VDR-CSO-DET Vulnerability Detection

Providers MUST systematically, persistently, and promptly discover and identify vulnerabilities within their cloud service offering using appropriate techniques such as assessment, scanning, threat intelligence, vulnerability disclosure mechanisms, bug bounties, penetration testing, incident response, automated control testing, supply chain monitoring, and other relevant capabilities; this process is called vulnerability detection. Vulnerability detection includes persistently verifying and validating that information resources and processes are operating as intended and documented for FedRAMP Practices.

Warning: Vulnerability Detection and Response includes all efforts to identify weaknesses in a system and is NOT limited to traditional vulnerability scanning or testing. An out-of-date control statement in the Security Decision Record is a vulnerability that must be detected and remediated just like any other vulnerability.

Notes

FedRAMP's vulnerability detection (and response) rules are intended to set modern expectations for maintaining the security of a cloud service. Historical FedRAMP guidance on vulnerability scanning or continuous monitoring generally focused only on CVE-type vulnerabilities while leaving other types of vulnerabilities and exposures unaddressed.

Providers are encouraged to leverage their existing holistic security review, architecture review, and similar processes to meet these requirements. FedRAMP strongly discourages providers from implementing separate vulnerability detection and response processes for FedRAMP reporting that are operated by independent compliance branches unless these processes are consuming data directly from the areas of the cloud service that actively maintain it.

NIST SP 800-53 Rev. 5 controls: AU-5(2), AU-6, CA-8, CA-8(1), CA-8(2), RA-5, RA-5(2), RA-5(3), RA-5(4), SI-2, SI-3, SI-4(1), SI-4(12), SI-4(18), SI-4(22), SI-5(1)

Defined terms: Cloud Service Offering, FedRAMP Practices, Incident, Information Resource, Persistently, Promptly, Vulnerability, Vulnerability Detection, Vulnerability Response

1. Resumen

1.1 Referencias

• FRC-CLA-MFR Mandatory FedRAMP Rules for Class A
• AU-05(02) Real-time Alerts
• AU-06 Audit Record Review, Analysis, and Reporting
• CA-08 Penetration Testing
• CA-08(01) Independent Penetration Testing Agent or Team
• CA-08(02) Red Team Exercises
• RA-05 Vulnerability Monitoring and Scanning
• RA-05(02) Update Vulnerabilities to Be Scanned
• RA-05(03) Breadth and Depth of Coverage
• RA-05(04) Discoverable Information
• SI-02 Flaw Remediation
• SI-03 Malicious Code Protection
• SI-04(01) System-wide Intrusion Detection System
• SI-04(12) Automated Organization-generated Alerts
• SI-04(18) Analyze Traffic and Covert Exfiltration
• SI-04(22) Unauthorized Network Services
• SI-05(01) Automated Alerts and Advisories
• FRD-CSO Cloud Service Offering
• FRD-FPR FedRAMP Practices
• FRD-INT Incident
• FRD-IRS Information Resource
• FRD-PER Persistently
• FRD-PRO Promptly
• FRD-VUL Vulnerability
• FRD-VLD Vulnerability Detection
• FRD-VLR Vulnerability Response

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

• FedRAMP Consolidated Rules -

  EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

  DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.