@@ -1131,7 +1131,7 @@ See Section 5.3 for which mitigations are necessary for which security profiles
The product shall implement appropriate mitigations to minimize impact on other devices and services.
> TODO: Manufacturers should contribute state-of-the-art techniques for minimizing impact.
> TODO: Manufacturers should contribute more state-of-the-art techniques for minimizing impact.
#### 5.2.4.2 MI-MDOC: Document transfer of risk of minimizing impact to operating environment
@@ -1143,6 +1143,28 @@ The product shall be accompanied by documentation informing the user of the tran
* Verdict: Transfer of risk documented in a manner appropriate to the user => PASS, otherwise FAIL
* Evidence: Documentation, analysis of documentation
#### 5.2.X.x **MI-MNET**: Minimize negative impact of network transmission
The product shall minimise its negative impact on other products or services via the data it transmits on the network. Each source of network data shall be documented, along with the ways it can interfere with other products or services, and methods the product uses to minimise that interference.
* Reference: TR-MINI
* Objective: Minimise negative impact on others
* Preparation: List all sources of transmitted network data on the product
* Activities: For each method of sending network data, examine the documentation of the ways it can interfere with other products or services, and what methods the product uses to minimise that interference
* Verdict: Every method of sending network data is documented with ways it can interface and methods used to minimise => PASS, otherwise FAIL
* Evidence: All configuration files for network services, documentation of network services and their impact and methods to minimise it, internal lists of listening ports, results of an external port scan
#### 5.2.X.x **MI-MAMP**: Minimize negative impact of network traffic amplification
The product shall mitigate abuse of network services that amplify network traffic in manner that can be used to attack other devices. Each network service and its associated mitigations shall be documented.
* Reference: TR-MINI
* Objective: Minimise negative impact on others
* Preparation: List all network services that return responses larger than the recieved packet without authorization of the source
* Activities: For each network service, examine the documentation of the steps taken to limit access, rate-limit, or otherwise mitigate the use of the service in traffic amplication attacks
* Verdict: Every method of sending network data is documented with how its impact on others has been mitigated => PASS, otherwise FAIL
* Evidence: All configuration files for network services, documentation of network services and their impact and methods to minimise it, internal lists of listening ports, results of an external port scan, calculation of traffic amplification factors
#### 5.2.4.4 Mapping of mitigations to risk factors and security profiles
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
@@ -1648,34 +1670,6 @@ The product shall provide a method by which an authorized user can securely tran
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.X **TR-MIMP**: Impact minimization
#### 5.2.X.x Requirement
The product shall minimise its negative impact on other products or services.
#### 5.2.X.x **MI-MNET**: Minimize negative impact of network transmission
The product shall minimise its negative impact on other products or services via the data it transmits on the network. Each source of network data shall be documented, along with the ways it can interfere with other products or services, and methods the product uses to minimise that interference.
* Reference: TR-MIMP
* Objective: Minimise negative impact on others
* Preparation: List all sources of transmitted network data on the product
* Activities: For each method of sending network data, examine the documentation of the ways it can interfere with other products or services, and what methods the product uses to minimise that interference
* Verdict: Every method of sending network data is documented with ways it can interface and methods used to minimise => PASS, otherwise FAIL
* Evidence: All configuration files for network services, documentation of network services and their impact and methods to minimise it, internal lists of listening ports, results of an external port scan
#### 5.2.X.x **MI-MAMP**: Minimize negative impact of network traffic amplification
The product shall mitigate abuse of network services that amplify network traffic in manner that can be used to attack other devices. Each network service and its associated mitigations shall be documented.
* Reference: TR-MIMP
* Objective: Minimise negative impact on others
* Preparation: List all network services that return responses larger than the recieved packet without authorization of the source
* Activities: For each network service, examine the documentation of the steps taken to limit access, rate-limit, or otherwise mitigate the use of the service in traffic amplication attacks
* Verdict: Every method of sending network data is documented with how its impact on others has been mitigated => PASS, otherwise FAIL
* Evidence: All configuration files for network services, documentation of network services and their impact and methods to minimise it, internal lists of listening ports, results of an external port scan, calculation of traffic amplification factors
## 5.3 Risk Mitigation Sets
> TODO: Connect the technical security requirements in clause 5.2 to specific Risk Factors, and define these as sets of Risk Mitigations that will be referenced in clause 6.
@@ -1699,7 +1693,7 @@ The product shall mitigate abuse of network services that amplify network traffi
| Integrity protection for data and configuration | MISO, IDST, IDTX |
| Data minimization | DMIN |
| Availability protection | AVAI |
| Minimize impact on other devices or services | MIMP |
| Minimize impact on other devices or services | MINI |
