+RA-05(04) Discoverable Information
|
RA-05(04) Discoverable Information
Control
Determine information about the system that is discoverable and take [Assignement: corrective actions].
Discussion
Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying appropriate organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This enhancement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) deployed by the organization.
Assessment Objective
- information about the system is discoverable;
- [Assignement: corrective actions] are taken when information about the system is confirmed as discoverable.
Assessment Method
Examine
Procedures addressing vulnerability scanning
assessment report
penetration test results
vulnerability scanning results
risk assessment report
records of corrective actions taken
incident response records
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with vulnerability scanning and/or penetration testing responsibilities
organizational personnel with vulnerability scan analysis responsibilities
organizational personnel responsible for risk response
organizational personnel responsible for incident management and response
organizational personnel with security responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|