@@ -486,44 +486,21 @@ For each security requirement, a product may:
2. Require security functions be provided by some other part of its context
3. Provide security functions for the use of other components
> EXAMPLE: Most individual hardware components do not have a built-in method of securely updating any firmware in the product. Usually this requires a full-featured system running an operating system which can check for firmware updates, download and verify them, and carry out the process of updating the firmware.
Most individual hardware components do not have a built-in method of secure firmware update, and rely on the presence of an operating system which can update the component's firmware securely.
### 4.5.2 Security functions provided outside the product
The operating system relies on correctly functioning hardware to implement its functions. It relies on security functions and configuration provided by the environment, hardware, boot manager, and any virtualization prior to the beginning of its execution. Such security functions may include:
Operating systems often rely on essential external functionality to implement their necessary security functionality.
* Memory protection
* Secure or measured boot
* Confidential data transmission
* Encryption of data at rest
* Secure updates
* Access control
For example, many operating systems rely on hardware secure elements and a compatible boot manager prior to the beginning of the operating system's own execution in order for the operating system to execute securely.
### 4.5.3 Security functions provided to other components
The operating system often provides many security functions to other components of the system, including:
* Secure by default configuration
* Secure updates
* Authentication and access control mechanisms
* Confidentiality protection
* Integrity protection for data and configuration
* Data minimization
* Availability protection
* Minimize impact on other devices or services
* Limit attack surface
* Exploit mitigation by limiting incident impact
* Logging and monitoring mechanisms
* Secure deletion and data transfer
Operating systems often provides essential security functions to other components of the system.
## 4.6 Users
* General public
* Children
* Assistants to primary user
* IT professionals
* Systems integrators
* Software developers
Users of products may interact directly with the operating system, or the operating sytsem may be integrated into a product in such a way that the end user does not interact directly with any functionality of the operating system.
