+SI-08 Spam Protection
---+SI-08(02) Automatic Updates
---+SI-08(03) Continuous Learning Capability

SI-08 Spam Protection

Control

  1. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and
  2. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Discussion

System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.

Assessment Objective

    1. spam protection mechanisms are employed at system entry points to detect unsolicited messages;
    2. spam protection mechanisms are employed at system exit points to detect unsolicited messages;
    3. spam protection mechanisms are employed at system entry points to act on unsolicited messages;
    4. spam protection mechanisms are employed at system exit points to act on unsolicited messages;
  2. spam protection mechanisms are updated when new releases are available in accordance with organizational configuration management policies and procedures.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures configuration management policies and procedures (CM-01) procedures addressing spam protection spam protection mechanisms records of spam protection updates system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for spam protection organizational personnel with information security responsibilities system/network administrators system developer

1. Oversigt

SI-08(02) Automatic Updates

Control

Automatically update spam protection mechanisms [Assignement: frequency].

Discussion

Using automated mechanisms to update spam protection mechanisms helps to ensure that updates occur on a regular basis and provide the latest content and protection capabilities.

Assessment Objective

spam protection mechanisms are automatically updated [Assignement: frequency].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing spam protection spam protection mechanisms records of spam protection updates system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for spam protection organizational personnel with information security responsibilities system/network administrators system developer
SI-08(03) Continuous Learning Capability

Control

Implement spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.

Discussion

Learning mechanisms include Bayesian filters that respond to user inputs that identify specific traffic as spam or legitimate by updating algorithm parameters and thereby more accurately separating types of traffic.

Assessment Objective

spam protection mechanisms with a learning capability are implemented to more effectively identify legitimate communications traffic.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing spam protection spam protection mechanisms system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for spam protection organizational personnel with information security responsibilities system/network administrators system developer

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SI-08 Spam Protection – Assessment Procedure
is blocked by Automatic Endpoint Protection Mechanism Updates
is blocked by Phishing & Spam Protection