+SI-14(03) Non-persistent Connectivity

SI-14(03) Non-persistent Connectivity

Control

Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].

Discussion

Persistent connections to systems can provide advanced adversaries with paths to move laterally through systems and potentially position themselves closer to high value assets. Limiting the availability of such connections impedes the adversary’s ability to move freely through organizational systems.

Assessment Objective

  1. connections to the system are established on demand;
  2. connections to the system are terminated after [Selection: completion of a request; a period of non-use].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing non-persistence for system components system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for limiting persistent connections organizational personnel with information security responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by SI-14(03) Non-persistent Connectivity – Assessment Procedure