Added use-case mapping to requirements based on annex B (78c5175b) · Commits · STAN4CRA / EN 304 621 Network Management Systems

EN-304-621.md

+79 −63

Original line number	Diff line number	Diff line
		@@ -850,7 +850,7 @@ That is mostly a browser, but sometimes also other possibilities are deployed, s
		* Function: Connect home devices to the local network and to the public network
		* Network connectivity: Filtered private network

		**Table
		Table 4.6.1-1: UC-1-HOME classification

		\| ID \| Risk factor \| Classification \|
		\| --------------- \| --------------------------- \| -------------- \|
		@@ -1267,7 +1267,6 @@ The integrity and authenticity of delivered content and configuration, the stren
		\| RF-NUM \| Number of elements \| Medium \|
		\| RF-ADMIN \| Administration skill \| Medium \|


		# 5 Technical requirements for the Products

		## 5.1 Introduction - Applicability of the requirements
		@@ -1282,67 +1281,84 @@ When requirements are divided into low-medium-high categories, the categories ar
		Medium requirement level shall implement also requirements listed in low level.
		High requirement level shall implement all requirements in the defined set of requirements as the requirements are cumulative.

		Table 5.1-1: Mapping of all use-cases to requirement sets

		\| Use-case \| Requirement set \| required level \|
		\| :---------- \| --------------- \| --------------- \|
		\| UC-1-HOME, \| CYB_GENERAL \| low \|
		\| UC-2-ENTER \| CYB_GENERAL \| low/medium/high \|
		\| UC-3-TELCO \| CYB_GENERAL \| high \|
		\| UC-4-SDN \| CYB_GENERAL \| low/medium/high \|
		\| UC-5-HYBRID \| CYB_GENERAL \| low/medium/high \|
		\| UC-6-IOT \| CYB_GENERAL \| low/medium/high \|
		\| UC-7-ICT \| CYB_GENERAL \| medium/high \|
		\| UC-8-FLEET \| CYB_GENERAL \| medium/high \|
		\| all \| CYB_OPS \| all \|
		\| all \| KEV_EXPLOIT \| all \|
		\| all \| SBD_TECH \| all \|
		\| all \| SU_UPDATES \| all \|
		\| all \| AAC_AUTH \| all \|
		\| all \| AAC_MACHINE \| all \|
		\| all \| CON_INGEST \| all \|
		\| all \| CON_CRYPTO \| all \|
		\| all \| CON_CHANNEL \| all \|
		\| all \| INT_CONF \| all \|
		\| all \| INT_ROTATE \| all \|
		\| all \| DM_RETENTION \| all \|
		\| UC-1-HOME, \| AP_HA \| low \|
		\| UC-2-ENTER \| AP_HA \| low/medium/high \|
		\| UC-3-TELCO \| AP_HA \| high \|
		\| UC-4-SDN \| AP_HA \| low/medium/high \|
		\| UC-5-HYBRID \| AP_HA \| low/medium/high \|
		\| UC-6-IOT \| AP_HA \| low/medium/high \|
		\| UC-7-ICT \| AP_HA \| medium/high \|
		\| UC-8-FLEET \| AP_HA \| medium/high \|
		\| UC-1-HOME, \| IM_SEGMENT \| low \|
		\| UC-2-ENTER \| IM_SEGMENT \| low/medium/high \|
		\| UC-3-TELCO \| IM_SEGMENT \| high \|
		\| UC-4-SDN \| IM_SEGMENT \| low/medium/high \|
		\| UC-5-HYBRID \| IM_SEGMENT \| low/medium/high \|
		\| UC-6-IOT \| IM_SEGMENT \| low/medium/high \|
		\| UC-7-ICT \| IM_SEGMENT \| medium/high \|
		\| UC-8-FLEET \| IM_SEGMENT \| medium/high \|
		\| all \| MAS_TECH \| all \|
		\| UC-1-HOME, \| EMM_ROUTE \| low \|
		\| UC-2-ENTER \| EMM_ROUTE \| low/medium/high \|
		\| UC-3-TELCO \| EMM_ROUTE \| high \|
		\| UC-4-SDN \| EMM_ROUTE \| low/medium/high \|
		\| UC-5-HYBRID \| EMM_ROUTE \| low/medium/high \|
		\| UC-6-IOT \| EMM_ROUTE \| low/medium/high \|
		\| UC-7-ICT \| EMM_ROUTE \| medium/high \|
		\| UC-8-FLEET \| EMM_ROUTE \| medium/high \|
		\| UC-1-HOME, \| MON_LOG \| low \|
		\| UC-2-ENTER \| MON_LOG \| low/medium/high \|
		\| UC-3-TELCO \| MON_LOG \| high \|
		\| UC-4-SDN \| MON_LOG \| low/medium/high \|
		\| UC-5-HYBRID \| MON_LOG \| low/medium/high \|
		\| UC-6-IOT \| MON_LOG \| low/medium/high \|
		\| UC-7-ICT \| MON_LOG \| medium/high \|
		\| UC-8-FLEET \| MON_LOG \| medium/high \|
		\| all \| MON_METRICS \| all \|
		\| all \| DRT_DELETE \| all \|

		The selection of required level for low/medium/high and medium/high is described in [Annex B.5 Mapping of risk factors to use cases](#b5-mapping-of-risk-factors-to-use-cases).
		Table 5.1-1: Mapping of UC-1-HOME, UC-2-ENTER-S, UC-2-ENTER-M, UC-2-ENTER-L and UC-3-TELCO to a requirement set based on annex A security analysis

		\| Requirement set \| UC-1-HOME \| UC-2-ENTER-S \| UC-2-ENTER-M \| UC-2-ENTER-L \| UC-3-TELCO \|
		\| --------------- \| --------- \| ------------ \| ------------ \| ------------ \| ---------- \|
		\| CYB_GENERAL \| low \| medium \| high \| high \| high \|
		\| CYB_OPS \| all \| all \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \| all \| all \|
		\| AP_HA \| low \| medium \| medium \| medium \| high \|
		\| IM_SEGMENT \| low \| medium \| medium \| medium \| high \|
		\| MAS_TECH \| all \| all \| all \| all \| all \|
		\| EMM_ROUTE \| high \| high \| medium \| medium \| high \|
		\| MON_LOG \| low \| medium \| medium \| meidum \| high \|
		\| MON_METRICS \| all \| all \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \| all \| all \|

		> NOTE: Because (RF-ADMIN is High or RF-NUM is High) is true for both UC-1-HOME and UC-3-TELCO, both use cases require high risk level from EMM_ROUTE requirements.

		Table 5.1-2: Mapping of UC-4-SDN, UC-5-HYBRID, UC-6-IOT, UC-7-ICT and UC-8-FLEET to a requirement set based on annex A security analysis

		\| Requirement set \| UC-4-SDN \| UC-5-HYBRID \| UC-6-IOT \| UC-7-ICT \| UC-8-FLEET \|
		\| --------------- \| -------- \| ----------- \| -------- \| -------- \| ---------- \|
		\| CYB_GENERAL \| high \| high \| medium \| high \| medium \|
		\| CYB_OPS \| all \| all \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \| all \| all \|
		\| AP_HA \| high \| high \| medium \| medium \| high \|
		\| IM_SEGMENT \| high \| high \| medium \| medium \| low \|
		\| MAS_TECH \| all \| all \| all \| all \| all \|
		\| EMM_ROUTE \| high \| high \| medium \| medium \| high \|
		\| MON_LOG \| high \| high \| medium \| medium \| high \|
		\| MON_METRICS \| all \| all \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \| all \| all \|

		Table 5.1-3: Mapping of UC-9-RESEARCH, UC-10-AIRGAP and UC-11-WATER to a requirement set based on annex A security analysis

		\| Requirement set \| UC-9-RESEARCH \| UC-10-AIRGAP \| UC-11-WATER \|
		\| --------------- \| ------------- \| ------------ \| ----------- \|
		\| CYB_GENERAL \| low \| low \| medium \|
		\| CYB_OPS \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \|
		\| AP_HA \| none \| none \| low \|
		\| IM_SEGMENT \| none \| none \| low \|
		\| MAS_TECH \| all \| all \| all \|
		\| EMM_ROUTE \| none \| high \| medium \|
		\| MON_LOG \| none \| high \| low \|
		\| MON_METRICS \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \|

		The selection of required level for is described in [Annex B](#annex-b-informative-security-analysis).

		## 5.2 Appropriate level of cybersecurity

Original line number	Diff line number	Diff line
		@@ -850,7 +850,7 @@ That is mostly a browser, but sometimes also other possibilities are deployed, s
		* Function: Connect home devices to the local network and to the public network
		* Network connectivity: Filtered private network

		**Table
		Table 4.6.1-1: UC-1-HOME classification

		\| ID \| Risk factor \| Classification \|
		\| --------------- \| --------------------------- \| -------------- \|
		@@ -1267,7 +1267,6 @@ The integrity and authenticity of delivered content and configuration, the stren
		\| RF-NUM \| Number of elements \| Medium \|
		\| RF-ADMIN \| Administration skill \| Medium \|


		# 5 Technical requirements for the Products

		## 5.1 Introduction - Applicability of the requirements
		@@ -1282,67 +1281,84 @@ When requirements are divided into low-medium-high categories, the categories ar
		Medium requirement level shall implement also requirements listed in low level.
		High requirement level shall implement all requirements in the defined set of requirements as the requirements are cumulative.

		Table 5.1-1: Mapping of all use-cases to requirement sets

		\| Use-case \| Requirement set \| required level \|
		\| :---------- \| --------------- \| --------------- \|
		\| UC-1-HOME, \| CYB_GENERAL \| low \|
		\| UC-2-ENTER \| CYB_GENERAL \| low/medium/high \|
		\| UC-3-TELCO \| CYB_GENERAL \| high \|
		\| UC-4-SDN \| CYB_GENERAL \| low/medium/high \|
		\| UC-5-HYBRID \| CYB_GENERAL \| low/medium/high \|
		\| UC-6-IOT \| CYB_GENERAL \| low/medium/high \|
		\| UC-7-ICT \| CYB_GENERAL \| medium/high \|
		\| UC-8-FLEET \| CYB_GENERAL \| medium/high \|
		\| all \| CYB_OPS \| all \|
		\| all \| KEV_EXPLOIT \| all \|
		\| all \| SBD_TECH \| all \|
		\| all \| SU_UPDATES \| all \|
		\| all \| AAC_AUTH \| all \|
		\| all \| AAC_MACHINE \| all \|
		\| all \| CON_INGEST \| all \|
		\| all \| CON_CRYPTO \| all \|
		\| all \| CON_CHANNEL \| all \|
		\| all \| INT_CONF \| all \|
		\| all \| INT_ROTATE \| all \|
		\| all \| DM_RETENTION \| all \|
		\| UC-1-HOME, \| AP_HA \| low \|
		\| UC-2-ENTER \| AP_HA \| low/medium/high \|
		\| UC-3-TELCO \| AP_HA \| high \|
		\| UC-4-SDN \| AP_HA \| low/medium/high \|
		\| UC-5-HYBRID \| AP_HA \| low/medium/high \|
		\| UC-6-IOT \| AP_HA \| low/medium/high \|
		\| UC-7-ICT \| AP_HA \| medium/high \|
		\| UC-8-FLEET \| AP_HA \| medium/high \|
		\| UC-1-HOME, \| IM_SEGMENT \| low \|
		\| UC-2-ENTER \| IM_SEGMENT \| low/medium/high \|
		\| UC-3-TELCO \| IM_SEGMENT \| high \|
		\| UC-4-SDN \| IM_SEGMENT \| low/medium/high \|
		\| UC-5-HYBRID \| IM_SEGMENT \| low/medium/high \|
		\| UC-6-IOT \| IM_SEGMENT \| low/medium/high \|
		\| UC-7-ICT \| IM_SEGMENT \| medium/high \|
		\| UC-8-FLEET \| IM_SEGMENT \| medium/high \|
		\| all \| MAS_TECH \| all \|
		\| UC-1-HOME, \| EMM_ROUTE \| low \|
		\| UC-2-ENTER \| EMM_ROUTE \| low/medium/high \|
		\| UC-3-TELCO \| EMM_ROUTE \| high \|
		\| UC-4-SDN \| EMM_ROUTE \| low/medium/high \|
		\| UC-5-HYBRID \| EMM_ROUTE \| low/medium/high \|
		\| UC-6-IOT \| EMM_ROUTE \| low/medium/high \|
		\| UC-7-ICT \| EMM_ROUTE \| medium/high \|
		\| UC-8-FLEET \| EMM_ROUTE \| medium/high \|
		\| UC-1-HOME, \| MON_LOG \| low \|
		\| UC-2-ENTER \| MON_LOG \| low/medium/high \|
		\| UC-3-TELCO \| MON_LOG \| high \|
		\| UC-4-SDN \| MON_LOG \| low/medium/high \|
		\| UC-5-HYBRID \| MON_LOG \| low/medium/high \|
		\| UC-6-IOT \| MON_LOG \| low/medium/high \|
		\| UC-7-ICT \| MON_LOG \| medium/high \|
		\| UC-8-FLEET \| MON_LOG \| medium/high \|
		\| all \| MON_METRICS \| all \|
		\| all \| DRT_DELETE \| all \|

		The selection of required level for low/medium/high and medium/high is described in [Annex B.5 Mapping of risk factors to use cases](#b5-mapping-of-risk-factors-to-use-cases).
		Table 5.1-1: Mapping of UC-1-HOME, UC-2-ENTER-S, UC-2-ENTER-M, UC-2-ENTER-L and UC-3-TELCO to a requirement set based on annex A security analysis

		\| Requirement set \| UC-1-HOME \| UC-2-ENTER-S \| UC-2-ENTER-M \| UC-2-ENTER-L \| UC-3-TELCO \|
		\| --------------- \| --------- \| ------------ \| ------------ \| ------------ \| ---------- \|
		\| CYB_GENERAL \| low \| medium \| high \| high \| high \|
		\| CYB_OPS \| all \| all \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \| all \| all \|
		\| AP_HA \| low \| medium \| medium \| medium \| high \|
		\| IM_SEGMENT \| low \| medium \| medium \| medium \| high \|
		\| MAS_TECH \| all \| all \| all \| all \| all \|
		\| EMM_ROUTE \| high \| high \| medium \| medium \| high \|
		\| MON_LOG \| low \| medium \| medium \| meidum \| high \|
		\| MON_METRICS \| all \| all \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \| all \| all \|

		> NOTE: Because (RF-ADMIN is High or RF-NUM is High) is true for both UC-1-HOME and UC-3-TELCO, both use cases require high risk level from EMM_ROUTE requirements.

		Table 5.1-2: Mapping of UC-4-SDN, UC-5-HYBRID, UC-6-IOT, UC-7-ICT and UC-8-FLEET to a requirement set based on annex A security analysis

		\| Requirement set \| UC-4-SDN \| UC-5-HYBRID \| UC-6-IOT \| UC-7-ICT \| UC-8-FLEET \|
		\| --------------- \| -------- \| ----------- \| -------- \| -------- \| ---------- \|
		\| CYB_GENERAL \| high \| high \| medium \| high \| medium \|
		\| CYB_OPS \| all \| all \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \| all \| all \|
		\| AP_HA \| high \| high \| medium \| medium \| high \|
		\| IM_SEGMENT \| high \| high \| medium \| medium \| low \|
		\| MAS_TECH \| all \| all \| all \| all \| all \|
		\| EMM_ROUTE \| high \| high \| medium \| medium \| high \|
		\| MON_LOG \| high \| high \| medium \| medium \| high \|
		\| MON_METRICS \| all \| all \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \| all \| all \|

		Table 5.1-3: Mapping of UC-9-RESEARCH, UC-10-AIRGAP and UC-11-WATER to a requirement set based on annex A security analysis

		\| Requirement set \| UC-9-RESEARCH \| UC-10-AIRGAP \| UC-11-WATER \|
		\| --------------- \| ------------- \| ------------ \| ----------- \|
		\| CYB_GENERAL \| low \| low \| medium \|
		\| CYB_OPS \| all \| all \| all \|
		\| KEV_EXPLOIT \| all \| all \| all \|
		\| SBD_TECH \| all \| all \| all \|
		\| SU_UPDATES \| all \| all \| all \|
		\| AAC_AUTH \| all \| all \| all \|
		\| AAC_MACHINE \| all \| all \| all \|
		\| CON_INGEST \| all \| all \| all \|
		\| CON_CRYPTO \| all \| all \| all \|
		\| CON_CHANNEL \| all \| all \| all \|
		\| INT_CONF \| all \| all \| all \|
		\| INT_ROTATE \| all \| all \| all \|
		\| DM_RETENTION \| all \| all \| all \|
		\| AP_HA \| none \| none \| low \|
		\| IM_SEGMENT \| none \| none \| low \|
		\| MAS_TECH \| all \| all \| all \|
		\| EMM_ROUTE \| none \| high \| medium \|
		\| MON_LOG \| none \| high \| low \|
		\| MON_METRICS \| all \| all \| all \|
		\| DRT_DELETE \| all \| all \| all \|

		The selection of required level for is described in [Annex B](#annex-b-informative-security-analysis).

		## 5.2 Appropriate level of cybersecurity