+SC-07(11) Restrict Incoming Communications Traffic
|
SC-07(11) Restrict Incoming Communications Traffic
Control
Only allow incoming communications from [Assignement: authorized sources] to be routed to [Assignement: authorized destinations].
Discussion
General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.
Assessment Objective
only incoming communications from [Assignement: authorized sources] are allowed to be routed to [Assignement: authorized destinations].
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|