+SC-30 Concealment and Misdirection
---+SC-30(02) Randomness
---+SC-30(03) Change Processing and Storage Locations
---+SC-30(04) Misleading Information
---+SC-30(05) Concealment of System Components
|
SC-30 Concealment and Misdirection
Control
Employ the following concealment and misdirection techniques for [Assignement: systems] at [Assignement: time periods] to confuse and mislead adversaries: [Assignement: concealment and misdirection techniques].
Discussion
Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of concealment and misdirection techniques and methods—including randomness, uncertainty, and virtualization—may sufficiently confuse and mislead adversaries and subsequently increase the risk of discovery and/or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system.
Assessment Objective
[Assignement: concealment and misdirection techniques] are employed for [Assignement: systems] for [Assignement: time periods] to confuse and mislead adversaries.
Assessment Method
Examine
System and communications protection policy
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
system architecture
list of concealment and misdirection techniques to be employed for organizational systems
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with the responsibility to implement concealment and misdirection techniques for systems
1. Oversigt
| Titel |
Standard |
|
SC-30(02) Randomness
|
Control
Employ [Assignement: techniques] to introduce randomness into organizational operations and assets.
Discussion
Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target information resources of organizations that support critical missions or business functions. Uncertainty may also cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating roles and responsibilities of organizational personnel.
Assessment Objective
[Assignement: techniques] are employed to introduce randomness into organizational operations and assets.
Assessment Method
Examine
System and communications protection policy
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
system architecture
list of techniques to be employed to introduce randomness into organizational operations and assets
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with the responsibility to implement concealment and misdirection techniques for systems
|
|
SC-30(03) Change Processing and Storage Locations
|
Control
Change the location of [Assignement: processing and/or storage] [Selection: {{ insert: param, sc-30.03_odp.03 }} ; random time intervals]].
Discussion
Adversaries target critical mission and business functions and the systems that support those mission and business functions while also trying to minimize the exposure of their existence and tradecraft. The static, homogeneous, and deterministic nature of organizational systems targeted by adversaries make such systems more susceptible to attacks with less adversary cost and effort to be successful. Changing processing and storage locations (also referred to as moving target defense) addresses the advanced persistent threat using techniques such as virtualization, distributed processing, and replication. This enables organizations to relocate the system components (i.e., processing, storage) that support critical mission and business functions. Changing the locations of processing activities and/or storage sites introduces a degree of uncertainty into the targeting activities of adversaries. The targeting uncertainty increases the work factor of adversaries and makes compromises or breaches of the organizational systems more difficult and time-consuming. It also increases the chances that adversaries may inadvertently disclose certain aspects of their tradecraft while attempting to locate critical organizational resources.
Assessment Objective
the location of [Assignement: processing and/or storage] is changed [Selection: {{ insert: param, sc-30.03_odp.03 }} ; random time intervals].
Assessment Method
Examine
System and communications protection policy
configuration management policy and procedures
procedures addressing concealment and misdirection techniques for the system
list of processing/storage locations to be changed at organizational time intervals
change control records
configuration management records
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with the responsibility to change processing and/or storage locations
|
|
SC-30(04) Misleading Information
|
Control
Employ realistic, but misleading information in [Assignement: system components] about its security state or posture.
Discussion
Employing misleading information is intended to confuse potential adversaries regarding the nature and extent of controls deployed by organizations. Thus, adversaries may employ incorrect and ineffective attack techniques. One technique for misleading adversaries is for organizations to place misleading information regarding the specific controls deployed in external systems that are known to be targeted by adversaries. Another technique is the use of deception nets that mimic actual aspects of organizational systems but use, for example, out-of-date software configurations.
Assessment Objective
realistic but misleading information about the security state or posture of [Assignement: system components] is employed.
Assessment Method
Examine
System and communications protection policy
configuration management policy and procedures
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with the responsibility to define and employ realistic but misleading information about the security posture of system components
|
|
SC-30(05) Concealment of System Components
|
Control
Employ the following techniques to hide or conceal [Assignement: system components]: [Assignement: techniques].
Discussion
By hiding, disguising, or concealing critical system components, organizations may be able to decrease the probability that adversaries target and successfully compromise those assets. Potential means to hide, disguise, or conceal system components include the configuration of routers or the use of encryption or virtualization techniques.
Assessment Objective
[Assignement: techniques] are employed to hide or conceal [Assignement: system components].
Assessment Method
Examine
System and communications protection policy
configuration management policy and procedures
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
list of techniques employed to hide or conceal system components
list of system components to be hidden or concealed
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with the responsibility to conceal system components
|
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|