@@ -837,7 +837,7 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
- REFERENCE: REQ-PKI-AAC-01
- REQUIREMENT: Only authorized users shall be able to access product functionalities, stored data, and configuration data.
To achieve this, the product shall enforce identification and authentication mechanisms.
To achieve this, the product shall enforce identification and authentication mechanisms by implementing cryptographic mechanisms conform to the general state of the art as defined in Annex K.
- RATIONALE: Only authorized, identified, and authenticated users should be able to access product services and stored data. This addresses all relevant threats.
- APPLICABILITY: All use cases.
@@ -1411,7 +1411,7 @@ The assessment criteria for each security requirements are described in a struct
- Vulnerability scanning results, including the tools and vulnerability databases used.
- Recognized public vulnerability sources, vendor advisories, and product identification information used in the assessment.
- Vulnerability assessment records and conclusions produced in accordance with prEN 40000-1-3 [X].
- Product user guidance relied upon to prevent exploitation, where applicable.
-REQ-PKI-AAC-01Product user guidance relied upon to prevent exploitation, where applicable.
## 6.3 Secure by default configuration
## 6.3.1 SBDC - Access control
@@ -1617,7 +1617,7 @@ The assessment criteria for each security requirements are described in a struct
- REFERENCE: ACC-PKI-AAC-01
- OBJECTIVE:
Verify the product allows to create different user profiles (users with different access rights to functions, configuration, and stored data) for the roles defined by PKI policies, each with distinct credentials.
Verify the product allows to create different user profiles (users with different access rights to functions, configuration, and stored data) for the roles defined by PKI policies, each with distinct credentials protected using state of the art cryptographic mecanisms.
- PREPARATION:
Access to the administrative and user interfaces of the product.
- ACTIVITIES:
@@ -1630,6 +1630,7 @@ The assessment criteria for each security requirements are described in a struct
- If the account is not authorized to, attempt to read configuration data
- If the account is not authorized to, attempt to modify stored data
- If the account is not authorized to, attempt to modify configuration data
- Validate supporting cryptographic mecanisms following annex K assessment requirements.
- VERDICT:
- SUCCESS: if only correct identification and authentication allows access to the specific rights of a user profile, and only authorized users may read or modify stored data or configuration data, or perform protected actions.
- FAIL: if unauthorized access or incorrect rights assignment is detected.
