03.14 System and Information Integrity

Statement

• a. Identify, report, and correct system flaws.

• b. Install security-relevant software and firmware updates within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Guidance

Organizations identify systems that are affected by announced software and firmware flaws, including potential vulnerabilities that result from those flaws, and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address the flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources (e.g., CWE or CVE databases) when remediating system flaws. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors, including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types.

Assessment objective

system flaws are identified.

Assessment objective

system flaws are reported.

Assessment objective

system flaws are corrected.

Assessment objective

security-relevant software updates are installed within {{ insert: param, A.03.14.01.ODP.01 }} of the release of the updates.

Assessment objective

security-relevant firmware updates are installed within {{ insert: param, A.03.14.01.ODP.02 }} of the release of the updates.

Assessment method

• system and information integrity policy and procedures procedures for flaw remediation procedures for configuration management list of recent security flaw remediation actions performed on the system list of flaws and vulnerabilities that may potentially affect the system test results from the installation of software and firmware updates to correct system flaws installation and change control records for security-relevant software and firmware updates system security plan other relevant documents or records

Assessment method

• personnel responsible for installing, configuring, or maintaining the system personnel responsible for flaw remediation personnel with configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for identifying, reporting, and correcting system flaws processes for installing software and firmware updates mechanisms for supporting or implementing the reporting and correction of system flaws mechanisms for supporting or implementing the testing software and firmware updates

Statement

• a. Implement malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code.

• b. Update malicious code protection mechanisms as new releases are available in accordance with configuration management policies and procedures.

• c. Configure malicious code protection mechanisms to:

  • 01. Perform scans of the system {{ insert: param, A.03.14.02.ODP.01 }} and real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed; and

  • 02. Block malicious code, quarantine malicious code, or take other mitigation actions in response to malicious code detection.

Guidance

Malicious code insertions occur through the exploitation of system vulnerabilities. Malicious code can be inserted into the system in a variety of ways, including email, the internet, and portable storage devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats, contained in compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code may be present in commercial off-the-shelf software and custom-built software and could include logic bombs, backdoors, and other types of attacks that could affect organizational mission and business functions. Periodic scans of the system and real-time scans of files from external sources as files are downloaded, opened, or executed can detect malicious code. Malicious code protection mechanisms can also monitor systems for anomalous or unexpected behaviors and take appropriate actions. Malicious code protection mechanisms include signature- and non-signature-based technologies. Non-signature-based detection mechanisms include artificial intelligence techniques that use heuristics to detect, analyze, and describe the characteristics or behavior of malicious code and to provide controls against such code for which signatures do not yet exist or for which existing signatures may not be effective. Malicious code for which active signatures do not yet exist or may be ineffective includes polymorphic malicious code (i.e., code that changes signatures when it replicates). Non-signature-based mechanisms include reputation-based technologies. Pervasive configuration management, anti-exploitation software, and software integrity controls may also be effective in preventing unauthorized code execution. If malicious code cannot be detected by detection methods or technologies, organizations can rely on secure coding practices, configuration management and control, trusted procurement processes, and monitoring practices to help ensure that the software only performs intended functions. Organizations may determine that different actions are warranted in response to the detection of malicious code. For example, organizations can define actions to be taken in response to the detection of malicious code during scans, malicious downloads, or malicious activity when attempting to open or execute files.

Assessment objective

malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.

Assessment objective

malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.

Assessment objective

malicious code protection mechanisms are updated as new releases are available in accordance with configuration management policy and procedures.

Assessment objective

malicious code protection mechanisms are configured to perform scans of the system {{ insert: param, A.03.14.02.ODP.01 }}.

Assessment objective

malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to malicious code detection.

Assessment objective

malicious code protection mechanisms are configured to perform real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed.

Assessment method

• system and information integrity policy and procedures configuration management policy and procedures procedures for malicious code protection records of malicious code protection updates system design documentation system configuration settings scan results from malicious code protection mechanisms record of actions initiated by malicious code protection mechanisms in response to malicious code detection system audit records system security plan other relevant documents or records

Assessment method

• personnel responsible for malicious code protection personnel with system installation, configuration, or maintenance responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for employing, updating, and configuring malicious code protection mechanisms processes for addressing the detection of false positives and resulting potential impacts mechanisms for supporting or implementing, employing, updating, and configuring malicious code protection mechanisms mechanisms for supporting or implementing malicious code scanning and the execution of subsequent actions

Statement

• a. Receive system security alerts, advisories, and directives from external organizations on an ongoing basis.

• b. Generate and disseminate internal system security alerts, advisories, and directives, as necessary.

Guidance

There are many publicly available sources of system security alerts and advisories. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) generate security alerts and advisories to maintain situational awareness across the Federal Government and in nonfederal organizations. Software vendors, subscription services, and industry Information Sharing and Analysis Centers (ISACs) may also provide security alerts and advisories. Compliance with security directives is essential due to the critical nature of many of these directives and the potential immediate adverse effects on organizational operations and assets, individuals, other organizations, and the Nation should the directives not be implemented in a timely manner.

Assessment objective

system security alerts, advisories, and directives from external organizations are received on an ongoing basis.

Assessment objective

internal security alerts, advisories, and directives are generated, as necessary.

Assessment objective

internal security alerts, advisories, and directives are disseminated, as necessary.

Statement

• a. Monitor the system to detect:

  • 01. Attacks and indicators of potential attacks and

  • 02. Unauthorized connections.

• b. Identify unauthorized use of the system.

• c. Monitor inbound and outbound communications traffic to detect unusual or unauthorized activities or conditions.

Guidance

System monitoring involves external and internal monitoring. Internal monitoring includes the observation of events that occur within the system. External monitoring includes the observation of events that occur at the system boundary. Organizations can monitor the system by observing audit record activities in real time or by observing other system aspects, such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. A system monitoring capability is achieved through a variety of tools and techniques (e.g., audit record monitoring software, intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms that support critical applications with such devices being employed at managed system interfaces. The granularity of monitoring the information collected is based on organizational monitoring objectives and the capability of the system to support such objectives. Systems connections can be network, remote, or local. A network connection is any connection with a device that communicates through a network (e.g., local area network, the internet). A remote connection is any connection with a device that communicates through an external network (e.g., the internet). Network, remote, and local connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in the system or propagating among system components, the unauthorized export of information, or signaling to external systems. Evidence of malicious code is used to identify a potentially compromised system. System monitoring requirements, including the need for types of system monitoring, may be referenced in other requirements.

Assessment objective

the system is monitored to detect attacks.

Assessment objective

the system is monitored to detect indicators of potential attacks.

Assessment objective

the system is monitored to detect unauthorized connections.

Assessment objective

unauthorized use of the system is identified.

Assessment objective

inbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.

Assessment objective

outbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.

Assessment method

• system and information integrity policy and procedures procedures for system monitoring tools and techniques continuous monitoring strategy facility diagram or layout system design documentation locations within the system where monitoring devices are deployed system configuration settings system protocols system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for installing, configuring, or maintaining the system personnel with system monitoring responsibilities personnel with intrusion detection responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for intrusion detection and system monitoring mechanisms for supporting or implementing system monitoring capabilities mechanisms for supporting or implementing intrusion detection and system monitoring capabilities mechanisms for supporting or implementing the monitoring of inbound and outbound communications traffic

Statement

Manage and retain CUI within the system and CUI output from the system in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Guidance

Federal agencies consider data retention requirements for nonfederal organizations. Retaining CUI on nonfederal systems after contracts or agreements have concluded increases the attack surface for those systems and the risk of the information being compromised. NARA provides federal policy and guidance on records retention and schedules.

Assessment objective

CUI within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment objective

CUI within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment objective

CUI output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment objective

CUI output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment method

• system and information integrity policy and procedures laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention records retention and disposition policy records retention and disposition procedures media protection policy media protection procedures audit findings system security plan other relevant documents or records

Assessment method

• personnel with information and records management, retention, and disposition responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for information management, retention, and disposition mechanisms for supporting or implementing information management, retention, and disposition