03.04.08 Authorized Software – Allow by Exception

Statement

• a. Identify software programs authorized to execute on the system.

• b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system.

• c. Review and update the list of authorized software programs {{ insert: param, A.03.04.08.ODP.01 }}.

Guidance

If provided with the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved “app stores.” The policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods. Authorized software programs can be limited to specific versions or come from specific sources. To facilitate a comprehensive authorized software process and increase the strength of protection against attacks that bypass application-level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.

Assessment objective

software programs authorized to execute on the system are identified.

Assessment objective

a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.

Assessment objective

the list of authorized software programs is reviewed and updated {{ insert: param, A.03.04.08.ODP.01 }}.

Assessment method

• configuration management policy and procedures procedures for least functionality in the system configuration management plan system design documentation system configuration settings list of software programs authorized to execute on the system system component inventory records associated with the review and update of the list of authorized software programs common secure configuration checklists change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for identifying software authorized to execute on the system personnel with information security responsibilities system administrators

Assessment method

• processes for identifying, reviewing, and updating programs authorized to execute on the system processes for implementing authorized software policy mechanisms for supporting or implementing authorized software policy

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final