Review update to 6.5.1 SU_UPDATE-1

### 6.5.1 SU_UPDATES-1

**Objective:** Prevent exploitation of known exploitable vulnerability

**Objective:** The product has functionality to be securely updated.

**Preparation:**

1. Examine public or private vulnerability information sources and select a recently fixed vulnerability (preferably the most recently fixed).

1. Have the product initialised and available with the default configuration and required credentials.

2. Provide an update package on the foreseen source.

**Activities:**

1. On a new product, carry out the initial secure update.

2. Scan the product to see if a recently fixed vulnerability has been fixed on the product.

3. Examine the documentation for the required info.

1. Either the product notifies the system user after the update package is made available, or, the assessor notifies the administrator about the availability.

2. Either the product itself or the system user updates the product with the package.

3. The product writes the event in the log file.

**Verdict:**

1. Pass if the secure update completes successfully

2. and the most recently fixed vulnerability is fixed

2. and the log entry is present

3. and the documentation includes all the required information

4. and the instructions are noting the custom requirements of the application, if any

5. and the interfaces connected during the update procedure are known

**Supporting Evidence:**

1. Documentation of vulnerability handling

1. Documentation of how to securely update the product

1. The report for the selected vulnerability

1. Description of how to scan for the vulnerability

1. Log of vulnerability scan results

1. Documentation of the update package provision and the system user notification

2. Documentation of the update conduct

3. Screenshot of the log entry.

### 6.5.2 SU_UPDATES-2