+SI-07 Software, Firmware, and Information Integrity
---+SI-07(01) Integrity Checks
---+SI-07(02) Automated Notifications of Integrity Violations
---+SI-07(03) Centrally Managed Integrity Tools
---+SI-07(05) Automated Response to Integrity Violations
---+SI-07(06) Cryptographic Protection
---+SI-07(07) Integration of Detection and Response
---+SI-07(08) Auditing Capability for Significant Events
---+SI-07(09) Verify Boot Process
---+SI-07(10) Protection of Boot Firmware
---+SI-07(12) Integrity Verification
---+SI-07(15) Code Authentication
---+SI-07(16) Time Limit on Process Execution Without Supervision
---+SI-07(17) Runtime Application Self-protection
|
SI-07 Software, Firmware, and Information Integrity
Control
- Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignement: organization-defined software, firmware, and information] ; and
- Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignement: organization-defined actions].
Discussion
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.
Assessment Objective
- integrity verification tools are employed to detect unauthorized changes to [Assignement: software];
- integrity verification tools are employed to detect unauthorized changes to [Assignement: firmware];
- integrity verification tools are employed to detect unauthorized changes to [Assignement: information];
- [Assignement: actions] are taken when unauthorized changes to the software, are detected;
- [Assignement: actions] are taken when unauthorized changes to the firmware are detected;
- [Assignement: actions] are taken when unauthorized changes to the information are detected.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
personally identifiable information processing policy
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security and privacy responsibilities
system/network administrators
1. Přehled
| Název |
Standard |
|
SI-07(01) Integrity Checks
|
Control
Perform an integrity check of [Assignement: organization-defined software, firmware, and information] [Selection(one-or-more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].
Discussion
Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.
Assessment Objective
- an integrity check of [Assignement: software] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.03 }} ; {{ insert: param, si-07.01_odp.04 }} ];
- an integrity check of [Assignement: firmware] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.07 }} ; {{ insert: param, si-07.01_odp.08 }} ];
- an integrity check of [Assignement: information] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.11 }} ; {{ insert: param, si-07.01_odp.12 }} ].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity testing
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(02) Automated Notifications of Integrity Violations
|
Control
Employ automated tools that provide notification to [Assignement: personnel or roles] upon discovering discrepancies during integrity verification.
Discussion
The employment of automated tools to report system and information integrity violations and to notify organizational personnel in a timely matter is essential to effective risk response. Personnel with an interest in system and information integrity violations include mission and business owners, system owners, senior agency information security official, senior agency official for privacy, system administrators, software developers, systems integrators, information security officers, and privacy officers.
Assessment Objective
automated tools that provide notification to [Assignement: personnel or roles] upon discovering discrepancies during integrity verification are employed.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
personally identifiable information processing policy
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
automated tools supporting alerts and notifications for integrity discrepancies
notifications provided upon discovering discrepancies during integrity verifications
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security and privacy responsibilities
system administrators
software developers
|
|
SI-07(03) Centrally Managed Integrity Tools
|
Control
Employ centrally managed integrity verification tools.
Discussion
Centrally managed integrity verification tools provides greater consistency in the application of such tools and can facilitate more comprehensive coverage of integrity verification actions.
Assessment Objective
centrally managed integrity verification tools are employed.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for the central management of integrity verification tools
organizational personnel with information security responsibilities
|
|
SI-07(05) Automated Response to Integrity Violations
|
Control
Automatically [Selection(one-or-more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] when integrity violations are discovered.
Discussion
Organizations may define different integrity-checking responses by type of information, specific information, or a combination of both. Types of information include firmware, software, and user data. Specific information includes boot firmware for certain types of machines. The automatic implementation of controls within organizational systems includes reversing the changes, halting the system, or triggering audit alerts when unauthorized modifications to critical security files occur.
Assessment Objective
[Selection(one-or-more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] are automatically performed when integrity violations are discovered.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
records of integrity checks and responses to integrity violations
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(06) Cryptographic Protection
|
Control
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
Discussion
Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.
Assessment Objective
- cryptographic mechanisms are implemented to detect unauthorized changes to software;
- cryptographic mechanisms are implemented to detect unauthorized changes to firmware;
- cryptographic mechanisms are implemented to detect unauthorized changes to information.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated documentation
records of detected unauthorized changes to software, firmware, and information
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(07) Integration of Detection and Response
|
Control
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].
Discussion
Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.
Assessment Objective
the detection of [Assignement: changes] are incorporated into the organizational incident response capability.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
procedures addressing incident response
system design documentation
system configuration settings and associated documentation
incident response records
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
|
|
SI-07(08) Auditing Capability for Significant Events
|
Control
Upon detection of a potential integrity violation, provide the capability to audit the event and initiate the following actions: [Selection(one-or-more): generate an audit record; alert current user; alert {{ insert: param, si-07.08_odp.02 }} ; {{ insert: param, si-07.08_odp.03 }} ].
Discussion
Organizations select response actions based on types of software, specific software, or information for which there are potential integrity violations.
Assessment Objective
- the capability to audit an event upon the detection of a potential integrity violation is provided;
- [Selection(one-or-more): generate an audit record; alert current user; alert {{ insert: param, si-07.08_odp.02 }} ; {{ insert: param, si-07.08_odp.03 }} ] is/are initiated upon the detection of a potential integrity violation.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
incident response records
list of security-relevant changes to the system
automated tools supporting alerts and notifications if unauthorized security changes are detected
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(09) Verify Boot Process
|
Control
Verify the integrity of the boot process of the following system components: [Assignement: system components].
Discussion
Ensuring the integrity of boot processes is critical to starting system components in known, trustworthy states. Integrity verification mechanisms provide a level of assurance that only trusted code is executed during boot processes.
Assessment Objective
the integrity of the boot process of [Assignement: system components] is verified.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
documentation
records of integrity verification scans
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system developer
|
|
SI-07(10) Protection of Boot Firmware
|
Control
Implement the following mechanisms to protect the integrity of boot firmware in [Assignement: system components]: [Assignement: mechanisms].
Discussion
Unauthorized modifications to boot firmware may indicate a sophisticated, targeted attack. These types of targeted attacks can result in a permanent denial of service or a persistent malicious code presence. These situations can occur if the firmware is corrupted or if the malicious code is embedded within the firmware. System components can protect the integrity of boot firmware in organizational systems by verifying the integrity and authenticity of all updates to the firmware prior to applying changes to the system component and preventing unauthorized processes from modifying the boot firmware.
Assessment Objective
[Assignement: mechanisms] are implemented to protect the integrity of boot firmware in [Assignement: system components].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity verification scans
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(12) Integrity Verification
|
Control
Require that the integrity of the following user-installed software be verified prior to execution: [Assignement: user-installed software].
Discussion
Organizations verify the integrity of user-installed software prior to execution to reduce the likelihood of executing malicious code or programs that contains errors from unauthorized modifications. Organizations consider the source of the software, ensuring the software and updates come from authorized sources and/or sites, and the practicality of approaches to verifying software integrity, including the availability of trustworthy checksums from software developers and vendors.
Assessment Objective
the integrity of [Assignement: user-installed software] is verified prior to execution.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
integrity verification records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
|
|
SI-07(15) Code Authentication
|
Control
Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignement: software or firmware components].
Discussion
Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.
Assessment Objective
cryptographic mechanisms are implemented to authenticate [Assignement: software or firmware components] prior to installation.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(16) Time Limit on Process Execution Without Supervision
|
Control
Prohibit processes from executing without supervision for more than [Assignement: time period].
Discussion
Placing a time limit on process execution without supervision is intended to apply to processes for which typical or normal execution periods can be determined and situations in which organizations exceed such periods. Supervision includes timers on operating systems, automated responses, and manual oversight and response when system process anomalies occur.
Assessment Objective
processes are prohibited from executing without supervision for more than [Assignement: time period].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software and information integrity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(17) Runtime Application Self-protection
|
Control
Implement [Assignement: controls] for application self-protection at runtime.
Discussion
Runtime application self-protection employs runtime instrumentation to detect and block the exploitation of software vulnerabilities by taking advantage of information from the software in execution. Runtime exploit prevention differs from traditional perimeter-based protections such as guards and firewalls which can only detect and block attacks by using network information without contextual awareness. Runtime application self-protection technology can reduce the susceptibility of software to attacks by monitoring its inputs and blocking those inputs that could allow attacks. It can also help protect the runtime environment from unwanted changes and tampering. When a threat is detected, runtime application self-protection technology can prevent exploitation and take other actions (e.g., sending a warning message to the user, terminating the user's session, terminating the application, or sending an alert to organizational personnel). Runtime application self-protection solutions can be deployed in either a monitor or protection mode.
Assessment Objective
[Assignement: controls] are implemented for application self-protection at runtime.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software and information integrity
system design documentation
system configuration settings and associated documentation
list of known vulnerabilities addressed by runtime instrumentation
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|