+SC-07 [L] Boundary Protection

SC-07 [L] Boundary Protection

Control

  1. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
  2. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
  3. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Discussion

Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).

Assessment Objective

    1. communications at external managed interfaces to the system are monitored;
    2. communications at external managed interfaces to the system are controlled;
    3. communications at key internal managed interfaces within the system are monitored;
    4. communications at key internal managed interfaces within the system are controlled;
  2. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
  3. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Assessment Method

Examine

System and communications protection policy procedures addressing boundary protection list of key internal boundaries of the system system design documentation boundary protection hardware and software system configuration settings and associated documentation enterprise security architecture documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SC-07 [L] Boundary Protection – Assessment Procedure
is blocked by Boundary Protection