Commit c6a3f5c6 authored by Valerie Aurora's avatar Valerie Aurora
Browse files

Update Clause 5.6/6.6 Authentication and access control to revised structure 

closes #151
parent ff5eafed

EN-304-625.md

+50 −4
Original line number Diff line number Diff line
@@ -1051,6 +1051,22 @@ The product shall provide provide a method of securely updating the product via 


TODO



## 5.6 Authentication and access control



### 5.6.1 Overview



This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (d).



### 5.6.2 REQ-AAC-01: Authentication and access control provided by operational environment



#### 5.6.2.1 Requirement



The product shall provide methods by which the operational environment may implement any necessary authentication and access control to the product, and describe these methods in the documentation accompanying the product.



#### 5.6.2.2 Applicability



TODO



### 5.2.4 ER-MINI: Minimize impact on other devices and services



#### 5.2.4.1 Cybersecurity requirement
@@ -1082,10 +1098,6 @@ The product shall implement methods of detecting and mitigating denial of servic 


See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.



### 5.2.7 ER-AUTH: Authentication and access control



>> TODO: Fill in very limited authentication cybersecurity requirements (for remote management or self-update) and reference cross-vertical authentication standards when they exist.



### 5.2.7 ER-CDST: Confidentiality of data stored on the product



#### 5.2.7.1 Cybersecurity requirement
@@ -2107,6 +2119,40 @@ Otherwise FAIL 


Documentation and analysis of completeness.



## 6.6 Authentication and access control



### 6.6.1 Overview



This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (d).



### 6.6.2 REQ-AAC-01: Authentication and access control provided by operational environment



#### 6.6.2.1 Objective



Prevent unauthorized access.



#### 6.6.2.2 Preparation



Examine the documentation accompanying the product.



#### 6.6.2.3 Activities



For each method by which the operational environment may implement any necessary authentication and access control to the product, implement each method and attempt to access the product without the necessary authorization.



#### 6.6.2.4 Verdict



PASS if **all** the following are fulfilled:



* the technical documentation describes how the operational environment can provide any necessary authentication and access control to the product, and

* for every method described, attempts to access the product after implementing the method without the necessary authorization fail.



Otherwise FAIL



#### 6.6.2.5 Evidence



* Documentation accompanying product

* Logs of access attempts



### 6.2.13.4 MI-FDRP assessment



**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.