+SC-18(04) Prevent Automatic Execution

SC-18(04) Prevent Automatic Execution

Control

Prevent the automatic execution of mobile code in [Assignement: software applications] and enforce [Assignement: actions] prior to executing the code.

Discussion

Actions enforced before executing mobile code include prompting users prior to opening email attachments or clicking on web links. Preventing the automatic execution of mobile code includes disabling auto-execute features on system components that employ portable storage devices, such as compact discs, digital versatile discs, and universal serial bus devices.

Assessment Objective

  1. the automatic execution of mobile code in [Assignement: software applications] is prevented;
  2. [Assignement: actions] are enforced prior to executing mobile code.

Assessment Method

Examine

System and communications protection policy procedures addressing mobile code mobile code usage restrictions mobile code implementation policy and procedures system design documentation system configuration settings and associated documentation list of software applications in which the automatic execution of mobile code must be prohibited list of actions required before execution of mobile code system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with responsibilities for managing mobile code

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SC-18(04) Prevent Automatic Execution – Assessment Procedure
is blocked by Explicitly Allow / Deny Applications
is blocked by Mobile Code