@@ -972,6 +972,26 @@ The product may provide security functions that the operational environment may
> NOTE: The scope of this standard could be potentially be extended to cover products whose intended purpose and reasonably foreseeable use requires authentication and access control in their secure-by-default configuration. One way to do this is to copy the relevant requirements from related standards, such as those for routers or firewalls.
## 5.7 Confidentiality protection
### 5.7.1 Overview
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (e).
### 5.7.2 REQ-CP-01: Confidentiality protection provided by operational environment
#### 5.7.2.1 Requirement
The product shall provide methods by which the operational environment may protect the confidentiality of data transmitted by or stored on the product that is necessary to the cybersecurity of the product.
#### 5.7.2.2 Applicability
TODO
#### 5.7.2.3 Guidance
The product may provide security functions that the operational environment may make use of to provide confidentiality protection for a product that integrates this product as a component. But products in the scope of the present document are not required to provide confidentiality protection independently of their operational environment.
### 5.2.4 ER-MINI: Minimize impact on other devices and services
#### 5.2.4.1 Cybersecurity requirement
@@ -1003,80 +1023,6 @@ The product shall implement methods of detecting and mitigating denial of servic
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.7 ER-CDST: Confidentiality of data stored on the product
#### 5.2.7.1 Cybersecurity requirement
The product shall protect data stored on the product from unauthorized access.
#### 5.2.7.2 MI-CDST: Protect confidentiality of data stored on the product
>> TODO: This is a blanket mitigation that is too vague and high-level. Public comment or delegate activity is needed to contribute more detailed and specific mitigations.
The product shall protect data stored on the product from unauthorized access.
Guidance: This may include keys, firmware, configuration, packets, credentials, and data stored in volatile or non-volatile memory or storage.
* Reference: ER-CDST
* Objective: Confidentiality of data
* Preparation: List all types of data that may be stored on the product that should not be readable without authorization, what methods of ensuring confidentiality are appropriate for each type, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each type of data and each access mechanism, determine the method of ensuring confidentiality used, and attempt to read the data without authorization
* Verdict: If all methods of ensuring confidentiality match the type of the data stored, and all the attempts to read confidential data without authorization fail => PASS, otherwise => FAIL
* Evidence: Logs of determination of type of data and method of confidentiality and attempts to read confidential data without authorization
Guidance: Data may be protected by the environment, permissions, encryption, salting and hashing, offline storage, or hardware-backed secrets.
#### 5.2.7.3 Mapping of mitigations to risk factors and security profiles
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.8 ER-CDTX: Confidentiality of data transmitted by product
#### 5.2.8.1 Cybersecurity Requirement
The product shall protect data transmitted by the product from unauthorized access.
#### 5.2.8.2 MI-CDTX: Protect confidentiality of data transmitted by product
>> TODO: This is a blanket mitigation that is too vague and high-level. Public comment or delegate activity is needed to contribute more detailed and specific mitigations.
The product shall protect data transmitted by the product from unauthorized access on the local network.
Guidance: Protecting confidentiality of data transmitted across indirectly attached networks is not the responsibility of the network interface.
* Reference: ER-CDTX
* Objective: Confidentiality of data
* Preparation: List all types of data that may be transmitted on the product that should not be readable without authorization, what methods of ensuring confidentiality are appropriate for each type, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each type of data and each access mechanism, determine the method of ensuring confidentiality used, and attempt to read the data without authorization
* Verdict: If all methods of ensuring confidentiality match the type of the data transmitted, and all the attempts to read confidential data without authorization fail => PASS, otherwise => FAIL
* Evidence: Logs of determination of type of data and method of confidentiality and attempts to read confidential data without authorization
Guidance: Data transmitted may be protected by the environment or encryption.
#### 5.2.8.3 MI-DOCC: Document transfer of risk of confidentiality of data transmitted by product
The product shall be accompanied by documentation informing the user of the transfer of risk for protecting the confidentiality of data transmitted by the product.
* Reference: ER-CDTX
* Objective: Protect data confidentiality
* Activities: Examine the documentation
* Verdict: Transfer of risk documented in a manner appropriate to the user => PASS, otherwise FAIL
* Evidence: Documentation, analysis of documentation
#### 5.2.8.4 Mapping of mitigations to risk factors and security profiles
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.10 ER-IDST: Integrity of data stored on the product
#### 5.2.10.1 Cybersecurity requirement
@@ -1985,6 +1931,56 @@ Otherwise FAIL
* Records of configuration, input, and/or preparation for each test
* Logs of access attempts and their results
## 6.7 Confidentiality protection
### 6.7.1 Overview
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (e).
### 6.7.2 REQ-CP-01: Confidentiality protection provided by operational environment
#### 6.7.2.1 Objective
Protect confidentiality of data transmitted by or stored on the product.
#### 6.7.2.2 Preparation
Identify methods the product provides for confidentiality protection of cybersecurity-relevant product assets. Identify an operational environment that permits testing these methods. Identify product assets that require confidentiality protection. For each identified asset, identify the methods to protect its confidentiality and any necessary configuration, inputs, or other preparation for testing confidentiality protection of that product asset. Install the product in the identified operational environment.
#### 6.7.2.3 Activities
For each method and each type of data identified, carry out the identified testing preparations and attempt to read the confidentiality protected data without the necessary authorization.
#### 6.7.2.4 Verdict
PASS if every attempt to read the confidentiality protected data without the necessary authorization fails.
Otherwise FAIL
#### 6.7.2.5 Evidence
* Descriptions of types of data requiring confidentiality protection
* Records of configuration, input, and/or preparation for each test
* Logs of read attempts and their results
#### 6.7.2.6 Guidance
Many products in the scope of the present document require data confidentiality protection only on data assets that are only accessible from the host system, which is usually trusted. E.g., encryption keys stored on the network interface may only be transmitted to and from the host system over the host system bus. In this situation, a cybersecurity risk assessment may conclude that, for the product integrating the network interface, the risk of an threat actor reading the data transmitted over the system bus is already low enough to present an acceptable risk without further treatment.
Examples of data that might need to be protected by the operational environment:
* Firmware on a physical network device
* Software comprising a virtual network device
* Contents of memory in the product
* Confidential cryptographic materials stored on the device
* Packet data while it is being copied (transmitted over the system bus) from the host to the network interface
Examples of attempts to read data without authorization:
* Use the operating system interface to read cryptographic material from the product without necessary operating system privileges
* Attempt to read the memory mapped to the network interface's registers and memory without the necessary memory permissions
* Attempt to decrypt encrypted data sent over the network without the private cryptographic key
### 6.2.13.4 MI-FDRP assessment
**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.
