Update Clause 5.12/6.12 Attack surface minimisation to revised structure

This requirement operates at the link layer (IP) or data link layer and/or physical layer (OSI model). Interfaces of this type are relatively uncommon for the products in the scope of the present document and are mostly located outside the product, in higher layers of the network stack. Non-interference at higher layers in the network stack is the responsibility of the operational environment.

### 5.2.14 ER-LMAS: Minimize exposed interfaces

## 5.12 Attack surface minimisation

#### 5.2.14.1 Cybersecurity requirement

### 5.12.1 Overview

The product's exposed interfaces shall be minimized in the default configuration of the product in all operating modes, including initial configuration, during initialization, while in use, while shutting down or paused, or after reset.

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (j).

#### 5.2.14.2 MI-JSTY: Document and justify exposed interfaces

### 5.12.2 REQ-ASM-01 (MI-JSTY): Minimise attack surface

All exposed interfaces on the product in any state that is part of its reasonably foreseeable use or misuse in its secure-by-default configuration shall be documented. Every interface shall have a documented rationale for why its exposure is necessary for the functioning of the product in its secure-by-default configuration.

#### 5.12.2.1 Requirement

  * Reference: ER-LMAS

Exposure of interfaces on the product shall be minimised in its secure-by-default configuration.

  * Objective: Limit attack surface

#### 5.12.2.2 Applicability

  * Preparation: List all types of interfaces on the product that may be exposed to an attacker, whether enabled or disabled. For each type of interface, list all exposed interfaces of that type, and document the method or methods used to create and verify these lists. List all states of the product with different exposed interfaces of the product in its secure-by-default configuration, including but not limited to initial configuration, startup, in use, idle, shutdown, and reset, if applicable. For each distinct exposed interface in each state, describe the interface and why it has to be enabled by default.

  * Activities: Using the list of types of interfaces, the list of states of the product, list all exposed interfaces in each state, and document the method or methods used to create and verify this list. Compare the list of exposed interfaces by state to the documented list by type.

  * Verdict: All discovered interfaces are documented, including rationale => PASS, otherwise => FAIL

  * Evidence: List of types of interfaces, list of product states, documentation of each exposed interface, output of methods to list all exposed interfaces, connection between each discovered interface to its documentation

#### 5.2.14.3 Mapping of mitigations to risk factors and security profiles

See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.

TODO

### 5.2.15 ER-LOGG: Logging and monitoring

* Packet captures or other appropriate logs of the data transmitted

* Sufficiency analysis of analysis of amount of data in response

## 6.12 Attack surface minimisation

### 6.12.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (j).

### 6.12.2 REQ-ASM-01 (MI-JSTY): Minimise attack surface

#### 6.12.2.1 Objective

Minimise attack surface.

#### 6.12.2.2 Preparation

Identify all exposed interfaces in the product in its secure-by-default configuration, including different run-time states such as initial configuration, startup, in use, idle, shutdown, and reset, if applicable. Use appropriate tools and methodology to search for interfaces that may have accidentally or unintentionally exposed and that could reasonably be found by a threat actor under the conditions of the manufacturer's cybersecurity risk assessment.

#### 6.12.2.3 Activities

For each identified interface, analyse if the exposure of the interface is necessary for the product's intended purpose and reasonably foreseeable use in its secure-by-default configuration, connecting it to specific product functions and comparing with any obvious reasonable alternatives with smaller attack surface.

#### 6.12.2.4 Verdict

PASS if for each identified exposed interface, the analysis for exposure of the interface concludes that it is necessary and that there is no obvious reasonable alternative with smaller attack surface.

Otherwise FAIL

#### 6.12.2.5 Evidence

* Documentation of and rationale for search process for interfaces

* Logs of searches for interfaces

* List of identified interfaces

* Sufficiency analysis of rationale for interface search process

* Analysis of necessity of and alternatives to each identified interface

* Sufficiency analysis of necessity analysis for identified exposed interfaces

#### 6.12.2.5 Guidance

See Clause \[6.1.2\] "Guidance for identifying interfaces or data processing."

# Annex A (informative): Relationship between the present document and the CRA

<mark>Editor's Note: Even if informative, this Annex is mandatory in Harmonised Standards.</mark>