+5.4.2.4 Illustrative example of third-party verification

5.4.2.4 Illustrative example of third-party verification

The following table shows how machine-processable security information may be consumed by third-party assessors to identify relevant claims, locate supporting evidence and perform targeted verification activities.

Principle

Threat ID

Technical evidence (what to look for)

Verification

Auditor spot-check step

gate (how it

was tested)

Attack	T1, T3	Distroless image; empty	Nmap-Scan-Gate	Run ls /bin/sh on the
surface		/bin/ and /usr/bin/ of		device; it should return ‘File not
minimisation		non-essential tools		found’

Least privilege		T2	systemd unit file showing	Systemd-Unit-Audit		Run ps aux and verify the
			User=1001 and restricted			gate process is owned by
			capabilities			gate-service, not root
Strong identity		T4	sshd_config with		SSH-	Attempt to SSH using a
			PasswordAuthentication		Config-	password; the connection must
			no		Validation	be immediately rejected
	Vulnerability	T5	Partition table	Mount-Check-CI		Run touch /usr/bin/test;
	and patch		showing/mounted as ro (read			it should return ‘Read-only file
	management		only)			system’

1. Áttekintés

Megnevezés	Szabvány

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

Követelmények
Forrás	Követelmény

3. Kapcsolódó szabályozások

Szabályozások
Forrás	Szabályozás

ENISA -