Skip to content

Commit 177cad4

Browse files
chuckb1300chuckb1300
committed
1pm updates
1 parent 49ed42f commit 177cad4

File tree

1 file changed

+81
-70
lines changed

1 file changed

+81
-70
lines changed

‎articles/certification/program-requirements-edge-secured-core.md

Lines changed: 81 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
281281
|Name|SecuredCore.Hardware.Identity|x86/AMD64|Arm64|
282282
|:---|:---|:---|:---|
283283
|Description|The purpose of the test is to validate the device identify is rooted in hardware.|||
284-
|Requirements dependency||TPM v2.0 device|TPM v2.0 <sup>or *other supported method</sup>|
284+
|Requirements dependency||TPM v2.0 device|TPM v2.0 </br><sup>or *other supported method</sup>|
285285
|Status|Required|2023|2023|
286286
|Validation Type|Manual/Tools|||
287287
|Validation|Device to be validated through toolset to ensure that the device has a HWRoT present and that it can be provisioned through DPS using TPM or SE.|||
@@ -327,7 +327,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
327327
|:---|:---|:---|:---|
328328
|Status|Required|2023|2023|
329329
|Description|The purpose of the test is to ensure the device can remotely attest to the Microsoft Azure Attestation service.|
330-
|Dependency||TPM 2.0|TPM 2.0 <sup>or *supported OP-TEE based application chained to a HWRoT (Secure Element or Secure Enclave)</sup>|
330+
|Dependency||TPM 2.0|TPM 2.0 </br><sup>or *supported OP-TEE based application chained to a HWRoT (Secure Element or Secure Enclave)</sup>|
331331
|Validation Type|Manual/Tools|
332332
|Validation|Device to be validated through toolset to ensure that platform boot logs and applicable runtime measurements can be collected and remotely attested to the Microsoft Azure Attestation service.|
333333
|Resources| [Microsoft Azure Attestation](../attestation/index.yml) </br> Certification portal test includes an attestation client that when combined with the TPM 2.0 can validate the Microsoft Azure Attestation service.|
@@ -527,43 +527,43 @@ Additional considerations for Azure Sphere are provided as an application note h
527527
528528

529529
---
530-
|Name|SecuredCore.Hardware.Identity|x86/AMD64|Arm64|
531-
|:---|:---|:---|:---|
532-
|Description|The purpose of the test is to validate the device identify is rooted in hardware.|||
533-
|Requirements dependency||TPM v2.0 device|TPM v2.0,Secure Element|
534-
|Status|Required|2023|2023|
530+
|Name|SecuredCore.Hardware.Identity|Sphere|
531+
|:---|:---|:---|
532+
|Status|Required|2023|
533+
|Description|The purpose of the test is to validate the device identify is rooted in hardware.||
534+
|Requirements dependency|||
535535
|Validation Type|Pre-validated, no additional validation is required|||
536536
|Validation|Provided by Microsoft|||
537537
|Resources|[Setup auto provisioning with DPS](../iot-dps/quick-setup-auto-provision.md)|||
538538

539539
---
540540
</br>
541541

542-
|Name|SecuredCore.Hardware.MemoryProtection|x86/AMD64|Arm64|
543-
|:---|:---|:---|:---|
544-
|Status|Required|2023|2023|
545-
|Description|The purpose of the test is to validate that DMA is not enabled on externally accessible ports.|
542+
|Name|SecuredCore.Hardware.MemoryProtection|Sphere|
543+
|:---|:---|:---|
544+
|Status|Required|2023|
545+
|Description|The purpose of the test is to ensure that memory integrity helps protect the device from vulnerable peripherals.|
546546
|Validation Type|Automated|
547547
|Validation|Provided by Microsoft|
548548
|Resources||
549549

550550
</br>
551551

552552
---
553-
|Name|SecuredCore.Firmware.Protection|x86/AMD64|Arm64|
554-
|:---|:---|:---|:---|
555-
|Status|Required|2023|2023|
553+
|Name|SecuredCore.Firmware.Protection|Sphere|
554+
|:---|:---|:---|
555+
|Status|Required|2023|
556556
|Description|The purpose of the test is to ensure that device has adequate mitigations from Firmware security threats.|
557557
|Validation Type|Automated|
558558
|Validation|Provided by Microsoft|
559-
|Resources| https://trustedcomputinggroup.org/ |
559+
|Resources||
560560

561561
---
562562
</br>
563563

564-
|Name|SecuredCore.Firmware.SecureBoot|x86/AMD64|Arm64|
565-
|:---|:---|:---|:---|
566-
|Status|Required|2023|2023|
564+
|Name|SecuredCore.Firmware.SecureBoot|Sphere|
565+
|:---|:---|:---|
566+
|Status|Required|2023|
567567
|Description|The purpose of the test is to validate the boot integrity of the device.|
568568
|Validation Type|Automated|
569569
|Validation|Provided by Microsoft|
@@ -572,43 +572,43 @@ Additional considerations for Azure Sphere are provided as an application note h
572572
---
573573
</br>
574574

575-
|Name|SecuredCore.Firmware.Attestation|x86/AMD64|Arm64|
576-
|:---|:---|:---|:---|
577-
|Status|Required|2023|2023|
575+
|Name|SecuredCore.Firmware.Attestation|Sphere|
576+
|:---|:---|:---|
577+
|Status|Required|2023|
578578
|Description|The purpose of the test is to ensure the device can remotely attest to the Microsoft Azure Attestation service.|
579579
|Dependency||TPM 2.0|To be announced|
580580
|Validation Type|Automated|
581581
|Validation|Provided by Microsoft|
582-
|Resources| [Microsoft Azure Attestation](../attestation/index.yml) |
582+
|Resources||
583583

584584
---
585585
</br>
586586

587-
|Name|SecuredCore.Hardware.SecureEnclave|x86/AMD64|Arm64|
588-
|:---|:---|:---|:---|
589-
|Status|Optional|Comming soon|Comming soon|
590-
|Description|The purpose of the test to validate the existence of a secure enclave and that the enclave is accessible from a secure agent.|
587+
|Name|SecuredCore.Hardware.SecureEnclave|Sphere|
588+
|:---|:---|:---|
589+
|Status|Required|2023|
590+
|Description|The purpose of this reqiurement is to validate hardware security that is accessible from a secure operating system.|
591591
|Validation Type|Automated|
592592
|Validation|Provided by Microsoft|
593-
|Resources|https://github.com/openenclave/openenclave/blob/master/samples/BuildSamplesLinux.md|
593+
|Resources||
594594

595595
## Linux Configuration Requirements
596596

597597
---
598-
|Name|SecuredCore.Encryption.Storage|x86/AMD64|Arm64|
599-
|:---|:---|:---|:---|
600-
|Status|Required|2023|2023|
601-
|Description|The purpose of the test to validate that sensitive data can be encrypted on non-volatile storage.|
598+
|Name|SecuredCore.Encryption.Storage|Sphere|
599+
|:---|:---|:---|
600+
|Status|Required|2023|
601+
|Description|The purpose of this reqiurement is to validate that sensitive data can be encrypted on non-volatile storage.|
602602
|Validation Type|Automated|
603603
|Validation|Provided by Microsoft|
604-
|Resources||
604+
|Resources|[Data at rest protection on Azure Sphere](https://learn.microsoft.com/azure-sphere/app-notes/app-notes-overview)|
605605

606606
---
607607
</br>
608608

609-
|Name|SecuredCore.Encryption.TLS|x86/AMD64|Arm64|
610-
|:---|:---|:---|:---|
611-
|Status|Required|2023|2023|
609+
|Name|SecuredCore.Encryption.TLS|Sphere|
610+
|:---|:---|:---|
611+
|Status|Required|2023|
612612
|Description|The purpose of the test is to validate support for required TLS versions and cipher suites.|
613613
|Validation Type|Automated|
614614
|Validation|Provided by Microsoft|
@@ -617,9 +617,9 @@ Additional considerations for Azure Sphere are provided as an application note h
617617
---
618618
</br>
619619

620-
|Name|SecuredCore.Protection.CodeIntegrity|x86/AMD64|Arm64|
621-
|:---|:---|:---|:---|
622-
|Status|Required|2023|2023|
620+
|Name|SecuredCore.Protection.CodeIntegrity|Sphere|
621+
|:---|:---|:---|
622+
|Status|Required|2023|
623623
|Description|The purpose of this test is to validate that authorized code runs with least privilege.|
624624
|Validation Type|Automated|
625625
|Validation|Provided by Microsoft|
@@ -628,69 +628,80 @@ Additional considerations for Azure Sphere are provided as an application note h
628628
---
629629
</br>
630630

631-
|Name|SecuredCore.Protection.NetworkServices|x86/AMD64|Arm64|
632-
|:---|:---|:---|:---|
633-
|Status|Required|2023|2023|
631+
|Name|SecuredCore.Protection.NetworkServices|Sphere|
632+
|:---|:---|:---|
633+
|Status|Required|2023|
634634
|Description|The purpose of the test is to validate that applications accepting input from the network are not running with elevated privileges.|
635635
|Validation Type|Automated|
636636
|Validation|Provided by Microsoft|
637637
|Resources||
638638

639+
---
640+
</br>
641+
642+
|Name|SecuredCore.Protection.NetworkFirewall|Sphere|
643+
|:---|:---|:---|
644+
|Status|Required|2023|
645+
|Description|The purpose of this requirement is to validate that applications cannot connect to endpoints that have not been authorized.|
646+
|Validation Type|Automated|
647+
|Validation|Provided by Microsoft|
648+
|Resources||
649+
639650

640651
## Sphere Software/Service Requirements
641652
---
642-
|Name|SecuredCore.Built-in.Security|x86/AMD64|Arm64|
643-
|:---|:---|:---|:---|
644-
|Status|Required|2023|2023|
653+
|Name|SecuredCore.Built-in.Security|Sphere|
654+
|:---|:---|:---|
655+
|Status|Required|2023|
645656
|Description|The purpose of the test is to make sure devices can report security information and events by sending data to Azure Defender for IoT. <br>Note: Download and deploy security agent from GitHub|
646657
|Validation Type|Automated|
647658
|Validation|Provided by Microsoft|
648-
|Resources|[Azure Docs IoT Defender for IoT](../defender-for-iot/how-to-configure-agent-based-solution.md)|
659+
|Resources|[Collect and interpret error data - Azure Sphere](https://learn.microsoft.com/azure-sphere/deployment/interpret-error-data?tabs=cliv2beta)</br>[Configure crash dumps - Azure Sphere](https://learn.microsoft.com/azure-sphere/deployment/configure-crash-dumps)|
649660

650661
---
651662
</br>
652663

653-
|Name|SecuredCore.Manageability.Configuration|x86/AMD64|Arm64|
654-
|:---|:---|:---|:---|
655-
|Status|Required|2023|2023|
656-
|Description|The purpose of the test is to validate that device supports auditing and setting of system configuration (and certain management actions such as reboot) through Azure. Note: Use of other system management toolchains (e.g., Ansible, etc.) by operators is not prohibited, but the device must include the azure-osconfig agent such that it is ready to be managed from Azure.|
657-
|Dependency|azure-osconfig|
664+
|Name|SecuredCore.Manageability.Configuration|Sphere|
665+
|:---|:---|:---|
666+
|Status|Required|2023|
667+
|Description|The purpose of this requirement is to validate the device supports remote adiministration via service-based configuration control.|
668+
|Dependency||
658669
|Validation Type|Automated|
659670
|Validation|Provided by Microsoft|
660671
|Resources||
661672

662673
---
663674
</br>
664675

665-
|Name|SecuredCore.Update|x86/AMD64|Arm64|
666-
|:---|:---|:---|:---|
667-
|Status|Audit|2023|2023|
668-
|Description|The purpose of the test is to validate the device can receive and update its firmware and software.|
669-
|Validation Type|Manual/Tools|
670-
|Validation|Partner confirmation that they were able to send an update to the device through Azure Device update and other approved services.|
671-
|Resources|[Device Update for IoT Hub](../iot-hub-device-update/index.yml)|
676+
|Name|SecuredCore.Update|Sphere|
677+
|:---|:---|:---|
678+
|Status|Required|2023|
679+
|Description|The purpose of the requirement is to validate the device can receive and update its firmware and software.|
680+
|Validation Type|Automated|
681+
|Validation|Provided by Microsoft|
682+
|Resources||
672683

673684
---
674685
</br>
675686

676-
|Name|SecuredCore.Protection.Baselines|x86/AMD64|Arm64|
677-
|:---|:---|:---|:---|
678-
|Status|Required|2023|2023|
679-
|Description|The purpose of the test is to validate the extent to which the device implements the Azure Security Baseline|
687+
|Name|SecuredCore.Protection.Baselines|Sphere|
688+
|:---|:---|:---|
689+
|Status|Required|2023|
690+
|Description|The purpose of the requirement is to validate that the system conforms to a baseline security configuration|
680691
|Dependency|azure-osconfig|
681-
|Validation Type|Manual/Tools|
682-
|Validation|OSConfig is present on the device and reporting to what extent it implemets the Azure Security Baseline.|
683-
|Resources| <ul><li>https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines </li><li> https://www.cisecurity.org/cis-benchmarks/ </li><li>https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-linux|</li></ul>
692+
|Validation Type|Automated|
693+
|Validation|Provided by Microsoft|
694+
|Resources||
684695

685696
---
686697
</br>
687698

688-
|Name|SecuredCore.Protection.SignedUpdates|x86/AMD64|Arm64|
689-
|:---|:---|:---|:---|
690-
|Status|Required|2023|2023|
691-
|Description|The purpose of the test is to validate that updates must be signed.|
692-
|Validation Type|Manual/Tools|
693-
|Validation|Device to be validated through toolset to ensure that updates to the operating system, drivers, application software, libraries, packages and firmware will not be applied unless properly signed and validated.
699+
|Name|SecuredCore.Protection.SignedUpdates|Sphere|
700+
|:---|:---|:---|
701+
|Status|Required|2023|
702+
|Description|The purpose of the requirement is to validate that updates must be signed.|
703+
|Validation Type|Automated|
704+
|Validation|Provided by Microsoft|
694705
|Resources||
695706

696707

0 commit comments

Comments
 (0)