@@ -402,6 +402,7 @@ The overall risk related to each use case should be considered as a result of co
- EXP-3 Device ingestion API available in publicly connectible interface
- EXP-3 Device ingestion API available in publicly connectible interface
> <mark>Things to consider</mark>:
> <mark>Things to consider</mark>:
>
> 1. Interfaces or sources that are just used
> 1. Interfaces or sources that are just used
> 1. CM clients that are trusted
> 1. CM clients that are trusted
> 1. Carbage from authorized sources
> 1. Carbage from authorized sources
@@ -415,6 +416,7 @@ The overall risk related to each use case should be considered as a result of co
- ADM-2 IT generalist adminstrator (full or part time)
- ADM-2 IT generalist adminstrator (full or part time)
> <mark>Things to consider</mark>:
> <mark>Things to consider</mark>:
>
> 1. How well the admin knows the company?
> 1. How well the admin knows the company?
> 1. Is this a quality thing for the product? If so, should be removed.
> 1. Is this a quality thing for the product? If so, should be removed.
@@ -428,26 +430,30 @@ The overall risk related to each use case should be considered as a result of co
> NOTE: Remote data processing effects the risks associated with a product in ways that cannot be covered entirely by risk factors focused on the physical product. These intrinsic risks of the Remote Data Processing Solution are the result of its remote nature and must be considered as distinct risk factors.
> NOTE: Remote data processing effects the risks associated with a product in ways that cannot be covered entirely by risk factors focused on the physical product. These intrinsic risks of the Remote Data Processing Solution are the result of its remote nature and must be considered as distinct risk factors.
#### 4.5.1.5 Governance Complexity of Remote Data Processing Solutions
#### 4.5.1.5 Complexity of Remote Data Processing Solutions
**\[GRDPS]**: The complexity of the RDPS is an aggregate of the degree of control the manufacturer has over the RDPS, and the number of parties with access to the RDPS.
**\[CRDPS]**: The complexity of the RDPS is an aggregate of the degree of control the manufacturer has over the RDPS, and the number of parties with access to the RDPS.
- CRDPS-0 Product performs no remote data processing.
- CRDPS-1 Product uses remote data processing solutions under the manufacturer’s sole administrative control.
- CRDPS-2 Product uses remote data processing solutions where parties other than the manufacturer have administrative control.
#### 4.5.1.5 Value of Data or Function of Remote Data Processing Solutions
- [GRDPS-0] Product RDPS features are fully under users control.
- [GRDPS-1] Product uses remote data processing solutions under the manufacturer’s administrative control.
- [GRDPS-2] Product uses remote data processing solutions where parties other than the manufacturer have administrative control.
#### 4.5.1.6 Value of Data or Function of Remote Data Processing Solutions
**\[DRDPS]**: The nature and treatment of data transferred by the RDPS compounds the risk associated with RDPS, as do the functions that RDPS provides. Where data transferred is public, non-essential to user activity, or otherwise of little use or value, the impact of the RDPS's failure or breach is not substantial. Likewise, when the function of the RDPS is not essential to the continued use of the product risk is also low.
**\[DRDPS]**: The nature and treatment of data transferred by the RDPS compounds the risk associated with RDPS, as do the functions that RDPS provides. Where data transferred is public, non-essential to user activity, or otherwise of little use or value, the impact of the RDPS's failure or breach is not substantial. Likewise, when the function of the RDPS is not essential to the continued use of the product risk is also low.
- DRDPS-1 Data transferred by and functions provided by RPDS are neither confidential or essential.
- DRDPS-2 Data transferred by RPDS or functions provided by RPDS are confidential or essential.
- [DRDPS-0]: No remote data processing (fully local operation)
- DRDPS-3 RPDS transfers the confidential data of or provides essential functions to multiple parties.
- [DRDPS-1]: Limited remote processing for non-sensitive data (configuration, preferences)
- [DRDPS-2]: Extended remote processing including sensitive data with strong security controls
- [DRDPS-3]: Full remote processing with critical data requiring maximum security
#### 4.5.1.7 Impact of Remote Data Processing Solution Compromise
#### 4.5.1.7 Impact of Remote Data Processing Solution Compromise
**\[IRDPS]**: The overall potential impact from the compromise of the remote Data Processing Solution.
**\[IRDPS]**: The overall potential impact from the compromise of the remote Data Processing Solution.
- IRDPS-1 Compromise of RPDS threatens harm to only a small number of customers and end users. The failure of the RPDS does not threaten essential, infrastructural or life sustaining services.
- IRDPS-2 Compromise of the RPDS threatens harm a significant number of customers and end users. The failure of the RPDS does not threaten essential, infrastructural or life sustaining services.
- [IRDPS-0] Compromise of RPDS threatens harm to only a small number of customers and end users. The failure of the RPDS does not threaten essential, infrastructural or life sustaining services.
- IRDPS-3 RPDS The failure of the RPDS may threaten essential, infrastructural or life sustaining products and services.
- [IRDPS-1] Compromise of the RPDS threatens harm a significant number of customers and end users. The failure of the RPDS does not threaten essential, infrastructural or life sustaining services.
- [IRDPS-2] RPDS The failure of the RPDS may threaten essential, infrastructural or life sustaining products and services.
> <mark>A Final Consideration</mark>: Do these Risk Factors cover the risk associated with the network activity all major activities of the SIEM system?
> <mark>A Final Consideration</mark>: Do these Risk Factors cover the risk associated with the network activity all major activities of the SIEM system?
@@ -460,7 +466,7 @@ The overall risk related to each use case should be considered as a result of co
| [UC-OP-1] On Premises SIEM system | 0-2 | 0-3 | 2 | 0 |
| [UC-OP-1] On Premises SIEM system | 0-2 | 0-3 | 2 | 0 |
| [UC-OP-2] On Premises MSSP system | 0-2 | 3 | 1 | 1 |
| [UC-OP-2] On Premises MSSP system | 0-2 | 3 | 1 | 1 |
| [UC-RS-1] Cloud Based System | 0-2 | 3 | 1 | 1 |
| [UC-RS-1] Cloud Based System | 0-2 | 3 | 1 | 1 |
@@ -550,7 +556,6 @@ Security functions provided by other components of a system to a SIEM product ma
<mark>Note:</mark>: Fix language here and rexamine some of these functions will be provided by other products outside the SIEM system (AV for example), but others of these are still essential functions of the SIEM system (storage) that may at tiems be provided by connected products, but at other times will be part of the SIEM system. Does this need to be broken out and explained?
<mark>Note:</mark>: Fix language here and rexamine some of these functions will be provided by other products outside the SIEM system (AV for example), but others of these are still essential functions of the SIEM system (storage) that may at tiems be provided by connected products, but at other times will be part of the SIEM system. Does this need to be broken out and explained?
### 4.10.2 Security functions provided to other products
### 4.10.2 Security functions provided to other products
Security functions a SIEM product may provide to other components of the system may include:
Security functions a SIEM product may provide to other components of the system may include:
@@ -568,7 +573,6 @@ Security functions a SIEM product may provide to other components of the system
<mark>Note</mark>: We may be removing this requirement as it is required as part of CRA requirements and outside of the standard's scope. Manufacturers must do this anyway?
<mark>Note</mark>: We may be removing this requirement as it is required as part of CRA requirements and outside of the standard's scope. Manufacturers must do this anyway?
> List technical security requirements for the product. Each requirement should be objectively verifiable on an instance of a product. Each should include an implementable method of verifying the requirement is met. Each should include a way to determine if the requirement is applicable to the product. Ideally each will include at least one concrete example of an implementation that satisfies the requirement and a test that verifies it. If the requirement allows the manufacturer to specify their own solution to the technical requirement, the requirement should include a specific way to measure the effectiveness of the risk mitigation and set a minimum level.
> List technical security requirements for the product. Each requirement should be objectively verifiable on an instance of a product. Each should include an implementable method of verifying the requirement is met. Each should include a way to determine if the requirement is applicable to the product. Ideally each will include at least one concrete example of an implementation that satisfies the requirement and a test that verifies it. If the requirement allows the manufacturer to specify their own solution to the technical requirement, the requirement should include a specific way to measure the effectiveness of the risk mitigation and set a minimum level.
@@ -654,17 +658,16 @@ For backwards compatibility, use of other combinations of options other what is
### 5.2.6 Remote Data Processing Systems
### 5.2.6 Remote Data Processing Systems
A remote data processing solution or "RDPS" is a component of a product that has an essential role in one or more of a product's functions and performs that role remotely from the local components of the product. While many product update methods may fit into the definition of an RDPS, product update requirements are considered seperately in term[5.3.4 Secure updates](#534-secure-updates) of this document.
A remote data processing solution (RDPS) is a component of a product that has an essential role in one or more of a product's functions and performs that role remotely from the local components of the product. While many product update methods may fit into the definition of an RDPS, product update requirements are considered separately in Section[5.3.4 Secure updates](#534-secure-updates) of this document.
All remote data processing solutions are a component of the product but its use is independent of the product's deployment environment.
All remote data processing solutions are components of the product, but their use is independent of the product's deployment environment.
While a product's employment of an RDPS may create additional security requirements related to its remote nature and effect the tools available to an assessor, use of an RDPS does not significantly change the security requirements associated with the product's use or functions. A remote data processing solution is a component of the product when it has been designed by or for the manufacturer or is in the manufacturers control, and it is necessary for the product to performs its intended functions.
While a product's employment of an RDPS may create additional security requirements related to its remote nature and affect the tools available to an assessor, use of an RDPS does not significantly change the security requirements associated with the product's use or functions. A remote data processing solution is a component of the product when it has been designed by or for the manufacturer or is in the manufacturer's control, and it is necessary for the product to perform its intended functions.
Remote data processing solutions can perform any function of the product, and are not limited to a product's core functions. Common uses of RDPS include remote storage of profile or configuration data, often to enable similar devices to use or access the data from a web interface.
A remote data processing solution is a component of the product when it has been designed by or for the manufacturer or is in the manufacturer's control, and it is necessary for the product to perform its intended functions. Remote data processing solutions can perform any function of the product and are not limited to a product's core functions. Common uses of RDPS include remote storage of profile or configuration data, often to enable similar devices to use or access the data from a web interface.
The system can also be a log storage or metrics collection endpoint, which is part of the product design, but those have a dedicated section in the present document with detailed requirements.
The system can also be a log storage or metrics collection endpoint, which is part of the product design, but those have dedicated sections in the present document with detailed requirements.
CRA applicability has as subtle difference in how the application is desigend.
The CRA has a subtle difference in how the application is designed. A website that is accessed with a browser is not in scope, but an online service which is used from an installed application is in scope.
A website that is accessed with a browser is not in scope, but a online service which is used from an installed application is in scope.
General risks to consider with RDPS:
General risks to consider with RDPS:
@@ -689,11 +692,115 @@ The CRA [\[i.1\]](#_ref_i.1) Article 3(2) defines that an RDPS is under the resp
RDPS sepcific requirements:
RDPS sepcific requirements:
-**[REQ-RDPS-0]** Product functionality is described in case connectivity to RDPS is not available.
-**[REQ-RDPS-0]:** Dependent RDPS systems are listed in the technical documentation.
-**[REQ-RDPS-1]** Data processed or stored in the RDPS is well defined.
-**[REQ-RDPS-0]:** Product functionality is described in case connectivity to RDPS is not available.
-**[REQ-RDPS-2]** Criticality of the processed or stored data is defined.
-**[REQ-RDPS-1]:** Data processed or stored in the RDPS is well defined.
-**[REQ-RDPS-3]** Important data can be recovered from redundant copies or from backups.
-**[REQ-RDPS-2]:** Criticality of the processed or stored data is defined.
-**[REQ-RDPS-4]** When local configuration of one or more RDPS endpoints is provided for the user, all assosiated security settings needs to be configurable at the same time.
-**[REQ-RDPS-3]:** Important data can be recovered from redundant copies or from backups.
-**[REQ-RDPS-4]:** When local configuration of one or more RDPS endpoints is provided for the user, all assosiated security settings needs to be configurable at the same time.
The manufactureer shall implement the requirements according to the following table:
