Skip to content

Commit 4d51e8f

Browse files
chuckb1300chuckb1300
committed
removing empty resources
1 parent afce930 commit 4d51e8f

File tree

1 file changed

+31
-32
lines changed

1 file changed

+31
-32
lines changed

‎articles/certification/program-requirements-edge-secured-core.md

Lines changed: 31 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
6666
|Requirements dependency|Only if DMA capable ports exist|
6767
|Validation Type|Manual/Tools|
6868
|Validation|If DMA capable external ports exist on the device, toolset to validate that the IOMMU or SMMU is enabled and configured for those ports.|
69-
|Resources||
69+
7070

7171
---
7272
</br>
@@ -90,7 +90,7 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
9090
|Requirements dependency|UEFI|
9191
|Validation Type|Manual/Tools|
9292
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure that firmware and kernel signatures are validated every time the device boots. <ul><li>UEFI: Secure boot is enabled</li></ul>|
93-
|Resources||
93+
9494

9595
---
9696
</br>
@@ -116,7 +116,7 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
116116
|Description|The purpose of the requirement to validate that sensitive data can be encrypted on non-volatile storage.|
117117
|Validation Type|Manual/Tools|
118118
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure Secure-boot and BitLocker is enabled and bound to PCR7.|
119-
|Resources||
119+
120120

121121
---
122122
</br>
@@ -151,7 +151,7 @@ Validation|Device to be validated through toolset to ensure the device supports
151151
|Description|The purpose of the requirement is to validate that services listening for input from the network are not running with elevated privileges.|
152152
|Validation Type|Manual/Tools|
153153
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure that 3rd party services accepting network connections are not running with elevated LocalSystem and LocalService privileges. <ol><li>Exceptions may apply</li></ol>|
154-
|Resources||
154+
155155

156156
---
157157

@@ -195,7 +195,7 @@ Some requirements of this program are based on a business agreement between your
195195
|Requirements dependency||
196196
|Validation Type|Manual/Tools|
197197
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
198-
|Resources||
198+
199199

200200
---
201201
</br>
@@ -207,7 +207,7 @@ Some requirements of this program are based on a business agreement between your
207207
|Requirements dependency||
208208
|Validation Type|Manual/Tools|
209209
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
210-
|Resources||
210+
211211

212212
---
213213
</br>
@@ -218,7 +218,7 @@ Some requirements of this program are based on a business agreement between your
218218
|Description|The purpose of this policy is to ensure that the device remains secure.|
219219
|Validation Type|Manual|
220220
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
221-
|Resources||
221+
222222

223223
---
224224
</br>
@@ -229,7 +229,7 @@ Some requirements of this program are based on a business agreement between your
229229
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
230230
|Validation Type|Manual|
231231
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
232-
|Resources||
232+
233233

234234
---
235235
</br>
@@ -240,7 +240,7 @@ Some requirements of this program are based on a business agreement between your
240240
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
241241
|Validation Type|Manual|
242242
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
243-
|Resources||
243+
244244

245245
---
246246
</br>
@@ -281,7 +281,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
281281
|Description|The purpose of the requirement is to validate ensure that memory integrity helps protect the device from vulnerable peripherals.|
282282
|Validation Type|Manual/Tools|
283283
|Validation|memory regions for peripherals must be gated with hardware/firmware such as memory region domain controllers or SMMU (System memory management Unit).|
284-
|Resources||
284+
285285

286286
</br>
287287

@@ -303,7 +303,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
303303
|Description|The purpose of the requirement is to validate the boot integrity of the device.|
304304
|Validation Type|Manual/Tools|
305305
|Validation|Device to be validated through toolset to ensure that firmware and kernel signatures are validated every time the device boots. <ul><li>UEFI: Secure boot is enabled</li><li>Uboot: Verified boot is enabled</li></ul>|
306-
|Resources||
306+
307307

308308
---
309309
</br>
@@ -326,7 +326,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
326326
|Description|The purpose of the requirement to validate the existence of a secure enclave and that the enclave can be used for security functions.|
327327
|Validation Type|Manual/Tools|
328328
|Validation||
329-
|Resources||
329+
330330

331331
## Linux Configuration Requirements
332332

@@ -337,7 +337,7 @@ Edge Secured-core validation on Linux based devices is executed through a contai
337337
|Description|The purpose of the requirement to validate that sensitive data can be encrypted on non-volatile storage.|
338338
|Validation Type|Manual/Tools|
339339
|Validation|Device to be validated through toolset to ensure storage encryption is enabled and default algorithm is XTS-AES, with key length 128 bits or higher.|
340-
|Resources||
340+
341341

342342
---
343343
</br>
@@ -359,7 +359,7 @@ Validation|Device to be validated through toolset to ensure the device supports
359359
|Description|The purpose of this requirement is to validate that authorized code runs with least privilege.|
360360
|Validation Type|Manual/Tools|
361361
|Validation|Device to be validated through toolset to ensure that code integrity is enabled by validating dm-verity and IMA|
362-
|Resources||
362+
363363

364364
---
365365
</br>
@@ -370,7 +370,7 @@ Validation|Device to be validated through toolset to ensure the device supports
370370
|Description|The purpose of the requirement is to validate that applications accepting input from the network are not running with elevated privileges.|
371371
|Validation Type|Manual/Tools|
372372
|Validation|Device to be validated through toolset to ensure that services accepting network connections are not running with SYSTEM or root privileges.|
373-
|Resources||
373+
374374

375375

376376
## Linux Software/Service Requirements
@@ -393,7 +393,7 @@ Validation|Device to be validated through toolset to ensure the device supports
393393
|Dependency|azure-osconfig|
394394
|Validation Type|Manual/Tools|
395395
|Validation|<ol><li>Device must report, via IoT Hub, its firewall state, firewall fingerprint, ip addresses, network adapter state, host name, hosts file, TPM (absence, or presence with version) and package manager sources (see What can I manage) </li><li>Device must accept the creation, via IoT Hub, of a default firewall policy (accept vs drop), and at least one firewall rule, with positive remote acknowledgement (see configurationStatus)</li><li>Device must accept the replacement of /etc/hosts file contents via IoT Hub, with positive remote acknowledgement (see https://learn.microsoft.com/en-us/azure/osconfig/howto-hosts?tabs=portal#the-object-model )</li><li>Device must accept and implement, via IoT Hub, remote reboot</li></ol> Note: Use of other system management toolchains (e.g., Ansible, etc.) by operators is not prohibited, but the device must include the azure-osconfig agent such that it is ready to be managed from Azure.|
396-
|Resources||
396+
397397

398398
---
399399
</br>
@@ -427,7 +427,7 @@ Validation|Device to be validated through toolset to ensure the device supports
427427
|Description|The purpose of the requirement is to validate that updates must be signed.|
428428
|Validation Type|Manual/Tools|
429429
|Validation|Device to be validated through toolset to ensure that updates to the operating system, drivers, application software, libraries, packages and firmware will not be applied unless properly signed and validated.
430-
|Resources||
430+
431431

432432

433433

@@ -439,7 +439,7 @@ Validation|Device to be validated through toolset to ensure the device supports
439439
|Description|The purpose of the requirement is to validate that debug functionality on the device is disabled.|
440440
|Validation Type|Manual/Tools|
441441
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
442-
|Resources||
442+
443443

444444
---
445445
</br>
@@ -450,7 +450,7 @@ Validation|Device to be validated through toolset to ensure the device supports
450450
|Description|The purpose of this requirement is to validate the device against two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
451451
|Validation Type|Manual/Tools|
452452
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
453-
|Resources||
453+
454454

455455
---
456456
</br>
@@ -461,7 +461,7 @@ Validation|Device to be validated through toolset to ensure the device supports
461461
|Description|The purpose of this policy is to ensure that the device remains secure.|
462462
|Validation Type|Manual|
463463
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
464-
|Resources||
464+
465465

466466
---
467467
</br>
@@ -472,7 +472,7 @@ Validation|Device to be validated through toolset to ensure the device supports
472472
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
473473
|Validation Type|Manual|
474474
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
475-
|Resources||
475+
476476

477477
---
478478
</br>
@@ -483,7 +483,7 @@ Validation|Device to be validated through toolset to ensure the device supports
483483
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
484484
|Validation Type|Manual|
485485
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
486-
|Resources||
486+
487487

488488
</br>
489489
::: zone-end
@@ -520,7 +520,7 @@ Additional considerations for Azure Sphere are provided as an application note h
520520
|Description|The purpose of the requirement is to ensure that memory integrity helps protect the device from vulnerable peripherals.|
521521
|Validation Type|Automated|
522522
|Validation|Provided by Microsoft|
523-
|Resources||
523+
524524

525525
</br>
526526

@@ -531,7 +531,7 @@ Additional considerations for Azure Sphere are provided as an application note h
531531
|Description|The purpose of the requirement is to ensure that device has adequate mitigations from Firmware security threats.|
532532
|Validation Type|Automated|
533533
|Validation|Provided by Microsoft|
534-
|Resources||
534+
535535

536536
---
537537
</br>
@@ -542,7 +542,7 @@ Additional considerations for Azure Sphere are provided as an application note h
542542
|Description|The purpose of the requirement is to validate the boot integrity of the device.|
543543
|Validation Type|Automated|
544544
|Validation|Provided by Microsoft|
545-
|Resources||
545+
546546

547547
---
548548
</br>
@@ -553,7 +553,7 @@ Additional considerations for Azure Sphere are provided as an application note h
553553
|Description|The purpose of the requirement is to ensure the device can remotely attest to the Microsoft Azure Attestation service.|
554554
|Validation Type|Automated|
555555
|Validation|Provided by Microsoft|
556-
|Resources||
556+
557557

558558
---
559559
</br>
@@ -564,7 +564,6 @@ Additional considerations for Azure Sphere are provided as an application note h
564564
|Description|The purpose of this reqiurement is to validate hardware security that is accessible from a secure operating system.|
565565
|Validation Type|Automated|
566566
|Validation|Provided by Microsoft|
567-
|Resources||
568567

569568
## Sphere OS Configuration Requirements
570569

@@ -679,7 +678,7 @@ Additional considerations for Azure Sphere are provided as an application note h
679678
|Description|The purpose of the policy requires that debug functionality on the device is disabled.|
680679
|Validation Type|Manual/Tools|
681680
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
682-
|Resources||
681+
683682

684683
---
685684
</br>
@@ -690,7 +689,7 @@ Additional considerations for Azure Sphere are provided as an application note h
690689
|Description|The policy requires that the device can execute two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
691690
|Validation Type|Manual/Tools|
692691
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
693-
|Resources||
692+
694693

695694
---
696695
</br>
@@ -701,7 +700,7 @@ Additional considerations for Azure Sphere are provided as an application note h
701700
|Description|The purpose of this policy is to ensure that the device remains secure.|
702701
|Validation Type|Manual|
703702
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
704-
|Resources||
703+
705704

706705
---
707706
</br>
@@ -712,7 +711,7 @@ Additional considerations for Azure Sphere are provided as an application note h
712711
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
713712
|Validation Type|Manual|
714713
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
715-
|Resources||
714+
716715

717716
---
718717
</br>
@@ -723,7 +722,7 @@ Additional considerations for Azure Sphere are provided as an application note h
723722
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
724723
|Validation Type|Manual|
725724
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
726-
|Resources||
725+
727726

728727
</br>
729728
::: zone-end

0 commit comments

Comments
 (0)