+CM-07 Least Functionality
---+CM-07(01) Periodic Review
---+CM-07(02) Prevent Program Execution
---+CM-07(03) Registration Compliance
---+CM-07(04) Unauthorized Software — Deny-by-exception
---+CM-07(05) Authorized Software — Allow-by-exception
---+CM-07(06) Confined Environments with Limited Privileges
---+CM-07(07) Code Execution in Protected Environments
---+CM-07(08) Binary or Machine Executable Code
---+CM-07(09) Prohibiting The Use of Unauthorized Hardware
|
CM-07 Least Functionality
Control
- Configure the system to provide only [Assignement: mission-essential capabilities] ; and
- Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignement: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].
Discussion
Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).
Assessment Objective
- the system is configured to provide only [Assignement: mission-essential capabilities];
- the use of [Assignement: functions] is prohibited or restricted;
- the use of [Assignement: ports] is prohibited or restricted;
- the use of [Assignement: protocols] is prohibited or restricted;
- the use of [Assignement: software] is prohibited or restricted;
- the use of [Assignement: services] is prohibited or restricted.
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
system component inventory
common secure configuration checklists
system security plan
other relevant documents or records
Interview
Organizational personnel with security configuration management responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
1. Übersicht
| Bezeichnung |
Standard |
|
CM-07(01) Periodic Review
|
Control
- Review the system [Assignement: frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and
- Disable or remove [Assignement: organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].
Discussion
Organizations review functions, ports, protocols, and services provided by systems or system components to determine the functions and services that are candidates for elimination. Such reviews are especially important during transition periods from older technologies to newer technologies (e.g., transition from IPv4 to IPv6). These technology transitions may require implementing the older and newer technologies simultaneously during the transition period and returning to minimum essential functions, ports, protocols, and services at the earliest opportunity. Organizations can either decide the relative security of the function, port, protocol, and/or service or base the security decision on the assessment of other entities. Unsecure protocols include Bluetooth, FTP, and peer-to-peer networking.
Assessment Objective
- the system is reviewed [Assignement: frequency] to identify unnecessary and/or non-secure functions, ports, protocols, software, and services:
- [Assignement: functions] deemed to be unnecessary and/or non-secure are disabled or removed;
- [Assignement: ports] deemed to be unnecessary and/or non-secure are disabled or removed;
- [Assignement: protocols] deemed to be unnecessary and/or non-secure are disabled or removed;
- [Assignement: software] deemed to be unnecessary and/or non-secure is disabled or removed;
- [Assignement: services] deemed to be unnecessary and/or non-secure are disabled or removed.
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
common secure configuration checklists
documented reviews of functions, ports, protocols, and/or services
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for reviewing functions, ports, protocols, and services on the system
organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
CM-07(02) Prevent Program Execution
|
Control
Prevent program execution in accordance with [Selection(one-or-more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage].
Discussion
Prevention of program execution addresses organizational policies, rules of behavior, and/or access agreements that restrict software usage and the terms and conditions imposed by the developer or manufacturer, including software licensing and copyrights. Restrictions include prohibiting auto-execute features, restricting roles allowed to approve program execution, permitting or prohibiting specific software programs, or restricting the number of program instances executed at the same time.
Assessment Objective
program execution is prevented in accordance with [Selection(one-or-more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
system component inventory
common secure configuration checklists
specifications for preventing software program execution
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with information security responsibilities
system/network administrators
system developers
|
|
CM-07(03) Registration Compliance
|
Control
Ensure compliance with [Assignement: registration requirements].
Discussion
Organizations use the registration process to manage, track, and provide oversight for systems and implemented functions, ports, protocols, and services.
Assessment Objective
[Assignement: registration requirements] are complied with.
Assessment Method
Examine
System security plan
configuration management policy
procedures addressing least functionality in the system
configuration management plan
system configuration settings and associated documentation
system component inventory
audit and compliance reviews
system audit records
other relevant documents or records
Interview
Organizational personnel with security responsibilities
system/network administrators
system developers
|
|
CM-07(04) Unauthorized Software — Deny-by-exception
|
Control
- Identify [Assignement: software programs];
- Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and
- Review and update the list of unauthorized software programs [Assignement: frequency].
Discussion
Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses.
Assessment Objective
- [Assignement: software programs] are identified;
- an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system;
- the list of unauthorized software programs is reviewed and updated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list of software programs not authorized to execute on the system
system component inventory
common secure configuration checklists
review and update records associated with list of unauthorized software programs
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for identifying software not authorized to execute on the system
organizational personnel with information security responsibilities
system/network administrators
|
|
CM-07(05) Authorized Software — Allow-by-exception
|
Control
- Identify [Assignement: software programs];
- Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
- Review and update the list of authorized software programs [Assignement: frequency].
Discussion
Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries. The concept of permitting the execution of authorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses. Organizations consider verifying the integrity of authorized software programs using digital signatures, cryptographic checksums, or hash functions. Verification of authorized software can occur either prior to execution or at system startup. The identification of authorized URLs for websites is addressed in [CA-3(5)](#ca-3.5) and [SC-7](#sc-7).
Assessment Objective
- [Assignement: software programs] are identified;
- a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed;
- the list of authorized software programs is reviewed and updated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list of software programs authorized to execute on the system
system component inventory
common secure configuration checklists
review and update records associated with list of authorized software programs
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for identifying software authorized to execute on the system
organizational personnel with information security responsibilities
system/network administrators
|
|
CM-07(06) Confined Environments with Limited Privileges
|
Control
Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignement: user-installed software].
Discussion
Organizations identify software that may be of concern regarding its origin or potential for containing malicious code. For this type of software, user installations occur in confined environments of operation to limit or contain damage from malicious code that may be executed.
Assessment Objective
[Assignement: user-installed software] is required to be executed in a confined physical or virtual machine environment with limited privileges.
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list or record of software required to execute in a confined environment
system component inventory
common secure configuration checklists
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for identifying and/or managing user-installed software and associated privileges
organizational personnel with information security responsibilities
system/network administrators
|
|
CM-07(07) Code Execution in Protected Environments
|
Control
Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignement: personnel or roles] when such code is:- Obtained from sources with limited or no warranty; and/or
- Without the provision of source code.
Discussion
Code execution in protected environments applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software.
Assessment Objective
the execution of binary or machine-executable code is only allowed in confined physical or virtual machine environments;- the execution of binary or machine-executable code obtained from sources with limited or no warranty is only allowed with the explicit approval of [Assignement: personnel or roles];
- the execution of binary or machine-executable code without the provision of source code is only allowed with the explicit approval of [Assignement: personnel or roles].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list or record of binary or machine-executable code
system component inventory
common secure configuration checklists
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for approving execution of binary or machine-executable code
organizational personnel with information security responsibilities
organizational personnel with software management responsibilities
system/network administrators
system developers
|
|
CM-07(08) Binary or Machine Executable Code
|
Control
- Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and
- Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
Discussion
Binary or machine executable code applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software. Organizations assess software products without accompanying source code or from sources with limited or no warranty for potential security impacts. The assessments address the fact that software products without the provision of source code may be difficult to review, repair, or extend. In addition, there may be no owners to make such repairs on behalf of organizations. If open-source software is used, the assessments address the fact that there is no warranty, the open-source software could contain back doors or malware, and there may be no support available.
Assessment Objective
- the use of binary or machine-executable code is prohibited when it originates from sources with limited or no warranty or without the provision of source code;
- exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only for compelling mission or operational requirements;
- exceptions to the prohibition of binary or machine-executable code from sources with limited or no warranty or without the provision of source code are allowed only with the approval of the authorizing official.
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system security plan
system design documentation
system configuration settings and associated documentation
list or record of binary or machine-executable code
system component inventory
common secure configuration checklists
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for determining mission and operational requirements
authorizing official for the system
organizational personnel with information security responsibilities
organizational personnel with software management responsibilities
system/network administrators
|
|
CM-07(09) Prohibiting The Use of Unauthorized Hardware
|
Control
- Identify [Assignement: hardware components];
- Prohibit the use or connection of unauthorized hardware components;
- Review and update the list of authorized hardware components [Assignement: frequency].
Discussion
Hardware components provide the foundation for organizational systems and the platform for the execution of authorized software programs. Managing the inventory of hardware components and controlling which hardware components are permitted to be installed or connected to organizational systems is essential in order to provide adequate security.
Assessment Objective
- [Assignement: hardware components] are identified;
- the use or connection of unauthorized hardware components is prohibited;
- the list of authorized hardware components is reviewed and updated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
network connection policy and procedures
configuration management plan
system security plan
system design documentation
system component inventory
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with system hardware management responsibilities
organizational personnel with information security responsibilities
system/network administrators
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|