@@ -1471,7 +1471,7 @@ The product shall operate in a secure configuration by default.
#### 5.2.X.x **MI-ADEF**: Authorization required by default to access security-relevant assets
The product shall require authorization by default to access security-relevant assets, such as product firmware, security-relevant configuration, sensitive data, and sensitive functions.
The product shall require appropriate authorization by default to access security-relevant assets, such as product firmware, security-relevant configuration, sensitive data, and sensitive functions.
* Reference: TR-SDEF
@@ -1479,12 +1479,14 @@ The product shall require authorization by default to access security-relevant a
* Preparation: List all interfaces allowing access to security-relevant assets
* Activities: For each interface, attempt to access security-relevant assets without authorization and record whether access was allowed or not
* Activities: For each interface, attempt to access security-relevant assets without appropriate authorization and record whether access was allowed or not
* Verdict: If every interface does not allow access without authorization => PASS, otherwise => FAIL
* Verdict: If every interface does not allow access without appropriate authorization => PASS, otherwise => FAIL
* Evidence: List of interfaces allowing access to security-relevant assets, record of activities used to attempt unauthorized access to security-relevant assets, log of results of attempts
> FIXME: Definition of appropriate authorization is in progress by another group.
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
@@ -1513,15 +1515,7 @@ The product shall protect confidential data stored on the product from unauthori
* Evidence: Logs of attempts to read confidential data with indication of success or failure
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
| Risk factors | Requires mitigations |
|---------------------|----------------------|
| any | SCNF |
| Security Profile | Requires mitigations |
|---------------------|----------------------|
| any | SCNF |
> TODO: Specify which types of data should be protected by the environment, permissons, encryption, salted hashes, offline storage, or hardware-backed secrets.
#### 5.2.X.x **MI-TCNF**: Confidentiality of data transmitted by product
@@ -1539,15 +1533,19 @@ The product shall protect data transmitted by the product from unauthorized acce
* Evidence: Logs of attempts to read data transmitted with indication of success or failure
> TODO: Specify which types of transmitted data should be protected by the environment or encryption.
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
