+AC-17 [M] Remote Access
---+AC-17(01) [M] Monitoring and Control
---+AC-17(02) [M] Protection of Confidentiality and Integrity Using Encryption
---+AC-17(03) [M] Managed Access Control Points
---+AC-17(04) [M] Privileged Commands and Access

AC-17 [M] Remote Access

Control

Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
Authorize each type of remote access to the system prior to allowing such connections.

Discussion

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).

Assessment Objective

1. usage restrictions are established and documented for each type of remote access allowed;
2. configuration/connection requirements are established and documented for each type of remote access allowed;
3. implementation guidance is established and documented for each type of remote access allowed;
each type of remote access to the system is authorized prior to allowing such connections.

Assessment Method

Examine

Access control policy procedures addressing remote access implementation and usage (including restrictions) configuration management plan system configuration settings and associated documentation remote access authorizations system audit records system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for managing remote access connections system/network administrators organizational personnel with information security responsibilities

1. Overview

Summary	Standard
AC-17(01) [M] Monitoring and Control	Control Employ automated mechanisms to monitor and control remote access methods. Discussion Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by [AU-2](#au-2) . Audit events are defined in [AU-2a](#au-2_smt.a). Assessment Objective automated mechanisms are employed to monitor remote access methods; automated mechanisms are employed to control remote access methods. Assessment Method Examine Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation system audit records system monitoring records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers
AC-17(02) [M] Protection of Confidentiality and Integrity Using Encryption	Control Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions. Discussion Virtual private networks can be used to protect the confidentiality and integrity of remote access sessions. Transport Layer Security (TLS) is an example of a cryptographic protocol that provides end-to-end communications security over networks and is used for Internet communications and online transactions. Assessment Objective cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions. Assessment Method Examine Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation cryptographic mechanisms and associated configuration documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers
AC-17(03) [M] Managed Access Control Points	Control Route remote accesses through authorized and managed network access control points. Discussion Organizations consider the Trusted Internet Connections (TIC) initiative [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) requirements for external network connections since limiting the number of access control points for remote access reduces attack surfaces. Assessment Objective remote accesses are routed through authorized and managed network access control points. Assessment Method Examine Access control policy procedures addressing remote access to the system system design documentation list of all managed network access control points system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities
AC-17(04) [M] Privileged Commands and Access	Control Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignement: organization-defined needs] ; and Document the rationale for remote access in the security plan for the system. Discussion Remote access to systems represents a significant potential vulnerability that can be exploited by adversaries. As such, restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and the susceptibility to threats by adversaries to the remote access capability. Assessment Objective the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence; access to security-relevant information via remote access is authorized only in a format that provides assessable evidence; the execution of privileged commands via remote access is authorized only for the following needs: [Assignement: needs requiring remote access]; access to security-relevant information via remote access is authorized only for the following needs: [Assignement: needs requiring remote access]; the rationale for remote access is documented in the security plan for the system. Assessment Method Examine Access control policy procedures addressing remote access to the system system configuration settings and associated documentation security plan system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements
Source	Requirement

3. Related Regulations

Regulations
Source	Regulation

Linked Issues

Issuelinks
Linktype	Issue
is blocked by	AC-17 [M] Remote Access – Assessment Procedure
is blocked by	Remote Access

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.