+AC-04(14) Security or Privacy Policy Filter Constraints
|
AC-04(14) Security or Privacy Policy Filter Constraints
Control
When transferring information between different security domains, implement [Assignement: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.
Discussion
Data structure and content restrictions reduce the range of potential malicious or unsanctioned content in cross-domain transactions. Security or privacy policy filters that restrict data structures include restricting file sizes and field lengths. Data content policy filters include encoding formats for character sets, restricting character data fields to only contain alpha-numeric characters, prohibiting special characters, and validating schema structures.
Assessment Objective
- when transferring information between different security domains, implemented [Assignement: security policy filters] require fully enumerated formats that restrict data structure and content;
- when transferring information between different security domains, implemented [Assignement: privacy policy filters] require fully enumerated formats that restrict data structure and content.
Assessment Method
Examine
Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of security and privacy policy filters
list of data structure policy filters
list of data content policy filters
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security and privacy responsibilities
system developers
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|