+SC-07 [M] Boundary Protection
---+SC-07(03) [M] Access Points
---+SC-07(04) [M] External Telecommunications Services
---+SC-07(05) [M] Deny by Default — Allow by Exception
---+SC-07(07) [M] Split Tunneling for Remote Devices
---+SC-07(08) [M] Route Traffic to Authenticated Proxy Servers
|
SC-07 [M] Boundary Protection
Control
- Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
- Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
- Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
Discussion
Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).
Assessment Objective
- communications at external managed interfaces to the system are monitored;
- communications at external managed interfaces to the system are controlled;
- communications at key internal managed interfaces within the system are monitored;
- communications at key internal managed interfaces within the system are controlled;
- subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
- external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
list of key internal boundaries of the system
system design documentation
boundary protection hardware and software
system configuration settings and associated documentation
enterprise security architecture documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
1. Übersicht
| Bezeichnung |
Standard |
|
SC-07(03) [M] Access Points
|
Control
Limit the number of external network connections to the system.
Discussion
Limiting the number of external network connections facilitates monitoring of inbound and outbound communications traffic. The Trusted Internet Connection [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) initiative is an example of a federal guideline that requires limits on the number of external network connections. Limiting the number of external network connections to the system is important during transition periods from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols). Such transitions may require implementing the older and newer technologies simultaneously during the transition period and thus increase the number of access points to the system.
Assessment Objective
the number of external network connections to the system is limited.
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
system design documentation
boundary protection hardware and software
system architecture and configuration documentation
system configuration settings and associated documentation
communications and network traffic monitoring logs
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with boundary protection responsibilities
|
|
SC-07(04) [M] External Telecommunications Services
|
Control
- Implement a managed interface for each external telecommunication service;
- Establish a traffic flow policy for each managed interface;
- Protect the confidentiality and integrity of the information being transmitted across each interface;
- Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
- Review exceptions to the traffic flow policy [Assignement: frequency] and remove exceptions that are no longer supported by an explicit mission or business need;
- Prevent unauthorized exchange of control plane traffic with external networks;
- Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
- Filter unauthorized control plane traffic from external networks.
Discussion
External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.
Assessment Objective
- a managed interface is implemented for each external telecommunication service;
- a traffic flow policy is established for each managed interface;
- the confidentiality of the information being transmitted across each interface is protected;
- the integrity of the information being transmitted across each interface is protected;
- each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;
- exceptions to the traffic flow policy are reviewed [Assignement: frequency];
- exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;
- unauthorized exchanges of control plan traffic with external networks are prevented;
- information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;
- unauthorized control plane traffic is filtered from external networks.
Assessment Method
Examine
System and communications protection policy
traffic flow policy
information flow control policy
procedures addressing boundary protection
system security architecture
system design documentation
boundary protection hardware and software
system architecture and configuration documentation
system configuration settings and associated documentation
records of traffic flow policy exceptions
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel with boundary protection responsibilities
|
|
SC-07(05) [M] Deny by Default — Allow by Exception
|
Control
Deny network communications traffic by default and allow network communications traffic by exception [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ].
Discussion
Denying by default and allowing by exception applies to inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those system connections that are essential and approved are allowed. Deny by default, allow by exception also applies to a system that is connected to an external system.
Assessment Objective
- network communications traffic is denied by default [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ];
- network communications traffic is allowed by exception [Selection(one-or-more): at managed interfaces; for {{ insert: param, sc-07.05_odp.02 }} ].
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
|
|
SC-07(07) [M] Split Tunneling for Remote Devices
|
Control
Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignement: safeguards].
Discussion
Split tunneling is the process of allowing a remote user or device to establish a non-remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices and simultaneously, access uncontrolled networks. Split tunneling might be desirable by remote users to communicate with local system resources, such as printers or file servers. However, split tunneling can facilitate unauthorized external connections, making the system vulnerable to attack and to exfiltration of organizational information. Split tunneling can be prevented by disabling configuration settings that allow such capability in remote devices and by preventing those configuration settings from being configurable by users. Prevention can also be achieved by the detection of split tunneling (or of configuration settings that allow split tunneling) in the remote device, and by prohibiting the connection if the remote device is using split tunneling. A virtual private network (VPN) can be used to securely provision a split tunnel. A securely provisioned VPN includes locking connectivity to exclusive, managed, and named environments, or to a specific set of pre-approved addresses, without user control.
Assessment Objective
split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignement: safeguards].
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
|
|
SC-07(08) [M] Route Traffic to Authenticated Proxy Servers
|
Control
Route [Assignement: internal communications traffic] to [Assignement: external networks] through authenticated proxy servers at managed interfaces.
Discussion
External networks are networks outside of organizational control. A proxy server is a server (i.e., system or application) that acts as an intermediary for clients requesting system resources from non-organizational or other organizational servers. System resources that may be requested include files, connections, web pages, or services. Client requests established through a connection to a proxy server are assessed to manage complexity and provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers that provide access to the Internet. Proxy servers can support the logging of Transmission Control Protocol sessions and the blocking of specific Uniform Resource Locators, Internet Protocol addresses, and domain names. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites. Note that proxy servers may inhibit the use of virtual private networks (VPNs) and create the potential for "man-in-the-middle" attacks (depending on the implementation).
Assessment Objective
[Assignement: internal communications traffic] is routed to [Assignement: external networks] through authenticated proxy servers at managed interfaces.
Assessment Method
Examine
System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
|
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|