Assessment Objective
Determine if:
- SC-18(04)[01] the automatic execution of mobile code in [Assignment: software applications] is prevented;
- SC-18(04)[02] [Assignment: actions] are enforced prior to executing mobile code.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing mobile code
- mobile code usage restrictions
- mobile code implementation policy and procedures
- system design documentation
- system configuration settings and associated documentation
- list of software applications in which the automatic execution of mobile code must be prohibited
- list of actions required before execution of mobile code
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with responsibilities for managing mobile code
Test
- Mechanisms preventing the automatic execution of unacceptable mobile code
- mechanisms enforcing actions to be taken prior to the execution of the mobile code
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | SC-18(04) Prevent Automatic Execution |