Only interfaces that would be exposed to unauthorized users need be disabled or protected. Which interfaces are determined by the intended purpose and reasonably foreseeble use specified by the manufacturer, and the manufacturer's risk assessment.
## 5.5 Security updates
### 5.5.1 Overview
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (c).
### 5.5.2 REQ-SU-01 (MI-SUOE): Secure update provided by operational environment
#### 5.5.2.1 Requirement
The product shall provide provide a method of securely updating the product via the operational environment before or during the time of first use.
#### 5.5.2.2 Applicability
TODO - how to express no need to update?
### 5.2.4 ER-MINI: Minimize impact on other devices and services
#### 5.2.4.1 Cybersecurity requirement
@@ -965,75 +981,6 @@ The product shall implement methods of detecting and mitigating denial of servic
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.6 ER-SCUD: Secure updates
#### 5.2.6.1 Cybersecurity requirement
The product shall be securely updatable by the user.
>> TODO: Specification of how secure updates can be done securely is in progress.
#### 5.2.6.2 MI-SUDC: Documentation of secure update
The product shall be accompanied by documentation of the secure update methods for any firmware or software in the product.
* Applicability: Product expected use is long enough to require updates
* Reference: ER-SCUD
* Objective: Prevent exploitation of known vulnerabilities
* Activities: Assess the documentation for completeness
* Verdict: Documentation describes secure update methods sufficiently for a third party to implement them => PASS, otherwise FAIL
* Evidence: Documentation and analysis of completeness
#### 5.2.6.3 MI-SUVP: Secure update via product
The product shall provide a method of securely updating any firmware or software in the product via the product itself.
* Applicability: Product expected use is long enough to require updates
* Reference: ER-SCUD
* Objective: Prevent exploitation of known vulnerabilities
* Preparation: Prepare an update for each part of the product that can be updated with a different version number from the currently installed product version
* Activities: Check the versions of all parts of the product that can be updated, install the new update, and check the versions again
* Verdict: The second versions read are that of the new product update => PASS, otherwise FAIL
* Evidence: New update version numbers, and log of querying the product parts' versions, installing the update, and querying the versions again
#### 5.2.6.4 MI-SUAP: Automatic secure update via product
The product shall provide a method of automatically securely updating any firmware or software in the product via the product itself with an option for the user to disable automatic updates.
* Applicability: Product expected use is long enough to require updates
* Reference: ER-SCUD
* Objective: Prevent exploitation of known vulnerabilities
* Preparation: Prepare an update for each part of the product that can be updated with a different version number from the currently installed product version
* Activities: Check the versions of all parts of the product that can be updated, create the conditions that allow automatic secure update to occur, check the versions again, then repeat except disabling automatic updates
* Verdict: For the first test, the second versions read are that of the new product update, and for the second test with automatic updates disabled, the second versions read are the same as the first versions read => PASS, otherwise FAIL
* Evidence: New update version numbers, and log of querying the product parts' versions, installing the update, and querying the versions again
#### 5.2.6.5 MI-SUOE: Secure update provided by operational environment
The technical documentation provided with the product shall document that the operational environment shall provide a method of securely updating the product.
* Applicability: Product expected use is long enough to require updates
* Reference: ER-SCUD
* Objective: Prevent exploitation of known vulnerabilities
* Activities: Assess the documentation provided with the product
* Verdict: Documentation describes cybersecurity requirements for the secure updates provided by the operational environment => PASS, otherwise FAIL
* Evidence: Documentation and analysis of completeness
#### 5.2.6.6 MI-SUAO: Automatic secure update provided by operational environment
The technical documentation provided with the product shall document that the operational environment shall provide a method of automatically securely updating the product with an option for the user to disable automatic updates.
* Applicability: Product expected use is long enough to require updates
* Reference: ER-SCUD
* Objective: Prevent exploitation of known vulnerabilities
* Activities: Assess the documentation provided with the product
* Verdict: Documentation describes cybersecurity requirements for automatic secure updates provided by the operational environment => PASS, otherwise FAIL
* Evidence: Documentation and analysis of completeness
#### 5.2.6.7 Mapping of mitigations to risk factors and security profiles
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.7 ER-AUTH: Authentication and access control
>> TODO: Fill in very limited authentication cybersecurity requirements (for remote management or self-update) and reference cross-vertical authentication standards when they exist.
@@ -1952,6 +1899,42 @@ Otherwise FAIL
* Sufficiency analysis of documentation of necessity for any unauthorized access for backward compatibility, if any
* Sufficiency analysis of instructions to user for mitigating risks, if any
## 6.5 Security updates
### 6.5.1 Overview
This clause provides assessment for the requirements in 5.14 relating to CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (c).
### 6.5.2 REQ-SU-01 (MI-SUOE) Secure update provided by operational environment
#### 6.5.2.1 Objective
Prevent exploitation of known vulnerabilities.
#### 6.5.2.2 Preparation
Identify methods the product provides for installing updates. Identify an operational environment that permits testing these methods. Set up the product in the identified operational environment. Identify a method to verify the installation of an update (e.g., read a version number from the product). Identify an update that is not yet installed on the product.
#### 6.5.2.3 Activities
Install the identified update for the product and use the identified method to verify it.
#### 6.5.2.4 Verdict
PASS if verification of the installation of the update succeds.
Otherwise FAIL
#### 6.5.2.5 Evidence
* Logs of reading original and updated version of product
* Security update file(s)
* Logs of update installation process
#### 6.5.2.6 Guidance
A method of assessment might be: install one version of the firmware, read the version number from the logs of the host system, then install a different version of the firmware and read the version number from that.
### 6.2.13.4 MI-FDRP assessment
**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.
