Stub in all the Risk Factors with relevant UCs (b50f4a88) · Commits · STAN4CRA / EN 304 626 Operating Systems

EN-304-626.md

+177 −18

Original line number	Diff line number	Diff line
		@@ -692,6 +692,7 @@ Note: "account" refers to a user in the operating systems sense: a unique system
		\|UC-OT-2 \| 0 \| 0 \| 0 \| 0 \| 2 \| 0 \| 0 \| 0 \| 0 \| 1 \| 1 \| 1 \| 6 \|
		\|UC-MOB-1 \| 1 \| 1 \| 2 \| 3 \| 1 \| 3 \| 0 \| 3 \| 2 \| 2 \| 2 \| 2 \| 22 \|
		\|UC-WE-1 \| 1 \| 1 \| 1 \| 2 \| 1 \| 2 \| 0 \| 0 \| 0 \| 1 \| 1 \| 0 \| 10 \|
		\|UC-ST-1 \| \| \| \| \| \| \| \| \| \| \| \| \| -- \|
		\|UC-PC-1 \| 1 \| 2 \| 2 \| 1 \| 0 \| 0 \| 2 \| 2 \| 1 \| 2 \| 1 \| 2 \| 15 \|
		\|UC-PC-2 \| 1 \| 2 \| 2 \| 1 \| 0 \| 0 \| 2 \| 2 \| 1 \| 2 \| 1 \| 1 \| 14 \|
		\|UC-LA-1 \| 1 \| 2 \| 2 \| 1 \| 1 \| 1 \| 1 \| 2 \| 2 \| 2 \| 2 \| 2 \| 19 \|
		@@ -979,9 +980,10 @@ Description: A non-internet-connected device such as a bluetooth speaker

		* Risk Factor Score: 1
		* Risk Analysis
		* There is no network risk since the device lacks all wireless networking capabilities.
		* There is no network risk since the device lacks wireless networking capabilities.
		* There is negligible risk to user data since the device does not store or process any sensitive or personal data.
		* While untrusted users may gain physical access to the device, likelyhood of tampering is lower than likelyhood of theft.
		* Interception of non-network wireless signals, such as audio connections, should be considered in the threat model.
		* Risk Mitigations
		* TBD - maybe none?
		* Derived Risk Tolerance: HIGH (4)
		@@ -1020,15 +1022,29 @@ Description: An internet-connected "smart home" device, such as a thermostat, fr
		* Users are likely to physically interact with the device on a regular basis, so the device should protect against malicious peripherals.
		* Derived Risk Tolerance: HIGH (4)

		### 6.2.4 SP-OT-1 A consumer-grade home wireless router
		### 6.2.4 SP-OT-1 :: RT-????

		### 6.2.5 SP-OT-2 A business-grade remote door locking system
		Description: A consumer-grade home wireless router
		\|UC-OT-1 \| 0 \| 0 \| 1 \| 0 \| 1 \| 0 \| 0 \| 0 \| 0 \| 2 \| 2 \| 2 \| 8 \|

		### 6.2.5 SP-OT-2 :: RT-????

		### 6.2.6 SP-MOB-1 A personal smart phone
		Description: A business-grade remote door locking system
		\|UC-OT-2 \| 0 \| 0 \| 0 \| 0 \| 2 \| 0 \| 0 \| 0 \| 0 \| 1 \| 1 \| 1 \| 6 \|

		### 6.2.7 SP-WE-1 A wearable health tracker, such as a smart watch
		### 6.2.6 SP-MOB-1 :: RT-????

		### 6.2.8 SP-ST-1 Stateless multi-user terminal
		Description: A personal smart phone
		\|UC-MOB-1 \| 1 \| 1 \| 2 \| 3 \| 1 \| 3 \| 0 \| 3 \| 2 \| 2 \| 2 \| 2 \| 22 \|

		### 6.2.7 SP-WE-1 :: RT-????

		Description: A wearable health tracker, such as a smart watch
		\|UC-WE-1 \| 1 \| 1 \| 1 \| 2 \| 1 \| 2 \| 0 \| 0 \| 0 \| 1 \| 1 \| 0 \| 10 \|

		### 6.2.8 SP-ST-1 :: RT-????

		Description: Stateless multi-user terminal

		### 6.2.9 SP-PC-1 :: RT-LOW

		@@ -1047,18 +1063,161 @@ Description: A personal computer in a fixed and generally safe location
		* Physical access to the device is likely to be limited only to trusted users, so tamper-resistant mitigations may not be needed -- and may be counter-indicated if end-users are anticipated to perform maintenance tasks.
		* Derived Risk Tolerance: LOW (2)

		### 6.2.10 SP-PC-2 An enterprise workstation in a fixed and generally safe location
		* SP-LA-1 A personal laptop
		* SP-LA-2 Enterprise laptop
		* SP-PS-1 Personal server
		* SP-SE-1 An enterprise server in a datacenter with no user accounts
		* SP-SE-2 An enterprise server in a datacenter with only trusted user accounts
		* SP-SE-3 An enterprise server in a datacenter hosting many untrusted user accounts
		* SP-IF-1 Internet infrastructure on private network
		* SP-IF-2 Internet infrastructure on filtered network
		* SP-IF-3 Internet infrastructure on open internet
		* SP-FI-1 Firewall for personal network
		* SP-FI-2 Firewall for enterprise network
		### 6.2.10 SP-PC-2 :: RT-????

		Description: An enterprise workstation in a fixed and generally safe location

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-PC-2 \| 1 \| 2 \| 2 \| 1 \| 0 \| 0 \| 2 \| 2 \| 1 \| 2 \| 1 \| 1 \| 14 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.11 SP-LA-1 :: RT-???

		Description: A personal laptop

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-LA-1 \| 1 \| 2 \| 2 \| 1 \| 1 \| 1 \| 1 \| 2 \| 2 \| 2 \| 2 \| 2 \| 19 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.12 SP-LA-2 :: RT-???

		Description: Enterprise laptop

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-LA-2 \| 1 \| 2 \| 2 \| 1 \| 1 \| 1 \| 1 \| 2 \| 2 \| 2 \| 2 \| 1 \| 18 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.13 SP-PS-1 :: RT-???

		Description: Personal server

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.14 SP-SE-1 :: RT-???

		Description: An enterprise server in a datacenter with no user accounts

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-SE-1 \| 0 \| 0 \| 2 \| 0 \| 0 \| 0 \| 1 \| 2 \| 1 \| 1 \| 1 \| 0 \| 9 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.15 SP-SE-2 :: RT-???

		Description: An enterprise server in a datacenter with only trusted user accounts

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-SE-2 \| 1 \| 1 \| 2 \| 0 \| 0 \| 0 \| 1 \| 2 \| 1 \| 1 \| 1 \| 0 \| 11 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.16 SP-SE-3 :: RT-???

		Description: An enterprise server in a datacenter hosting many untrusted user accounts

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-SE-3 \| 2 \| 2 \| 2 \| 0 \| 0 \| 0 \| 1 \| 2 \| 1 \| 1 \| 1 \| 0 \| 13 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.17 SP-IF-1 :: RT-???

		Description: Internet infrastructure on private network

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-IF-1 \| 0 \| 0 \| 1 \| 0 \| 0 \| 0 \| 1 \| 0 \| 0 \| 1 \| 0 \| 2 \| 5 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.18 SP-IF-2 :: RT-???

		Description: Internet infrastructure on filtered network

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-IF-2 \| 0 \| 0 \| 1 \| 0 \| 0 \| 0 \| 1 \| 0 \| 0 \| 2 \| 1 \| 1 \| 5 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.19 SP-IF-3 :: RT-???

		Description: Internet infrastructure on open internet

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-IF-3 \| 0 \| 0 \| 1 \| 0 \| 0 \| 0 \| 1 \| 0 \| 0 \| 3 \| 2 \| 1 \| 8 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.20 SP-FI-1 :: RT-???

		Description: Firewall for personal network

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-FI-1 \| 0 \| 0 \| 1 \| 0 \| 0 \| 0 \| 1 \| 0 \| 0 \| 3 \| 1 \| 2 \| 8 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)

		### 6.2.21 SP-FI-2 :: RT-???

		Description: Firewall for enterprise network

		\| Use Case \| NUSR \| CUSR \| DATA \| SENS \| PHYS \| LOSS \| HWMD \| SWMD \| DVCS \| TNET \| FNET \| CONF \| _TOTAL_ \|
		\|----------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|------\|---------\|
		\|UC-FI-2 \| 0 \| 0 \| 1 \| 0 \| 0 \| 0 \| 1 \| 0 \| 0 \| 3 \| 1 \| 1 \| 7 \|

		* Risk Factor Score: --
		* Risk Analysis
		* ...
		* Derived Risk Tolerance: --- (-)


		## 6.3 Mapping of Security Profile to Risk Tolerance