Skip to content

Commit 3cf59a3

Browse files
chuckb1300chuckb1300
committed
Sphere review updates
1 parent 30bd93e commit 3cf59a3

File tree

2 files changed

+56
-61
lines changed

2 files changed

+56
-61
lines changed

‎articles/certification/program-requirements-edge-secured-core.md

Lines changed: 55 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ zone_pivot_groups: app-service-platform-windows-linux-sphere-rtos
1515
## Edge Secured-Core certification requirements ##
1616

1717
### Program purpose ###
18-
Edge Secured-core is an incremental certification in the Azure Certified Device program for IoT devices running a full operating system, such as Linux or Windows 10 IoT.This program enables device partners to differentiate their devices by meeting an additional set of security criteria. Devices meeting this criteria enable these promises:
18+
Edge Secured-core is an incremental certification in the Azure Certified Device program for IoT devices running a full operating system, such as Linux, Windows 10 IoT or Azure Sphere OS. This program enables device partners to differentiate their devices by meeting an additional set of security criteria. Devices meeting this criteria enable these promises:
1919

2020
1. Hardware-based device identity
2121
2. Capable of enforcing system integrity
@@ -25,7 +25,6 @@ Edge Secured-core is an incremental certification in the Azure Certified Device
2525
6. Built in security agent and hardening
2626

2727

28-
Overview content
2928
::: zone pivot="platform-windows"
3029

3130
## Windows IoT OS Support
@@ -492,191 +491,186 @@ Validation|Device to be validated through toolset to ensure the device supports
492491
::: zone pivot="platform-sphere"
493492

494493
## Azure Sphere platform Support
495-
The Mediatek MT3620AN must be included in your design. For any component that can connect to the internet directly from your hardware product outside of this chip, including cellular modems, additional certification details may be required.
494+
The Mediatek MT3620AN must be included in your design. Additional guidance for building secured Azure Sphere applications can be within the [Azure Sphere application notes](https://learn.microsoft.com/azure-sphere/app-notes/app-notes-overview).
496495

497-
All operating systems on device must meet Secured Core requirements
498496

499-
Additional considerations for Azure Sphere are provided as an application note here: [Azure Sphere application notes](https://learn.microsoft.com/azure-sphere/app-notes/app-notes-overview)
500-
501-
502-
## Sphere Hardware/Firmware Requirements
497+
## Azure Sphere Hardware/Firmware Requirements
503498

504499
---
505-
|Name|SecuredCore.Hardware.Identity|Sphere|
500+
|Name|SecuredCore.Hardware.Identity|Azure Sphere|
506501
|:---|:---|:---|
507502
|Status|Required|2023|
508-
|Description|The purpose of the requirement is to validate the device identify is rooted in hardware.||
503+
|Description|The purpose of the requirement is to validate the device identity is rooted in hardware.||
509504
|Validation Type|Pre-validated, no additional validation is required||
510505
|Validation|Provided by Microsoft||
511-
|Resources|[Setup auto provisioning with DPS](../iot-dps/quick-setup-auto-provision.md)||
512506

513507
---
514508
</br>
515509

516-
|Name|SecuredCore.Hardware.MemoryProtection|Sphere|
510+
|Name|SecuredCore.Hardware.MemoryProtection|Azure Sphere|
517511
|:---|:---|:---|
518512
|Status|Required|2023|
519513
|Description|The purpose of the requirement is to ensure that memory integrity helps protect the device from vulnerable peripherals.|
520-
|Validation Type|Automated|
514+
|Validation Type|Pre-validated, no additioanl validation is required|
521515
|Validation|Provided by Microsoft|
522516

523517

524518
</br>
525519

526520
---
527-
|Name|SecuredCore.Firmware.Protection|Sphere|
521+
|Name|SecuredCore.Firmware.Protection|Azure Sphere|
528522
|:---|:---|:---|
529523
|Status|Required|2023|
530524
|Description|The purpose of the requirement is to ensure that device has adequate mitigations from Firmware security threats.|
531-
|Validation Type|Automated|
525+
|Validation Type|Pre-validated, no additioanl validation is required|
532526
|Validation|Provided by Microsoft|
533527

534528

535529
---
536530
</br>
537531

538-
|Name|SecuredCore.Firmware.SecureBoot|Sphere|
532+
|Name|SecuredCore.Firmware.SecureBoot|Azure Sphere|
539533
|:---|:---|:---|
540534
|Status|Required|2023|
541535
|Description|The purpose of the requirement is to validate the boot integrity of the device.|
542-
|Validation Type|Automated|
536+
|Validation Type|Pre-validated, no additioanl validation is required|
543537
|Validation|Provided by Microsoft|
544538

545539

546540
---
547541
</br>
548542

549-
|Name|SecuredCore.Firmware.Attestation|Sphere|
543+
|Name|SecuredCore.Firmware.Attestation|Azure Sphere|
550544
|:---|:---|:---|
551545
|Status|Required|2023|
552546
|Description|The purpose of the requirement is to ensure the device can remotely attest to the Microsoft Azure Attestation service.|
553-
|Validation Type|Automated|
547+
|Validation Type|Pre-validated, no additioanl validation is required|
554548
|Validation|Provided by Microsoft|
555549

556550

557551
---
558552
</br>
559553

560-
|Name|SecuredCore.Hardware.SecureEnclave|Sphere|
554+
|Name|SecuredCore.Hardware.SecureEnclave|Azure Sphere|
561555
|:---|:---|:---|
562556
|Status|Required|2023|
563-
|Description|The purpose of this reqiurement is to validate hardware security that is accessible from a secure operating system.|
564-
|Validation Type|Automated|
557+
|Description|The purpose of this requirement is to validate hardware security that is accessible from a secure operating system.|
558+
|Validation Type|Pre-validated, no additioanl validation is required|
565559
|Validation|Provided by Microsoft|
566560

567-
## Sphere OS Configuration Requirements
561+
## Azure Sphere OS Configuration Requirements
568562

569563
---
570-
|Name|SecuredCore.Encryption.Storage|Sphere|
564+
|Name|SecuredCore.Encryption.Storage|Azure Sphere|
571565
|:---|:---|:---|
572566
|Status|Required|2023|
573-
|Description|The purpose of this reqiurement is to validate that sensitive data can be encrypted on non-volatile storage.|
574-
|Validation Type|Automated|
567+
|Description|The purpose of this requirement is to validate that sensitive data can be encrypted on non-volatile storage.|
568+
|Validation Type|Pre-validated, no additioanl validation is required|
575569
|Validation|Provided by Microsoft|
576570
|Resources|[Data at rest protection on Azure Sphere](https://learn.microsoft.com/azure-sphere/app-notes/app-notes-overview)|
577571

578572
---
579573
</br>
580574

581-
|Name|SecuredCore.Encryption.TLS|Sphere|
575+
|Name|SecuredCore.Encryption.TLS|Azure Sphere|
582576
|:---|:---|:---|
583577
|Status|Required|2023|
584578
|Description|The purpose of the requirement is to validate support for required TLS versions and cipher suites.|
585-
|Validation Type|Automated|
579+
|Validation Type|Pre-validated, no additioanl validation is required|
586580
|Validation|Provided by Microsoft|
587581
|Resources| [TLS support in IoT Hub](../iot-hub/iot-hub-tls-support.md) <br /> |
588582

589583
---
590584
</br>
591585

592-
|Name|SecuredCore.Protection.CodeIntegrity|Sphere|
586+
|Name|SecuredCore.Protection.CodeIntegrity|Azure Sphere|
593587
|:---|:---|:---|
594588
|Status|Required|2023|
595589
|Description|The purpose of this requirement is to validate that authorized code runs with least privilege.|
596-
|Validation Type|Automated|
590+
|Validation Type|Pre-validated, no additioanl validation is required|
597591
|Validation|Provided by Microsoft|
598592

599593
---
600594
</br>
601595

602-
|Name|SecuredCore.Protection.NetworkServices|Sphere|
596+
|Name|SecuredCore.Protection.NetworkServices|Azure Sphere|
603597
|:---|:---|:---|
604598
|Status|Required|2023|
605599
|Description|The purpose of the requirement is to validate that applications accepting input from the network are not running with elevated privileges.|
606-
|Validation Type|Automated|
600+
|Validation Type|Pre-validated, no additioanl validation is required|
607601
|Validation|Provided by Microsoft|
608602

609603
---
610604
</br>
611605

612-
|Name|SecuredCore.Protection.NetworkFirewall|Sphere|
606+
|Name|SecuredCore.Protection.NetworkFirewall|Azure Sphere|
613607
|:---|:---|:---|
614608
|Status|Required|2023|
615609
|Description|The purpose of this requirement is to validate that applications cannot connect to endpoints that have not been authorized.|
616-
|Validation Type|Automated|
610+
|Validation Type|Pre-validated, no additioanl validation is required|
617611
|Validation|Provided by Microsoft|
618612

619613

620-
## Sphere Software/Service Requirements
614+
## Azure Sphere Software/Service Requirements
621615
---
622-
|Name|SecuredCore.Built-in.Security|Sphere|
616+
|Name|SecuredCore.Built-in.Security|Azure Sphere|
623617
|:---|:---|:---|
624618
|Status|Required|2023|
625-
|Description|The purpose of the requirement is to make sure devices can report security information and events by sending data to Azure Defender for IoT. <br>Note: Download and deploy security agent from GitHub|
626-
|Validation Type|Automated|
619+
|Description|The purpose of this requirement is to make sure devices can report security information and events by sending data to a Microsoft telemetry service.|
620+
|Validation Type|Pre-validated, no additioanl validation is required|
627621
|Validation|Provided by Microsoft|
628622
|Resources|[Collect and interpret error data - Azure Sphere](https://learn.microsoft.com/azure-sphere/deployment/interpret-error-data?tabs=cliv2beta)</br>[Configure crash dumps - Azure Sphere](https://learn.microsoft.com/azure-sphere/deployment/configure-crash-dumps)|
629623

630624
---
631625
</br>
632626

633-
|Name|SecuredCore.Manageability.Configuration|Sphere|
627+
|Name|SecuredCore.Manageability.Configuration|Azure Sphere|
634628
|:---|:---|:---|
635629
|Status|Required|2023|
636-
|Description|The purpose of this requirement is to validate the device supports remote adiministration via service-based configuration control.|
637-
|Validation Type|Automated|
630+
|Description|The purpose of this requirement is to validate the device supports remote administration via service-based configuration control.|
631+
|Validation Type|Pre-validated, no additioanl validation is required|
638632
|Validation|Provided by Microsoft|
639633

640634
---
641635
</br>
642636

643-
|Name|SecuredCore.Update|Sphere|
637+
|Name|SecuredCore.Update|Azure Sphere|
644638
|:---|:---|:---|
645639
|Status|Required|2023|
646640
|Description|The purpose of the requirement is to validate the device can receive and update its firmware and software.|
647-
|Validation Type|Automated|
641+
|Validation Type|Pre-validated, no additioanl validation is required|
648642
|Validation|Provided by Microsoft|
649643

650644
---
651645
</br>
652646

653-
|Name|SecuredCore.Protection.Baselines|Sphere|
647+
|Name|SecuredCore.Protection.Baselines|Azure Sphere|
654648
|:---|:---|:---|
655649
|Status|Required|2023|
656650
|Description|The purpose of the requirement is to validate that the system conforms to a baseline security configuration|
657-
|Validation Type|Automated|
651+
|Validation Type|Pre-validated, no additioanl validation is required|
658652
|Validation|Provided by Microsoft|
659653

660654
---
661655
</br>
662656

663-
|Name|SecuredCore.Protection.SignedUpdates|Sphere|
657+
|Name|SecuredCore.Protection.SignedUpdates|Azure Sphere|
664658
|:---|:---|:---|
665659
|Status|Required|2023|
666660
|Description|The purpose of the requirement is to validate that updates must be signed.|
667-
|Validation Type|Automated|
661+
|Validation Type|Pre-validated, no additioanl validation is required|
668662
|Validation|Provided by Microsoft|
669663

670664

671665

672-
## Sphere Policy Requirements
666+
## Azure Sphere Policy Requirements
673667
---
674668
|Name|SecuredCore.Policy.Protection.Debug|
675669
|:---|:---|
676670
|Status|Required|
677671
|Description|The purpose of the policy requires that debug functionality on the device is disabled.|
678-
|Validation Type|Manual/Tools|
679-
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
672+
|Validation Type|Pre-validated, no additioanl validation is required|
673+
|Validation|Provided by Microsoft|
680674

681675

682676
---
@@ -685,9 +679,9 @@ Additional considerations for Azure Sphere are provided as an application note h
685679
|Name|SecuredCore.Policy.Manageability.Reset|
686680
|:---|:---|
687681
|Status|Required|
688-
|Description|The policy requires that the device can execute two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
689-
|Validation Type|Manual/Tools|
690-
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
682+
|Description|The policy requires that the device can execute two use cases: a) Ability to perform a reset (remove user data, remove user configurations), b) Restore device to last known good in the case of an update causing issues.|
683+
|Validation Type|Pre-validated, no additioanl validation is required|
684+
|Validation|Provided by Microsoft|
691685

692686

693687
---
@@ -697,8 +691,8 @@ Additional considerations for Azure Sphere are provided as an application note h
697691
|:---|:---|
698692
|Status|Required|
699693
|Description|The purpose of this policy is to ensure that the device remains secure.|
700-
|Validation Type|Manual|
701-
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
694+
|Validation Type|Pre-validated, no additioanl validation is required|
695+
|Validation|Provided by Microsoft|
702696

703697

704698
---
@@ -708,9 +702,10 @@ Additional considerations for Azure Sphere are provided as an application note h
708702
|:---|:---|
709703
|Status|Required|
710704
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
711-
|Validation Type|Manual|
712-
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
713-
705+
|Validation Type|Pre-validated, no additioanl validation is required|
706+
|Validation|Azure Sphere vulnerabilities are collected by Microsoft through MSRC and are published to customers through the Tech Community Blog, Azure Sphere “What’s New” page, and through Mitre’s CVE database.|
707+
|Resources|<ul><li>[Report an issue and submission guidelines](https://www.microsoft.com/msrc/faqs-report-an-issue)</li><li>[What's new - Azure Sphere](https://learn.microsoft.com/azure-sphere/product-overview/whats-new)</li><li>
708+
[Azure Sphere CVEs](https://learn.microsoft.com/azure-sphere/deployment/azure-sphere-cves)|</li></ul>
714709

715710
---
716711
</br>
@@ -719,8 +714,8 @@ Additional considerations for Azure Sphere are provided as an application note h
719714
|:---|:---|
720715
|Status|Required|
721716
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
722-
|Validation Type|Manual|
723-
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
717+
|Validation Type|Pre-validated, no additioanl validation is required|
718+
|Validation|Provided by Microsoft|
724719

725720

726721
</br>

‎articles/zone-pivot-groups.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -943,7 +943,7 @@ groups:
943943
- id: platform-linux
944944
title: Linux
945945
- id: platform-sphere
946-
title: Sphere
946+
title: Azure Sphere
947947
- id: app-service-platform-environment
948948
title: App Service platform and development tool
949949
prompt: Choose a hosting platform and development tool

0 commit comments

Comments
 (0)