03.14.16E Tainting

Statement

Embed data or capabilities in the following systems or system components to determine if CUI has been exfiltrated or improperly removed from the organization: {{ insert: param, A.03.14.16E.ODP.01 }}.

Guidance

Many cyber-attacks target organizational information or information that the organization holds on behalf of other entities with the intent to exfiltrate that information. In addition, insider attacks and erroneous user procedures can remove information from the system in violation of organizational policies. Tainting approaches can range from passive to active. A passive tainting approach can be as simple as adding false email names and addresses to an internal database. If the organization receives email at one of the false email addresses, it knows that the database has been compromised. Moreover, the organization knows that the email was sent by an unauthorized entity, so any packets it includes potentially contain malicious code, and the unauthorized entity may have potentially obtained a copy of the database. Another tainting approach includes embedding false data or steganographic data in files to enable the data to be found via open-source analysis. An active tainting approach can include embedding software in the data that is able to “call home,” thereby alerting the organization to its capture and possibly its location and the path by which it was exfiltrated or removed. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

data or capabilities are embedded in {{ insert: param, A.03.14.16E.ODP.01 }} to determine if CUI has been exfiltrated or improperly removed from the organization.

Assessment method

• System and information integrity policy system and information integrity procedures procedures addressing software and information integrity system design documentation system configuration settings and associated documentation policy and procedures addressing the systems security engineering technique of deception system security plan other relevant documents or records

Assessment method

• Personnel responsible for detecting tainted data personnel with systems security engineering responsibilities personnel with information security responsibilities

Assessment method

• Automated mechanisms for post-breach detection decoys, traps, lures, and methods for deceiving adversaries detection and notification mechanisms

1. Yleiskatsaus

1.1 Viittaukset

1.2 Tunnistetut vaatimukset

1.3 Liittyvät säädökset

2. Tunnistetut vaatimukset

3. Liittyvät säädökset

Linkitetyt tehtävät

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final