Loading EN-304-626.md +4 −17 Original line number Diff line number Diff line Loading @@ -1009,11 +1009,11 @@ The product shall enable Address Space Layout Randomization (ASLR) by default fo | FIXME list RT-High | none | | FIXME RT-Med, RT-Low | ALSR | ### 5.2.X **TR-MSAF**: Memory error mitigations ### 5.2.3 TR-LMII: Limit incident impact #### 5.2.X.x Requirement #### 5.2.3.1 Requirement The product shall implement appropriate mitigations for memory errors. The product shall implement appropriate mitigations to limit incident impact. #### 5.2.X.x Default Preparation, Verdict, and Evidence Loading Loading @@ -1162,20 +1162,7 @@ Both kernel and userspace threads shall use hardware-supported memory tagging to #### 5.2.X.x Mapping of mitigations to risk factors and security profiles > FIXME: Figure out which risk factors/use cases require CFIN or else delete it. | Risk factors | Requires mitigations | |------------------------------------------------------|---------------------------------------------| | NUSR < 2 & UEIN < 2 & SWMD < 2 & DVCS < 2 & FNET < 2 | None | | NUSR < 2 & RT-High | None | | all others - option 1 | MSAF-\*, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | all others - option 2 | MPMT, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | Security Profile | Requires mitigations | |-------------------------------|---------------------------------------------| | LR, IoT-\*, OT-\*, WE-1, ST-1 | None | | all others - option 1 | MSAF-\*, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | all others - option 2 | MPMT, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale. ### 5.2.X **TR-SDEF**: Secure by default configuration Loading Loading
EN-304-626.md +4 −17 Original line number Diff line number Diff line Loading @@ -1009,11 +1009,11 @@ The product shall enable Address Space Layout Randomization (ASLR) by default fo | FIXME list RT-High | none | | FIXME RT-Med, RT-Low | ALSR | ### 5.2.X **TR-MSAF**: Memory error mitigations ### 5.2.3 TR-LMII: Limit incident impact #### 5.2.X.x Requirement #### 5.2.3.1 Requirement The product shall implement appropriate mitigations for memory errors. The product shall implement appropriate mitigations to limit incident impact. #### 5.2.X.x Default Preparation, Verdict, and Evidence Loading Loading @@ -1162,20 +1162,7 @@ Both kernel and userspace threads shall use hardware-supported memory tagging to #### 5.2.X.x Mapping of mitigations to risk factors and security profiles > FIXME: Figure out which risk factors/use cases require CFIN or else delete it. | Risk factors | Requires mitigations | |------------------------------------------------------|---------------------------------------------| | NUSR < 2 & UEIN < 2 & SWMD < 2 & DVCS < 2 & FNET < 2 | None | | NUSR < 2 & RT-High | None | | all others - option 1 | MSAF-\*, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | all others - option 2 | MPMT, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | Security Profile | Requires mitigations | |-------------------------------|---------------------------------------------| | LR, IoT-\*, OT-\*, WE-1, ST-1 | None | | all others - option 1 | MSAF-\*, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | | all others - option 2 | MPMT, MZRO-\*, MRWX-\*, NKAM, PLLC, MRCO | See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale. ### 5.2.X **TR-SDEF**: Secure by default configuration Loading
