+SI-10(06) Injection Prevention

SI-10(06) Injection Prevention

Control

Prevent untrusted data injections.

Discussion

Untrusted data injections may be prevented using a parameterized interface or output escaping (output encoding). Parameterized interfaces separate data from code so that injections of malicious or unintended data cannot change the semantics of commands being sent. Output escaping uses specified characters to inform the interpreter’s parser whether data is trusted. Prevention of untrusted data injections are with respect to the information inputs defined by the organization in the base control ( [SI-10](#si-10)).

Assessment Objective

untrusted data injections are prevented.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing information input validation system design documentation system configuration settings and associated documentation list of trusted sources for information inputs list of acceptable formats for input restrictions system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for information input validation organizational personnel with information security responsibilities system/network administrators system developer

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SI-10(06) Injection Prevention – Assessment Procedure