+SI-07 [M] Software, Firmware, and Information Integrity
---+SI-07(01) [M] Integrity Checks
---+SI-07(07) [M] Integration of Detection and Response
|
SI-07 [M] Software, Firmware, and Information Integrity
Control
- Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignement: organization-defined software, firmware, and information] ; and
- Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignement: organization-defined actions].
Discussion
Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.
Assessment Objective
- integrity verification tools are employed to detect unauthorized changes to [Assignement: software];
- integrity verification tools are employed to detect unauthorized changes to [Assignement: firmware];
- integrity verification tools are employed to detect unauthorized changes to [Assignement: information];
- [Assignement: actions] are taken when unauthorized changes to the software, are detected;
- [Assignement: actions] are taken when unauthorized changes to the firmware are detected;
- [Assignement: actions] are taken when unauthorized changes to the information are detected.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
personally identifiable information processing policy
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security and privacy responsibilities
system/network administrators
1. Přehled
| Název |
Standard |
|
SI-07(01) [M] Integrity Checks
|
Control
Perform an integrity check of [Assignement: organization-defined software, firmware, and information] [Selection(one-or-more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].
Discussion
Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.
Assessment Objective
- an integrity check of [Assignement: software] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.03 }} ; {{ insert: param, si-07.01_odp.04 }} ];
- an integrity check of [Assignement: firmware] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.07 }} ; {{ insert: param, si-07.01_odp.08 }} ];
- an integrity check of [Assignement: information] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.11 }} ; {{ insert: param, si-07.01_odp.12 }} ].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity testing
system design documentation
system configuration settings and associated documentation
integrity verification tools and associated documentation
records of integrity scans
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
|
|
SI-07(07) [M] Integration of Detection and Response
|
Control
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].
Discussion
Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.
Assessment Objective
the detection of [Assignement: changes] are incorporated into the organizational incident response capability.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
procedures addressing incident response
system design documentation
system configuration settings and associated documentation
incident response records
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
|
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|