+SC-48 Sensor Relocation
---+SC-48(01) Dynamic Relocation of Sensors or Monitoring Capabilities
|
SC-48 Sensor Relocation
Control
Relocate [Assignement: sensors and monitoring capabilities] to [Assignement: locations] under the following conditions or circumstances: [Assignement: conditions or circumstances].
Discussion
Adversaries may take various paths and use different approaches as they move laterally through an organization (including its systems) to reach their target or as they attempt to exfiltrate information from the organization. The organization often only has a limited set of monitoring and detection capabilities, and they may be focused on the critical or likely infiltration or exfiltration paths. By using communications paths that the organization typically does not monitor, the adversary can increase its chances of achieving its desired goals. By relocating its sensors or monitoring capabilities to new locations, the organization can impede the adversary’s ability to achieve its goals. The relocation of the sensors or monitoring capabilities might be done based on threat information that the organization has acquired or randomly to confuse the adversary and make its lateral transition through the system or organization more challenging.
Assessment Objective
[Assignement: sensors and monitoring capabilities] are relocated to [Assignement: locations] under [Assignement: conditions or circumstances].
Assessment Method
Examine
System and communications protection policy
procedures addressing sensor and monitoring capability relocation
list of sensors/monitoring capabilities to be relocated
change control records
configuration management records
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|