+SC-05 Denial-of-service Protection
---+SC-05(01) Restrict Ability to Attack Other Systems
---+SC-05(02) Capacity, Bandwidth, and Redundancy
---+SC-05(03) Detection and Monitoring
|
SC-05 Denial-of-service Protection
Control
- [Selection: protect against; limit] the effects of the following types of denial-of-service events: [Assignement: types of denial-of-service events] ; and
- Employ the following controls to achieve the denial-of-service objective: [Assignement: controls by type of denial-of-service event].
Discussion
Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events.
Assessment Objective
- the effects of [Assignement: types of denial-of-service events] are [Selection: protect against; limit];
- [Assignement: controls by type of denial-of-service event] are employed to achieve the denial-of-service protection objective.
Assessment Method
Examine
System and communications protection policy
procedures addressing denial-of-service protection
system design documentation
list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks
list of security safeguards protecting against or limiting the effects of denial-of-service attacks
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
system developer
1. Přehled
| Název |
Standard |
|
SC-05(01) Restrict Ability to Attack Other Systems
|
Control
Restrict the ability of individuals to launch the following denial-of-service attacks against other systems: [Assignement: denial-of-service attacks].
Discussion
Restricting the ability of individuals to launch denial-of-service attacks requires the mechanisms commonly used for such attacks to be unavailable. Individuals of concern include hostile insiders or external adversaries who have breached or compromised the system and are using it to launch a denial-of-service attack. Organizations can restrict the ability of individuals to connect and transmit arbitrary information on the transport medium (i.e., wired networks, wireless networks, spoofed Internet protocol packets). Organizations can also limit the ability of individuals to use excessive system resources. Protection against individuals having the ability to launch denial-of-service attacks may be implemented on specific systems or boundary devices that prohibit egress to potential target systems.
Assessment Objective
the ability of individuals to launch [Assignement: denial-of-service attacks] against other systems is restricted.
Assessment Method
Examine
System and communications protection policy
procedures addressing denial-of-service protection
system design documentation
list of denial-of-service attacks launched by individuals against systems
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
system developer
|
|
SC-05(02) Capacity, Bandwidth, and Redundancy
|
Control
Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding denial-of-service attacks.
Discussion
Managing capacity ensures that sufficient capacity is available to counter flooding attacks. Managing capacity includes establishing selected usage priorities, quotas, partitioning, or load balancing.
Assessment Objective
capacity, bandwidth, or other redundancies to limit the effects of information flooding denial-of-service attacks are managed.
Assessment Method
Examine
System and communications protection policy
procedures addressing denial-of-service protection
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
system developer
|
|
SC-05(03) Detection and Monitoring
|
Control
- Employ the following monitoring tools to detect indicators of denial-of-service attacks against, or launched from, the system: [Assignement: monitoring tools] ; and
- Monitor the following system resources to determine if sufficient resources exist to prevent effective denial-of-service attacks: [Assignement: system resources].
Discussion
Organizations consider the utilization and capacity of system resources when managing risk associated with a denial of service due to malicious attacks. Denial-of-service attacks can originate from external or internal sources. System resources that are sensitive to denial of service include physical disk storage, memory, and CPU cycles. Techniques used to prevent denial-of-service attacks related to storage utilization and capacity include instituting disk quotas, configuring systems to automatically alert administrators when specific storage capacity thresholds are reached, using file compression technologies to maximize available storage space, and imposing separate partitions for system and user data.
Assessment Objective
- [Assignement: monitoring tools] are employed to detect indicators of denial-of-service attacks against or launched from the system;
- [Assignement: system resources] are monitored to determine if sufficient resources exist to prevent effective denial-of-service attacks.
Assessment Method
Examine
System and communications protection policy
procedures addressing denial-of-service protection
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with detection and monitoring responsibilities
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|