Fictitious example. ACME Embedded GmbH, its products, records and document IDs are invented for illustration. Use this as a structural model, not as a template to adopt unchanged — and not as legal advice.
ENG-DES-033 — Minimal Attack-Surface Design Plan
| Document ID | ENG-DES-033, rev. 1.0 |
| Product | SensorNode S300 (project P-2026-04) |
| Reference | CRA Annex I I(2)(b); inputs: attack-surface inventory SEC-TM-S300 §3; verified later via SDL-CHK-030 |
| Prepared by | Team Lead Firmware, 2026-07-27 |
| Approved by | Product Security Lead |
| Principle | Every interface, service, port, and protocol not required for the intended function is removed from the build, or — where removal is impossible — disabled by default. "Disabled" beats "undocumented"; "removed" beats "disabled". Decided now, in pre-development, so the architecture never grows the surface in the first place. |
1. Decision table (planned system, per interface)
| # | Interface / service / protocol | Needed for intended function? | Decision | Implementation rule |
|---|---|---|---|---|
| 1 | 802.15.4 radio — authenticated join + telemetry | Yes | Keep | Only AEAD-protected frames accepted; join window opens only during commissioning mode (physical button, 10 min timeout) |
| 2 | 802.15.4 — vendor "sniffer/promiscuous" test mode | No | Remove | Compiled out of production build (build flag audit in CI) |
| 3 | Firmware update service (via radio) | Yes | Keep | Accepts signed images only; no developer-key acceptance path in production build |
| 4 | SWD debug port | Production: no | Disable by default (cannot be removed physically) | Debug authentication + permanent lock fused at EOL-of-line test; verified per production batch |
| 5 | UART service connector | Field diagnosis only | Disable shell; keep signed-command protocol | No interactive shell in production image; maintenance protocol requires per-device challenge–response |
| 6 | BLE (available in candidate-B silicon) | No | Remove | BLE stack not linked; radio PHY BLE mode not initialized; documented as "present in silicon, not in firmware" in attack-surface doc |
| 7 | NFC commissioning tag | Yes (read-only ID) | Keep, constrained | Static read-only content, cryptographically bound to device ID; no write path from tag to firmware |
| 8 | Vendor SDK default services (echo/test task, RTT logging) | No | Remove | SDK integration checklist strips vendor demo tasks; RTT disabled in release build |
| 9 | Filesystem on external flash | Internal only | Not exposed | No mass-storage or file-transfer protocol on any interface |
| 10 | Multicast/broadcast command handling | Only time-sync | Constrain | Broadcast accepted solely for authenticated time-sync beacon; all other commands unicast + authenticated |
2. Architectural consequences (why this is a pre-development artifact)
- The commissioning-window design (item 1) requires a physical button in the enclosure → input to mechanical design now.
- Debug lock at end-of-line (item 4) requires a fusing step in the production test plan → input to manufacturing planning now.
- BLE removal (item 6) affects antenna/matching layout: no BLE antenna path is placed, making later "accidental enablement" physically ineffective.
3. Enforcement and verification
- This table is the normative source for the Attack Surface Document (ASD-S300), which ships with the technical documentation.
- CI gate
surface-audit: production build is scanned for forbidden symbols/services (sniffer mode, shell, RTT, BLE stack) — build fails on hit. - Release gate: SDL-CHK-030 section A verifies the as-shipped unit against this table (nmap/radio scan, fuse report).
- Any new interface during development requires a delta threat-model workshop (SEC-TM-S300 maintenance rule) before implementation.
4. Records
Decision table and CI audit configuration are quality records; deviations require PSL-approved risk acceptance and are listed in the release conformity dossier.