Commit e0cefdc0 authored by Sammy Haddad's avatar Sammy Haddad
Browse files

Annex B

parent 7eda1d1a

EN-304-624.md

+26 −32
Original line number Diff line number Diff line
@@ -3246,6 +3246,8 @@ In assessing impact reasonable consideration has to be made for the use case in 


#### Deployment



The criticality of the environment in which a product is deployed influences its attractiveness as a target and, consequently, the likelihood of attacks. However, this effect is partially reduced by the fact that highly critical entities employ more robust security management and deployment practices.



<div align="center">



**Table B.4: Risk factor DEP**
@@ -3259,10 +3261,13 @@ In assessing impact reasonable consideration has to be made for the use case in 
  <tr>

    <td style="padding:7px; border:1px solid #ccc;">DEP-2</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Consumer use or non-critical use in enterprises.</td>

    <td style="padding:7px; border:1px solid #ccc;">Low</td>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">DEP-1</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Product use in critical environmment.</td>

   <td style="padding:7px; border:1px solid #ccc;">Medium</td>



  </tr>

</table>

</div>
@@ -3278,18 +3283,25 @@ In assessing impact reasonable consideration has to be made for the use case in 
  <tr style="background:#1F3864; color:white; font-weight:bold;">

    <th style="padding:8px; border:1px solid #ccc;">Risk factor</th>

    <th style="padding:8px; border:1px solid #ccc;">Description</th>

    <th style="padding:8px; border:1px solid #ccc;">Value</th>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">NET-2</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Enhanced network and physical security with continuous monitoring (EN 319 401 or stronger)</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Enhanced network and physical security with continuous monitoring (corresponding to POE.FullyControlled parameter)</td>

    <td style="padding:7px; border:1px solid #ccc;">Low</td>



  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">NET-1</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Standard enterprise network and physical security</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Standard enterprise network and physical security (corresponding to POE.PartiallyControlled parameter)</td>

      <td style="padding:7px; border:1px solid #ccc;">Medium</td>



  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">NET-0</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FF0000; color:red; font-weight:bold; text-align:center;">Limited network or physical security</td>

      <td style="padding:7px; border:1px solid #ccc;">High</td>



  </tr>

</table>

</div>
@@ -3298,50 +3310,28 @@ In assessing impact reasonable consideration has to be made for the use case in 


<div align="center">



**Table B.6: Risk factor NET**

**Table B.6: Risk factor USR**

</br>

<table style="border-collapse:collapse; width:100%; font-family:Arial; font-size:0.9em;">

  <tr style="background:#1F3864; color:white; font-weight:bold;">

    <th style="padding:8px; border:1px solid #ccc;">Risk factor</th>

    <th style="padding:8px; border:1px solid #ccc;">Description</th>

    <th style="padding:8px; border:1px solid #ccc;">Value</th>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">USR-2</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Skilled users with relevant experience and regular training (EN 319 401) or stronger</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Skilled users with relevant experience and regular training (corresponding to UE.SkilledUsers parameter).</td>

    <td style="padding:7px; border:1px solid #ccc;">High</td>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">USR-1</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Standard enterprise users with one-off or infrequent training</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Standard enterprise users with one-off or infrequent training (corresponding to UE.StandardUserCompetences parameter).</td>

    <td style="padding:7px; border:1px solid #ccc;">Medium</td>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">USR-0</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FF0000; color:red; font-weight:bold; text-align:center;">Unskilled users</td>

  </tr>

</table>

</div>



#### Operational security



<div align="center">



**Table B.7: Risk factor OPS**

</br>

<table style="border-collapse:collapse; width:100%; font-family:Arial; font-size:0.9em;">

  <tr style="background:#1F3864; color:white; font-weight:bold;">

    <th style="padding:8px; border:1px solid #ccc;">Risk factor</th>

    <th style="padding:8px; border:1px solid #ccc;">Description</th>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">OPS-2</td>

    <td style="padding:7px; border:1px solid #ccc; background:#00B050; color:green; font-weight:bold; text-align:center;">Enhanced policies and procedures with strict compliance regime (ETSI 319 401 or better)</td>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">OPS-1</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FFD700; color:yellow; font-weight:bold; text-align:center;">Standard enterprise policies and procedures with moderate compliance regime</td>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">OPS-0</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FF0000; color:red; font-weight:bold; text-align:center;">Limited policied and procedures</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FF0000; color:red; font-weight:bold; text-align:center;">Unskilled users (corresponding to UE.UnskilledUsers parameter).</td>

   <td style="padding:7px; border:1px solid #ccc;">High</td>

  </tr>

</table>

</div>
@@ -3356,6 +3346,8 @@ In assessing impact reasonable consideration has to be made for the use case in 
  <tr style="background:#1F3864; color:white; font-weight:bold;">

    <th style="padding:8px; border:1px solid #ccc;">Risk factor</th>

    <th style="padding:8px; border:1px solid #ccc;">Description</th>

    <th style="padding:8px; border:1px solid #ccc;">Value</th>

    <th style="padding:8px; border:1px solid #ccc;">Corresponding UC parameter</th>

  </tr>

  <tr>

    <td style="padding:7px; border:1px solid #ccc;">INT-2</td>
@@ -3368,6 +3360,8 @@ In assessing impact reasonable consideration has to be made for the use case in 
  <tr>

    <td style="padding:7px; border:1px solid #ccc;">INT-0</td>

    <td style="padding:7px; border:1px solid #ccc; background:#FF0000; color:red; font-weight:bold; text-align:center;">Remote interfaces accessible from public network</td>

    <td style="padding:7px; border:1px solid #ccc;">High</td>

    <td style="padding:7px; border:1px solid #ccc;">High</td>

  </tr>

</table>

</div>