@@ -1000,6 +1000,59 @@ The product shall require authorization by default to access security-relevant a
|---------------------|----------------------|
| all | ADEF |
### 5.2.X **TR-CONF**: Confidentiality of assets
#### 5.2.X.x **MI-SCNF**: Confidentiality of data stored on the device
The device shall protect confidential data stored on the device from unauthorized access.
* Reference: TR-CONF
* Objective: Confidentiality of data
* Preparation: List all types of data that may be stored on the device that should not be readable without authorization, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each type of data and each access mechanism, attempt to read the data without authorization
* Verdict: If all the attempts to read confidential data fail => PASS, otherwise => FAIL
* Evidence: Logs of attempts to read confidential data with indication of success or failure
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
|---------------------|----------------------|
| any | SCNF |
| Security Profile | Requires mitigations |
|---------------------|----------------------|
| any | SCNF |
#### 5.2.X.x **MI-TCNF**: Confidentiality of data transmitted by device
The device shall protect data transmitted by the device from unauthorized access.
* Reference: TR-CONF
* Objective: Confidentiality of data
* Preparation: List all methods of transmitting confidential data, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each method of data transmission and each access mechanism, attempt to read the transmitted data without authorization
* Verdict: If all the attempts to read confidential data fail => PASS, otherwise => FAIL
* Evidence: Logs of attempts to read data transmitted with indication of success or failure
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
|---------------------|----------------------|
| any | TCNF |
| Security Profile | Requires mitigations |
|---------------------|----------------------|
| any | TCNF |
### 5.2.X **TR-XXXX**: Encryption related stuff
@@ -1078,7 +1131,7 @@ Suggested type of tests include, but are not limited to:
| Secure by default configuration | ADEF |
| Secure updates | |
| Authentication and access control mechanisms | |
| Confidentiality protection | |
| Confidentiality protection | SCNF, TCNF |
| Integrity protection for data and configuration | IMEM |
