@@ -218,25 +218,10 @@ This section can include topic specific requirements.
### 5.3.1 Mitigations for user identity integrity
See [5.2.6 Role based authorisation](#526-role-based-authorisation)
### 5.3.2 Mitigations for ingested data integrity and confidentiality
***[REQ-INGEST-1]** The collected network element monitoring data shall be integrity and confidentiality protected.
***[REQ-INGEST-2]** The product shall protect data at rest.
***[REQ-INGEST-3]** The product shall protect data in transit.
***[REQ-INGEST-4]** When data relevant to monitoring, control, or security functions is transferred over connections not controlled by the product, the product shall provide measures appropriate to the intended and reasonably foreseeable use to protect the integrity and, where required, the confidentiality of that data.
### 5.3.3 Mitigations for managed device configuration integrity and confidentiality
***[REQ-CONF-1]** The product shall interface only through a [5.2.1 Secure channel].
***[REQ-CONF-2]** Where the product distributes or makes available configuration to managed devices
* The product shall ensure that the configuration is protected against unauthorized modification and disclosure;
* The product shall ensure that only the intended managed device can obtain and apply the relevant configuration;
* The prodcut shall ensure that the device can verify the integrity of the configuration.
***[REQ-CONF-3]** The configuration interfacing design shall enable the managed device to verify the authenticity of the product.
@@ -1149,8 +1149,6 @@ Distributed application design and delay lines built with buffers might tolerate
## 5.6 Authentication and access control
<mark>_Proposed ESR code: AAC_</mark>
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (d).
Authorization is the final step that assigns execution and access rights to resources to a user.
@@ -1260,10 +1258,13 @@ How the retake of the authority is implemented is between the product and the de
## 5.7 Confidentiality protection
<mark>_Proposed ESR code: CON_</mark>
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (e).
***CON_INGEST-1** The collected network element monitoring data shall be integrity and confidentiality protected.
***CON_INGEST-2** The product shall protect data at rest.
***CON_INGEST-3** The product shall protect data in transit.
***CON_INGEST-4** When data relevant to monitoring, control, or security functions is transferred over connections not controlled by the product, the product shall provide measures appropriate to the intended and reasonably foreseeable use to protect the integrity and, where required, the confidentiality of that data.
<mark>Editor's Note:In this clause, reference can be made to the Annex K (normative), specifying State Of The Art Cryptography.</mark>
## 5.8 Integrity protection
@@ -1272,6 +1273,13 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (f).
***[INT_CONF-1]** The product shall interface only through a [5.2.1 Secure channel].
***[INT_CONF-2]** Where the product distributes or makes available configuration to managed devices
* The product shall ensure that the configuration is protected against unauthorized modification and disclosure;
* The product shall ensure that only the intended managed device can obtain and apply the relevant configuration;
* The prodcut shall ensure that the device can verify the integrity of the configuration.
***[INT_CONF-3]** The configuration interfacing design shall enable the managed device to verify the authenticity of the product.
