Security
Cyber Security for DPP Systems
Designing security into passport infrastructure — access control, API security, supplier portal risk, incident response and the persistence constraint.
A Digital Product Passport system has, by definition, a public surface: millions of QR codes pointing at a service anyone can reach. The same system carries trade secrets and audit data in restricted tiers. That duality demands security design from the start.
Threat model
| Threat | Impact | Mitigation |
|---|---|---|
| Load attack on public endpoints | Passport unreachable | CDN, caching, rate limiting |
| Unauthorised restricted tier access | Trade secret leakage | Role-based authorisation, time-bound access |
| Supplier account compromise | Wrong data entered | MFA, least privilege, approval flow |
| Data integrity breach | Misleading declaration | Signed versions. See EN 18246 |
| Dependency supply chain attack | Platform compromise | Dependency auditing, signed builds |
Designing the public tier
The public tier serves without authentication, making it a natural DDoS target. Design rules:
- Produce static, cacheable responses; passport content changes rarely.
- Use a CDN and do not expose the origin directly.
- Rate limit — aggressive limits are reasonable even for scan analytics.
- Carry no personal data. See GDPR and DPP data.
Supplier portal risk
The portal opened for data collection adds the most users to the system, with the widest range of security maturity. Measures:
- Multi-factor authentication.
- Least privilege: a supplier sees only its own records.
- Input validation and an approval flow — entered data is not published directly.
- Session and access logging.
See collecting data from suppliers and DPP data quality management.
Persistence and incident response
In classic incident response, "take the service down, investigate, bring it back" is an option. For a passport that conflicts with the compliance duty to stay reachable. Therefore:
- Keep a read-only standby service available.
- Separate the write path so writes can be disabled without disabling reads.
- Test failover with your backup provider. See data persistence and backup.
Frequently asked questions
Does passport data contain personal data?
It should not. Dynamic data scenarios such as battery usage carry indirect linkage risk; use aggregation. See battery state of health.
Should restricted tier data be encrypted?
TLS in transit is mandatory; encryption at rest with proper key management is good practice.
Can I withdraw a passport during a security incident?
Change its status rather than deleting it. See passport lifecycle management.
