@@ -1071,6 +1071,26 @@ The product shall provide methods by which the operational environment may imple
TODO
## 5.7 Confidentiality protection
### 5.7.1 Overview
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (e).
### 5.7.2 REQ-CP-01: Confidentiality provided by operational environment
#### 5.7.2.1 Requirement
The product shall provide methods by which the operational environment may implement any necessary confidentiality protection of data transmitted by or stored on the product, and describe these methods in the documentation accompanying the product.
#### 5.7.2.2 Applicability
TODO
#### 5.7.3 Guidance
The product may provide security functions that the operational environment may make use of to provide confidentiality protection for a product that integrates this product as a component. But products in the scope of the present document do not have the capability to provide confidentiality protection independently of their operational environment.
### 5.2.4 ER-MINI: Minimize impact on other devices and services
#### 5.2.4.1 Cybersecurity requirement
@@ -1102,80 +1122,6 @@ The product shall implement methods of detecting and mitigating denial of servic
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.7 ER-CDST: Confidentiality of data stored on the product
#### 5.2.7.1 Cybersecurity requirement
The product shall protect data stored on the product from unauthorized access.
#### 5.2.7.2 MI-CDST: Protect confidentiality of data stored on the product
>> TODO: This is a blanket mitigation that is too vague and high-level. Public comment or delegate activity is needed to contribute more detailed and specific mitigations.
The product shall protect data stored on the product from unauthorized access.
Guidance: This may include keys, firmware, configuration, packets, credentials, and data stored in volatile or non-volatile memory or storage.
* Reference: ER-CDST
* Objective: Confidentiality of data
* Preparation: List all types of data that may be stored on the product that should not be readable without authorization, what methods of ensuring confidentiality are appropriate for each type, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each type of data and each access mechanism, determine the method of ensuring confidentiality used, and attempt to read the data without authorization
* Verdict: If all methods of ensuring confidentiality match the type of the data stored, and all the attempts to read confidential data without authorization fail => PASS, otherwise => FAIL
* Evidence: Logs of determination of type of data and method of confidentiality and attempts to read confidential data without authorization
Guidance: Data may be protected by the environment, permissions, encryption, salting and hashing, offline storage, or hardware-backed secrets.
#### 5.2.7.3 Mapping of mitigations to risk factors and security profiles
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.8 ER-CDTX: Confidentiality of data transmitted by product
#### 5.2.8.1 Cybersecurity Requirement
The product shall protect data transmitted by the product from unauthorized access.
#### 5.2.8.2 MI-CDTX: Protect confidentiality of data transmitted by product
>> TODO: This is a blanket mitigation that is too vague and high-level. Public comment or delegate activity is needed to contribute more detailed and specific mitigations.
The product shall protect data transmitted by the product from unauthorized access on the local network.
Guidance: Protecting confidentiality of data transmitted across indirectly attached networks is not the responsibility of the network interface.
* Reference: ER-CDTX
* Objective: Confidentiality of data
* Preparation: List all types of data that may be transmitted on the product that should not be readable without authorization, what methods of ensuring confidentiality are appropriate for each type, all methods of accessing that data available to an attacker based on the risk assessment, and what the allowable authorization methods are for that access method
* Activities: For each type of data and each access mechanism, determine the method of ensuring confidentiality used, and attempt to read the data without authorization
* Verdict: If all methods of ensuring confidentiality match the type of the data transmitted, and all the attempts to read confidential data without authorization fail => PASS, otherwise => FAIL
* Evidence: Logs of determination of type of data and method of confidentiality and attempts to read confidential data without authorization
Guidance: Data transmitted may be protected by the environment or encryption.
#### 5.2.8.3 MI-DOCC: Document transfer of risk of confidentiality of data transmitted by product
The product shall be accompanied by documentation informing the user of the transfer of risk for protecting the confidentiality of data transmitted by the product.
* Reference: ER-CDTX
* Objective: Protect data confidentiality
* Activities: Examine the documentation
* Verdict: Transfer of risk documented in a manner appropriate to the user => PASS, otherwise FAIL
* Evidence: Documentation, analysis of documentation
#### 5.2.8.4 Mapping of mitigations to risk factors and security profiles
See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.10 ER-IDST: Integrity of data stored on the product
#### 5.2.10.1 Cybersecurity requirement
@@ -2157,6 +2103,52 @@ Otherwise FAIL
* Documentation accompanying product
* Logs of access attempts
## 6.7 Confidentiality protection
### 6.7.1 Overview
This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (e).
### 6.7.2 REQ-CP-01: Confidentiality provided by operational environment
#### 6.7.2.1 Objective
Protect confidentiality of data transmitted by or stored on the product.
#### 6.7.2.2 Preparation
Examine the documentation accompanying the product.
#### 6.7.2.3 Activities
For each method by which the operational environment may implement any necessary confidentiality protection for data transmitted by or stored on the product, implement each method and attempt to access the protected confidential data without the necessary authorization.
#### 6.7.2.4 Verdict
PASS if **all** the following are fulfilled:
* the technical documentation describes how the operational environment can provide any necessary confidentiality protection for data transmitted by or stored on the product, and
* for every method described, after implementing the method, attempts to access the relevant protected confidential data without the necessary authorization fail.
Otherwise FAIL
#### 6.7.2.5 Evidence
* Documentation accompanying product
* Records of enabling the data confidentiality protection method
* Logs of access attempts
#### 6.7.2.6 Guidance
Many products in the scope of the present document require data confidentiality protection only on data assets accessible from the host system. E.g. encryption keys stored on the network interface may only be transmitted to and from the host system over the host system bus. In this situation, a cybersecurity risk assessment may conclude that, for the product integrating the network interface, the risk of an threat actor reading the data transmitted over the system bus is already low enough to present an acceptable risk.
Examples of data that might need to be protected by the operational environment:
* Firmware on a physical network device
* Software comprising a virtual network device
* Confidential cryptographic materials stored on the device
* Packet data while it is being copied (transmitted over the system bus) from the host to the network interface, which is then encrypted by the network interface
### 6.2.13.4 MI-FDRP assessment
**[MI-FDRP]** Verify the product performs ordered validity checks on incoming packets and drops invalid packets before further processing.
