+SI-14 Non-persistence
---+SI-14(01) Refresh from Trusted Sources
---+SI-14(02) Non-persistent Information
---+SI-14(03) Non-persistent Connectivity
|
SI-14 Non-persistence
Control
Implement non-persistent [Assignement: system components and services] that are initiated in a known state and terminated [Selection(one-or-more): upon end of session of use; {{ insert: param, si-14_odp.03 }} ].
Discussion
Implementation of non-persistent components and services mitigates risk from advanced persistent threats (APTs) by reducing the targeting capability of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. By implementing the concept of non-persistence for selected system components, organizations can provide a trusted, known state computing resource for a specific time period that does not give adversaries sufficient time to exploit vulnerabilities in organizational systems or operating environments. Since the APT is a high-end, sophisticated threat with regard to capability, intent, and targeting, organizations assume that over an extended period, a percentage of attacks will be successful. Non-persistent system components and services are activated as required using protected information and terminated periodically or at the end of sessions. Non-persistence increases the work factor of adversaries attempting to compromise or breach organizational systems.
Non-persistence can be achieved by refreshing system components, periodically reimaging components, or using a variety of common virtualization techniques. Non-persistent services can be implemented by using virtualization techniques as part of virtual machines or as new instances of processes on physical machines (either persistent or non-persistent). The benefit of periodic refreshes of system components and services is that it does not require organizations to first determine whether compromises of components or services have occurred (something that may often be difficult to determine). The refresh of selected system components and services occurs with sufficient frequency to prevent the spread or intended impact of attacks, but not with such frequency that it makes the system unstable. Refreshes of critical components and services may be done periodically to hinder the ability of adversaries to exploit optimum windows of vulnerabilities.
Assessment Objective
- non-persistent [Assignement: system components and services] that are initiated in a known state are implemented;
- non-persistent [Assignement: system components and services] are terminated [Selection(one-or-more): upon end of session of use; {{ insert: param, si-14_odp.03 }} ].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for non-persistence
organizational personnel with information security responsibilities
system/network administrators
system developer
1. Übersicht
| Bezeichnung |
Standard |
|
SI-14(01) Refresh from Trusted Sources
|
Control
Obtain software and data employed during system component and service refreshes from the following trusted sources: [Assignement: trusted sources].
Discussion
Trusted sources include software and data from write-once, read-only media or from selected offline secure storage facilities.
Assessment Objective
the software and data employed during system component and service refreshes are obtained from [Assignement: trusted sources].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for obtaining component and service refreshes from trusted sources
organizational personnel with information security responsibilities
|
|
SI-14(02) Non-persistent Information
|
Control
- [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] ; and
- Delete information when no longer needed.
Discussion
Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.
Assessment Objective
- [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] is performed;
- information is deleted when no longer needed.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for ensuring that information is and remains non-persistent
organizational personnel with information security responsibilities
|
|
SI-14(03) Non-persistent Connectivity
|
Control
Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].
Discussion
Persistent connections to systems can provide advanced adversaries with paths to move laterally through systems and potentially position themselves closer to high value assets. Limiting the availability of such connections impedes the adversary’s ability to move freely through organizational systems.
Assessment Objective
- connections to the system are established on demand;
- connections to the system are terminated after [Selection: completion of a request; a period of non-use].
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for limiting persistent connections
organizational personnel with information security responsibilities
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|