+5.4.2.4 Illustrative example of third-party verification

5.4.2.4 Illustrative example of third-party verification

The following table shows how machine-processable security information may be consumed by third-party assessors to identify relevant claims, locate supporting evidence and perform targeted verification activities.

Principle

Threat ID

Technical evidence (what to look for)

Verification

Auditor spot-check step

gate (how it

was tested)

Attack	T1, T3	Distroless image; empty	Nmap-Scan-Gate	Run ls /bin/sh on the
surface		/bin/ and /usr/bin/ of		device; it should return ‘File not
minimisation		non-essential tools		found’

Least privilege		T2	systemd unit file showing	Systemd-Unit-Audit		Run ps aux and verify the
			User=1001 and restricted			gate process is owned by
			capabilities			gate-service, not root
Strong identity		T4	sshd_config with		SSH-	Attempt to SSH using a
			PasswordAuthentication		Config-	password; the connection must
			no		Validation	be immediately rejected
	Vulnerability	T5	Partition table	Mount-Check-CI		Run touch /usr/bin/test;
	and patch		showing/mounted as ro (read			it should return ‘Read-only file
	management		only)			system’

1. Apžvalga

Pavadinimas	Standartas

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai
Šaltinis	Reikalavimas

3. Susiję teisės aktai

Teisės aktai
Šaltinis	Reguliavimas

ENISA -