@@ -786,7 +786,7 @@ This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 P
- APPLICABILITY: All use cases.
## 5.3 Secure by default configuration
### 5.3.1 General requirements
### 5.3.1 SDBC- Access control
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (b).
@@ -1426,10 +1426,135 @@ The assessment criteria for each security requirements are described in a struct
- [GUIDANCE] Product user guidance relied upon to prevent exploitation, where applicable.
## 6.3 Secure by default configuration
Assements covered in other sections:
- Other monitoring and certificate issuance assessment requirements
- Annex K assessment requirements
## 6.3.1 SBDC - Access control
- REFERENCE: ACC_PKI_SBDC_01
- OBJECTIVE:
- Verify that all system assets are identified as protected assets and that the default access control policy is configured to deny access unless an explicit permission is granted.
- PREPARATION:
- System architecture documentation and asset inventory.
- Default access control policies, role definitions, and authorization matrices.
- Administrator documentation describing access control configuration.
- Default user accounts with different privilege levels, including unauthenticated and unauthorized accounts.
- ACTIVITIES:
- Review the asset inventory and identify all system assets requiring access protection.
- Review access control configurations and verify that the default decision for all protected assets is DENY.
- Verify that access permissions are granted only through explicit authorization rules.
- Attempt to access protected assets using unauthenticated and unauthorized accounts.
- Verify that access requests without explicit permissions are denied in a deterministic manner.
- VERDICT:
- SUCCESS:
- All identified assets are configured by default as protected assets.
- The default access condition for all assets is DENY.
- Access is permitted only when explicitly authorized.
- Unauthorized access attempts are consistently denied.
- FAIL:
- One or more assets are not protected.
- The default policy allows access without explicit authorization.
- Unauthorized access attempts result in successful access or inconsistent behavior.
- EVIDENCE:
- System architecture and asset inventory documents.
- Access control policy configuration files.
- Role and permission matrices.
- Screenshots or configuration exports showing default DENY settings.
- Test execution records and access attempt logs.
## 6.3.2 SBDC - Monitoring
- REFERENCE: ACC-PKI-SBDC-02
- OBJECTIVE:
Verify that audit log integrity protection mechanisms are enabled by default and are executed automatically at least once every 24 hours.
- PREPARATION:
- Audit logging and monitoring configuration documentation.
- (If available) Documentation describing the audit integrity protection mechanism.
- System scheduling and logging configurations.
- Test environment with audit logging enabled.
- ACTIVITIES:
- Review the audit logging configuration.
- Verify that audit log integrity protection is enabled by default.
- Review scheduler configuration and verify that integrity protection events are configured to execute once every 24 hours.
- Observe system operation or examine generated records to confirm execution of the integrity protection event when reaching expecting activation time (manually set system time if necessary).
- Verify that evidence of execution is retained in logs or reports.
- VERDICT:
- SUCCESS:
- Audit log integrity protection is enabled by default.
- The integrity protection event is automatically executed at least once every 24 hours.
- Execution records are generated and retained.
- FAIL:
- Integrity protection is disabled by default.
- The integrity protection event is not scheduled or does not execute daily.
- No evidence of execution can be produced.
- EVIDENCE:
- Audit logging configuration files.
- Scheduler or cron configuration.
- System logs showing execution timestamps.
- Integrity verification reports.
- Screenshots or configuration exports demonstrating default settings.
## 6.3.3 SBDC - Cryptography
- REFERENCE: ACC-PKI-SBDC-03
- OBJECTIVE:
- Verify that all cryptographic mechanisms are configured by default using algorithms, key lengths, protocols, and parameters that conform to the requirements specified in Annex K.
- PREPARATION:
- Cryptographic architecture documentation.
- Default security configuration files.
- (If available) Tools capable of inspecting cryptographic configurations and certificates.
- ACTIVITIES:
- Identify all cryptographic mechanisms implemented by the system.
- Review default cryptographic configurations, including algorithms, protocols, key lengths, and operational parameters.
- Compare the default configurations against Annex K assessment requirements.
- Verify that deprecated, weak, or non-approved cryptographic mechanisms are not enabled by default.
- Verify that cryptographic defaults remain compliant following installation or initialization.
- VERDICT:
- SUCCESS:
- All cryptographic mechanisms use algorithms and parameters conformant with Annex K assessment requirements.
- Default installation results in a compliant cryptographic configuration.
- FAIL:
- One or more cryptographic mechanisms do not conform to Annex K requirements.
- Default configurations require manual modification to achieve compliance.
- EVIDENCE:
- Cryptographic architecture documentation.
- Default configuration files.
- Configuration exports and screenshots.
- Cryptographic parameter inspection outputs.
- Mapping of implemented mechanisms to Annex K requirements.
- Test reports demonstrating default compliance.
## 6.3.4 SBDC - Certificates
- REFERENCE: ACC-PKI-SBDC-04
- OBJECTIVE:
- Verify that the default certificate issuance configuration limits certificate validity periods to a maximum of three years.
- PREPARATION:
- Certificate management documentation.
- Defaualt certificate issuance policy and configuration files.
- Environment capable of generating certificates using default settings.
- Tools to parse certificate content.
- ACTIVITIES:
- Review the certificate issuance configuration and policies.
- Verify that the default certificate validity period is configured to be no greater than three years.
- Generate one or more certificates using default settings.
- Inspect the generated certificates and calculate the validity period using the `Not Before` and `Not After` fields or any other field providing validity duration..
- Verify that no certificate generated using default settings exceeds three years of validity.
- VERDICT:
- SUCCESS:
- The default certificate validity period is configured to a maximum of three years.
- Certificates generated using default settings do not exceed three years of validity.
- FAIL:
- The default configuration allows certificate validity periods exceeding three years.
- Certificates generated using default settings exceed the permitted validity period.
- EVIDENCE:
- Certificate issuance policies and configuration files.
- Generated test certificates.
- Certificate inspection outputs (`Not Before` and `Not After` values).
- Screenshots or configuration exports showing default validity settings.
- Test execution records and assessment report.
## 6.4 Secure updates
- REFERENCE: ACC_PKI_SU_01
@@ -4017,7 +4142,7 @@ provided in the documentation that a suitable algorithm has been implemented for
##### K.1.2.5.3 Assessment activities:
For every security mechanism and for every used algorithm, which is reachable over an interface of the product and identified as not included in CRY- SOTA, the documentation shall provide evidence:
- that this algorithm is applicable and suitable for the respective use case
- that no CRY-SOTA algorithm is applicable // DO WE KEEP THIS? (GDC)
