Update Clause 5.11/6.11 Non-interference to revised structure (was 5.2.4)

TODO

### 5.2.4 ER-MINI: Minimize impact on other devices and services

#### 5.2.4.1 Cybersecurity requirement

The product shall implement appropriate mitigations to minimize impact on other devices and services.

#### 5.2.4.2 MI-MDOC: Document transfer of risk of minimizing impact to operating environment

The product shall be accompanied by documentation informing the user of the transfer of risk for minimizing impact on other devices and services.

  * Reference: ER-MINI

  * Objective: Minimize impact on other devices and services

  * Activities: Examine the documentation

  * Verdict: Transfer of risk documented in a manner appropriate to the user => PASS, otherwise FAIL

  * Evidence: Documentation, analysis of documentation

#### 5.2.4.3 MI-MPHY: Prevent denial of service at physical layer

The product shall implement methods of detecting and mitigating denial of service attacks on other devices resulting from exploitation of vulnerabilities on the product via network or host system access.

  * Reference: ER-MINI

  * Objective: Minimize impact on other devices and services

  * Preparation: List known attack methods that generate output on the transmission medium originating in the product itself that negatively impact other devices and services

  * Activities: Use a tool to simulate these attacks and observe whether the product notifies the host or mitigates the negative impact itself

  * Verdict: Product notifies host or mitigates the negative impact itself  => PASS, otherwise FAIL

  * Evidence: List of attack methods, list of negative behaviours tested, log messages of product behaviour, log on host system

#### 5.2.5.8 Mapping of mitigations to risk factors and security profiles

See clause 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.

## 5.10 Availability protection

### 5.10.1 Overview

TODO

## 5.11 Non-interference

### 5.11.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (i).

### 5.11.2 REQ-NI-01: Minimise data transmitted to unverified sources

#### 5.11.2.1 Requirement

The product shall minimise the data transmitted to destinations whose source address has not been verified, and shall be accompanied by documentation of the rationale for the amount of data that is transmitted to that destination.

#### 5.11.2.2 Applicability

TODO

#### 5.11.2.3 Guidance

Denial of service attacks over the network often use traffic reflection or amplificaiton techniques, in which the threat actor sends packet to third party devices with a spoofed source address. The third party then sends a response packet to the spoofed source destination - a reflection attack. If the response is larger than the packet it is responding to, then it is an amplification attack. By minimising or rate-limiting the data sent to potentially spoofed source addresses, a product can reduce its interference with other devices.

### 5.11.3 REQ-NI-02 (MI-MPHY): Prevent denial of service at physical layer

#### 5.11.3.1 Requirement

The product shall implement methods of detecting and mitigating denial of service attacks on other devices or parts of the host system resulting from exploitation of vulnerabilities on the product via network or host system access.

#### 5.11.3.2 Applicability

TODO

### 5.2.14 ER-LMAS: Minimize exposed interfaces

#### 5.2.14.1 Cybersecurity requirement

* Log of device activity and/or state

* Packet captures

## 6.11 Non-interference

### 6.11.1 Overview

This clause addresses the requirements in the CRA [\[i.1\]](#_ref_i.1) Annex 1 Part 1 (2) (i).

### 6.11.2 REQ-NI-01: Minimise data transmitted to unverified sources

#### 6.11.2.1 Objective

Minimise negative impact on other devices or services.

#### 6.11.2.2 Preparation

Examine the product documentation for interfaces that may transmit data to unverified sources.

#### 6.11.2.3 Activities

For each identified interface, transmit data to the interface with an unverified source address and record any data the product transmits in response. Examine the documented rationale for the amount of data transmitted.

#### 6.11.2.4 Verdict

PASS if **all** of the following are fulfilled:

* The data transmitted in response matches the documentation, and

* The documented rationale for data minimisation of the response is deemed sufficient.

Otherwise FAIL

#### 6.11.2.5 Evidence

* Documentation accompanying product

* Packet captures or other appropriate logs of the data transmitted

* Sufficiency analysis of documentation

### 6.11.3 REQ-NI-02 (MI-MPHY): Prevent denial of service at physical layer

#### 6.11.3.1 Objective

Minimise negative impact on other devices or services.

#### 6.11.3.2 Preparation

Select representative known attacks that use vulnerabilities in this type of product to negatively impact other devices and services, including those on the attached network and the host system. Limit the selection to those attacks that represent risks that need to be mitigated by the manufacturer's risk assessment. Identify methods to simulate these attacks.

#### 6.11.3.3 Activities

Simulate the attacks and observe the product's response. Document the sufficiency of the mitigation of the attack.

#### 6.11.3.4 Verdict

PASS if **all** of the following are fulfilled:

* The product mitigates the negative impact, and

* The documented rationale for minimisation of the response is deemed sufficient.

Otherwise FAIL

#### 6.11.3.5 Evidence

* List of selected attack methods

* Documentation of attack simulation

* Logs of attacks and product response

* Sufficiency analysis of product response

#### 6.11.3.6 Guidance

Automated vulnerability scanners, penetration testing tools, or test cases for vulnerablities are one source of useful attack methods.

One method of mitigating the attack is to notify the host system in some manner.

# Annex A (informative): Relationship between the present document and the requirements of EU Regulation (EU) 2024/2847 - the Cyber Resilience Act

<mark>Editor's Note: Even if informative, this Annex is mandatory in Harmonised Standards.</mark>