3.12 Security Assessment and Monitoring

Statement

Conduct penetration testing {{ insert: param, A.03.12.01E.ODP.01 }} on {{ insert: param, A.03.12.01E.ODP.02 }}.

Guidance

Penetration testing is a specialized type of assessment conducted on systems or system components to identify vulnerabilities that could be exploited by adversaries. It is conducted by penetration testing agents and teams with particular skills and experience that include technical expertise in network, operating system, and application-level security. Penetration testing can be used to validate vulnerabilities or to determine a system’s penetration resistance to adversaries within specified constraints, such as time, resources, and skills. It can be conducted internally or externally on the hardware, software, or firmware components of a system and can exercise both physical and technical controls. A standard method for conducting penetration testing includes pretest analysis based on full knowledge of the system, pretest identification of potential vulnerabilities based on the pretest analysis, and testing designed to determine the exploitability of vulnerabilities. All parties agree to the specified rules of engagement before the commencement of penetration testing. Organizations may also supplement penetration testing with red team exercises. Red teams attempt to duplicate the actions of adversaries in carrying out attacks against organizations and provide an in-depth analysis of security-related weaknesses or deficiencies. Organizations correlate the rules of engagement for penetration tests and red teaming exercises (if used) with the tools, techniques, and procedures that they anticipate adversaries may employ. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

penetration testing is conducted {{ insert: param, A.03.12.01E.ODP.01 }} on {{ insert: param, A.03.12.01E.ODP.02 }}.

Assessment method

• Assessment and monitoring policy procedures addressing penetration testing assessment plan system security plan penetration test rules of engagement penetration test report assessment report assessment evidence other relevant documents or records

Assessment method

• Personnel with assessment responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Mechanisms supporting penetration testing

Statement

Use independent assessors or assessment teams to conduct security requirement assessments.

Guidance

Independent assessors or assessment teams are individuals or groups who conduct impartial assessments of systems. Impartiality means that assessors are free from any perceived or actual conflicts of interest regarding the development, operation, sustainment, or management of the systems under assessment or the determination of security requirement effectiveness. To achieve impartiality, assessors do not create a mutual or conflicting interest with the organizations where the assessments are being conducted, assess their own work, act as management or employees of the organizations they are serving, or place themselves in positions of advocacy for the organizations acquiring their services. Independent assessments can be obtained from entities that are internal or external to organizations. Organizations determine whether the level of assessor independence provides sufficient assurance such that the assessment results are sound and can be used to make effective risk-based decisions. This requirement enhances SP 800-171 requirement 03.12.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

independent assessors or assessment teams are used to conduct security requirement assessments.

Assessment method

• Assessment and monitoring policy procedures addressing assessments previous assessment plan previous assessment report plan of action and milestones system security plan other relevant documents or records

Assessment method

• Personnel with assessment responsibilities personnel with information security responsibilities

Statement

Ensure risk monitoring is an integral part of the continuous monitoring strategy that includes effectiveness monitoring, compliance monitoring, change monitoring.

Guidance

Risk monitoring is guided and informed by the established organizational risk tolerance. Effectiveness monitoring determines the ongoing effectiveness of the implemented risk response measures. Compliance monitoring verifies that required risk response measures are implemented. It also verifies that security requirements are satisfied. Change monitoring identifies changes to organizational systems and environments of operation that may affect security risk. This requirement enhances SP 800-171 requirement 03.12.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

risk monitoring is an integral part of the continuous monitoring strategy.

Assessment objective

effectiveness monitoring is included in risk monitoring.

Assessment objective

compliance monitoring is included in risk monitoring.

Assessment objective

change monitoring is included in risk monitoring.

Assessment method

• Assessment and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system assessment report plan of action and milestones system monitoring records impact analyses status reports system security plan other relevant documents or records

Assessment method

• Personnel with continuous monitoring responsibilities personnel with information security responsibilities

Assessment method

• Mechanisms supporting risk monitoring

Statement

• Authorize internal connections of {{ insert: param, A.03.12.04E.ODP.01 }} to the system.

• Document, for each internal connection, the interface characteristics, security requirements, and the nature of the information communicated.

• Terminate internal system connections after {{ insert: param, A.03.12.04E.ODP.02 }}.

• Review {{ insert: param, A.03.12.04E.ODP.03 }} the continued need for each internal connection.

Guidance

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system), including components that are used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or business functions. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

internal connections of {{ insert: param, A.03.12.04E.ODP.01 }} to the system are authorized.

Assessment objective

for each internal connection, the interface characteristics are documented.

Assessment objective

for each internal connection, the security requirements are documented.

Assessment objective

for each internal connection, the nature of the information communicated is documented.

Assessment objective

internal system connections are terminated after {{ insert: param, A.03.12.04E.ODP.02 }}.

Assessment objective

the continued need for each internal connection is reviewed {{ insert: param, A.03.12.04E.ODP.03 }}.

Assessment method

• Assessment and monitoring policy access control policy procedures addressing system connections system and communications protection policy system design documentation system audit records list of components or classes of components authorized as internal system connections system security plan system configuration settings and associated documentation assessment report other relevant documents or records

Assessment method

• Personnel with responsibilities for developing, implementing, or authorizing internal system connections personnel with information security and responsibilities

Assessment method

• Mechanisms supporting internal system connections