+AC-04(25) Data Sanitization
|
AC-04(25) Data Sanitization
Control
When transferring information between different security domains, sanitize data to minimize [Selection(one-or-more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information] in accordance with [Assignement: policy].
Discussion
Data sanitization is the process of irreversibly removing or destroying data stored on a memory device (e.g., hard drives, flash memory/solid state drives, mobile devices, CDs, and DVDs) or in hard copy form.
Assessment Objective
when transferring information between different security domains, data is sanitized to minimize [Selection(one-or-more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information] in accordance with [Assignement: policy].
Assessment Method
Examine
Information flow enforcement policy
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with information flow enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|