UL 2900-1-2017 UL Standard for Safety Software Cybersecurity for Network-Connectable Products Part 1 General Requirements (First Edition).pdf

1、UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL UL 2900-1 Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements STANDARD FOR SAFETYUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTIO

2、N WITHOUT PERMISSION FROM ULUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL UL Standard for Safety for Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements, UL 2900-1 First Edition, Dated July 5, 2017 Summary

3、 of Topics This is the First Edition of the Standard for Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements, ANSI/UL 2900-1 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form by any means, el

4、ectronic, mechanical photocopying, recording, or otherwise without prior permission of UL. UL provides this Standard as is without warranty of any kind, either expressed or implied, including but not limited to, the implied warranties of merchantability or tness for any purpose. In no event will UL

5、be liable for any special, incidental, consequential, indirect or similar damages, including loss of prots, lost savings, loss of data, or any other damages arising out of the use of or the inability to use this Standard, even if UL or an authorized UL representative has been advised of the possibil

6、ity of such damage. In no event shall ULs liability for any damage ever exceed the price paid for this Standard, regardless of the form of the claim. Users of the electronic versions of ULs Standards for Safety agree to defend, indemnify, and hold UL harmless from and against any loss, expense, liab

7、ility, damage, claim, or judgment (including reasonable attorneys fees) resulting from any error or deviation introduced while purchaser is storing an electronic Standard on the purchasers computer system. JULY 5, 2017 UL 2900-1 tr1UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR D

8、ISTRIBUTION WITHOUT PERMISSION FROM UL JULY 5, 2017 UL 2900-1 tr2 No Text on This PageUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL JULY 5, 2017 1 UL 2900-1 Standard for Software Cybersecurity for Network-Connectable Products, Part 1: Gene

9、ral Requirements First Edition July 5, 2017 This ANSI/UL Standard for Safety consists of the First Edition. The most recent designation of ANSI/UL 2900-1 as an American National Standard (ANSI) occurred on July 5, 2017. ANSI approval for a standard does not include the Cover Page, Transmittal Pages,

10、 and Title Page. Comments or proposals for revisions on any part of the Standard may be submitted to UL at any time. Proposals should be submitted via a Proposal Request in ULs On-Line Collaborative Standards Development System (CSDS) at https:/. ULs Standards for Safety are copyrighted by UL. Neith

11、er a printed nor electronic copy of a Standard should be altered in any way. All of ULs Standards and all copyrights, ownerships, and rights regarding those Standards shall remain the sole and exclusive property of UL. COPYRIGHT 2017 UNDERWRITERS LABORATORIES INC. ANSI/UL 2900-1-2017UL COPYRIGHTED M

12、ATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL JULY 5, 2017 UL 2900-1 2 No Text on This PageUL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL CONTENTS INTRODUCTION 1 Scope .4 2 Normative References .

13、4 3 Glossary .6 4 DOCUMENTATION OF PRODUCT, PRODUCT DESIGN AND PRODUCT USE 10 4.1 Product Documentation 10 5 Product Design Documentation 11 6 Documentation for Product Use11 7 Risk Controls 12 7.1 General 12 8 Access Control, User Authentication and User Authorization 12 9 Remote Communication 14 1

14、0 Sensitive Data14 11 Product Management .15 RISK MANAGEMENT 12 Vendor Product Risk Management Process 16 VULNERABILITIES AND EXPLOITS 13 Known Vulnerability Testing 18 14 Malware Testing 18 15 Malformed Input Testing .18 16 Structured Penetration Testing .20 SOFTWARE WEAKNESSES 17 Software Weakness

15、 Analysis.20 18 Static Source Code Analysis 21 19 Static Binary and Bytecode Analysis 21 APPENDIX A A1 Sources for Software Weaknesses .A1 APPENDIX B B1 Requirements for Secure Mechanisms for Storing Sensitive Data and Personally Identiable Information B1 APPENDIX C C1 Requirements for Security Func

16、tions .C1 JULY 5, 2017 UL 2900-1 3UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL INTRODUCTION 1 Scope 1.1 This standard applies to network-connectable products that shall be evaluated and tested for vulnerabilities, software weaknesses and

17、malware. 1.2 This standard describes: a) Requirements regarding the software developer (vendor or other supply chain member) risk management process for their product. b) Methods by which a product shall be evaluated and tested for the presence of vulnerabilities, software weaknesses and malware. c)

18、 Requirements regarding the presence of security risk controls in the architecture and design of a product. 1.3 This standard does not contain requirements regarding functional testing of a product. This means this standard contains no requirements to verify that the product functions as designed. 1

19、.4 This standard does not contain requirements regarding the hardware contained in a product. 2 Normative References 2.1 All references are for the latest published version of the document, unless stated otherwise. 1 Standard for Software Cybersecurity for Network-Connectable Products, Part 2-1: Par

20、ticular Requirements for Network Connectable Components of Healthcare Systems, UL 2900-2-1 2 Standard for Software Cybersecurity for Network-Connectable Products, Part 2-2: Particular Requirements for Industrial Control Systems, UL 2900-2-2 3 Standard for Test Access Port and Boundary-Scan Architect

21、ure, IEEE 1149 4 Cybersecurity information exchange Vulnerability/state exchange Common vulnerabilities and exposures (CVE); retrievable from https:/cve.mitre.org/, ITU-T X.1520 5 Cybersecurity information exchange Vulnerability/state exchange Common vulnerability scoring system (CVSS); retrievable

22、from https:/nvd.nist.gov/vuln-metrics/cvss, ITU-T X.1521 6 Cybersecurity information exchange Vulnerability/state exchange Common weakness enumeration (CWE), ITU-T X.1524 7 Cybersecurity information exchange Vulnerability/state exchange Common weakness scoring system (CWSS); retrievable from https:/

23、cwe.mitre.org/cwss, ITU-T X.1525 JULY 5, 2017 UL 2900-1 4UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 8 Cybersecurity information exchange Event/incident/heuristics exchange Common attack pattern enumeration and classication (CAPEC); retr

24、ievable from https:/capec.mitre.org, ITU-T X.1544 9 Common Weakness Risk Analysis Framework (CWRAF); retrievable from https:/cwe.mitre.org/cwraf/ 10 CWE/SANS Top 25 Most Dangerous Software Errors; retrievable from cwe.mitre.org/top25 11 CWE On the Cusp: other weaknesses to consider; retrievable from

25、 https:/cwe.mitre.org/top25/cusp.html 12 OWASP Top 10; latest version retrievable from https:/www.owasp.org/index.php/Top_10_2013-Top_10 13 Information technology Trusted platform module library, ISO/IEC 11889 14 Information technology Security techniques Digital signature scheme giving message reco

26、very, ISO/IEC 9796 (all parts) 15 Information technology Security techniques Message Authentication Codes (MACs), ISO/IEC 9797 (all parts) 16 Information technology Security techniques Entity authentication, ISO/IEC 9798 (all parts) 17 Information technology Security techniques Hash-functions, ISO/I

27、EC 10118 (all parts) 18 Information technology Security techniques Key management, ISO/IEC 11770 (all parts) 19 Information technology Security techniques Digital signatures with appendix, ISO/IEC 14888 (all parts) 20 Information technology Security techniques Cryptographic techniques based on ellip

28、tic curves, ISO/IEC 15946 (all parts) 21 Information technology Security techniques Encryption algorithms, ISO/IEC 18033 (all parts) 22 Information technology Security techniques Authenticated encryption, ISO/IEC 19772 (all parts) 23 The National Institute of Standards and Technology Cybersecurity F

29、ramework, NIST 2014 24 Annex A: Approved Security Functions, NIST FIPS 140-2 25 Annex D: Approved Key Establishment Techniques, NIST FIPS 140-2 26 The National Institute of Standards and Technology Special Publication, NIST 800-53 Revision 4 JULY 5, 2017 UL 2900-1 5UL COPYRIGHTED MATERIAL NOT AUTHOR

30、IZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 27 Guidelines for Media Sanitization, NIST SP 800-88 Revision 1 28 Guide to Protecting the Condentiality of Personally Identiable Information, NIST SP 800-122 3 Glossary 3.1 ATTACK The use of one or more exploit(s) by an advers

31、ary to achieve one or more negative technical impact(s). 3.2 ATTACK PATTERN A description of a generic method for carrying out attacks. 3.3 AUTHENTICATION The process of verifying the identity of an entity. 3.4 AUTHENTICITY The property that data, information or software originate from a specic enti

32、ty. 3.5 AUTHORIZATION The process of giving an entity permission to access or manipulate the product, or the property that an entity has such permission. 3.6 BINARY CODE Machine instructions and/or data in a format intended for a specic processor architecture. 3.7 BYTECODE Instructions and/or data t

33、hat are created from source code as an intermediate step before generating binary code. Bytecode is independent of a specic processor architecture and is typically handled by a virtual machine or interpreter. 3.8 COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATION (CAPEC) Specied in ITU-T X.1544 (r

34、ef. 7), the CAPEC is a publicly available resource providing a list and classication of a large number of attack mechanisms based on the topology of the environment. 3.9 COMMON VULNERABILITIES AND EXPOSURES (CVE) Specied in ITU-T X.1520 (ref. 3), the CVE is a publicly available resource providing co

35、mmon identiers for known vulnerabilities and exposures. 3.10 COMMON VULNERABILITY SCORING SYSTEM (CVSS) Specied in ITU-T X.1521 (ref. 4), the CVSS is a publicly available resource providing a means for prioritizing vulnerabilities in terms of exploit potential. 3.11 COMMON WEAKNESS ENUMERATION (CWE)

36、 Specied in ITU-T X.1524 (ref. 5), the CWE is a publicly available resource providing a structured means to exchange unied, measurable sets of information providing common identiers for software weaknesses, as well as consequences, detection methods and examples of each weakness. 3.12 COMMON WEAKNES

37、S SCORING SYSTEM (CWSS) Specied in ITU-T X.1525 (ref 6), the CWSS is a publicly available resource providing a means for prioritizing CWEs based on their technical impact, ease of attack, and other factors. JULY 5, 2017 UL 2900-1 6UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DI

38、STRIBUTION WITHOUT PERMISSION FROM UL 3.13 COMMUNICATION PROTOCOL A system of rules regarding syntax, semantics, synchronization and error recovery of data communication, allowing two or more entities to exchange information. 3.14 CONFIDENTIALITY The property that data, information or software is no

39、t made available or disclosed to unauthorized individuals, entities, or processes. 3.15 EXECUTABLE A le containing instructions in binary code, which can be used by a computer to perform computational tasks. 3.16 EXPLOIT An input or action designed to take advantage of a weakness (or multiple weakne

40、sses) and achieve a negative technical impact. NOTE: The existence of an exploit targeting a weakness is what makes that weakness a vulnerability. 3.17 EXTERNAL INTERFACE An interface of the product that is designed to potentially allow access to an entity outside the product; for example user inter

41、faces, remote interfaces, local interfaces, wireless interfaces and le inputs. 3.18 GENERATIONAL MALFORMED INPUT TESTING A method of deriving malformed input test cases by using detailed knowledge of the syntax and semantics of the specications of the protocol or le format being tested. 3.19 HARM Ph

42、ysical injury or damage to the health of people, or damage to property or the environment. 3.20 I2C BUS An inter-integrated circuit bus. 3.21 INTEGRITY t he assurance that data can only be altered by authorized entities. 3.22 JTAG Joint Test Action Group (JTAG) method of connection described in IEEE

43、 1149, Standard for Test Access Port and Boundary-Scan Architecture. 3.23 KNOWN VULNERABILITY A vulnerability described in the National Vulnerability Database (NVD). NOTE: The NVD is accessible at https:/nvd.nist.gov. 3.24 LIBRARY - A software set of code, functions, classes, procedures, scripts, co

44、nguration data that can be used by an executable 3.25 MALFORMED INPUT TESTING A black-box testing technique used to reveal software weaknesses in a product by triggering them with invalid or unexpected inputs on the external interfaces of the product. 3.26 MALFORMED INPUT TEST CASE The basic unit of

45、 malformed input testing, which consists of a single interaction with the product under test. JULY 5, 2017 UL 2900-1 7UL COPYRIGHTED MATERIAL NOT AUTHORIZED FOR FURTHER REPRODUCTION OR DISTRIBUTION WITHOUT PERMISSION FROM UL 3.27 MALWARE Software designed with malicious intent to disrupt normal func

46、tion, gather sensitive information, and/or access other connected systems. 3.28 NETWORK CONNECTABLE Any device, component, or software that can be connected via physical, wireless, cellular, and other non-physical transmission means to another device, component or software or groups of devices, comp

47、onents or systems of software 3.29 PENETRATION TESTING A mechanism of evaluation of a product to exploit vulnerabilities and weaknesses discovered in the vulnerability assessment phase. 3.30 PERSONALLY IDENTIFIABLE INFORMATION (PII) Any information about an individual maintained by the product, incl

48、uding any information that can be used to distinguish or trace an individuals identity, such as name, social security number, date and place of birth, mothers maiden name, or biometric records; AND Any other information that is linked or linkable to an individual, such as medical, educational, nanci

49、al, and employment information. NOTE: This can be, but is not limited to an individuals location, health records and/or nancial records that when used can determine the actual individuals identity. 3.31 PRODUCT The network-connectable device, software or system under test. 3.32 PROTOCOL See COMMUNICATION PROTOCOL 3.33 REMOTE