+AC-03(15) Discretionary and Mandatory Access Control

AC-03(15) Discretionary and Mandatory Access Control

Control

  1. Enforce [Assignement: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and
  2. Enforce [Assignement: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

Discussion

Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.

Assessment Objective

    1. [Assignement: mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
    2. [Assignement: mandatory access control policy] is enforced over the set of covered objects specified in the policy;
    1. [Assignement: discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
    2. [Assignement: discretionary access control policy] is enforced over the set of covered objects specified in the policy.

Assessment Method

Examine

Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies system audit records system security plan other relevant documents or records

Interview

Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by AC-03(15) Discretionary and Mandatory Access Control – Assessment Procedure