+PR.PS Platform Security
---+PR.PS-01 Configuration management practices are established and applied
---+PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
---+PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk
---+PR.PS-04 Log records are generated and made available for continuous monitoring
---+PR.PS-05 Installation and execution of unauthorized software are prevented
---+PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
|
PR.PS Platform Security
StatementThe hardware, software (e.g., firmware, operating systems, applications), and services of physical and virtual platforms are managed consistent with the organization's risk strategy to protect their confidentiality, integrity, and availability
1. Forbhreathnú
| Teideal |
Caighdeán |
|
PR.PS-01 Configuration management practices are established and applied
|
StatementConfiguration management practices are established and applied GuidanceEstablish, test, deploy, and maintain hardened baselines that enforce the organization's cybersecurity policies and provide only essential capabilities (i.e., principle of least functionality) GuidanceReview all default configuration settings that may potentially impact cybersecurity when installing or upgrading software GuidanceMonitor implemented software for deviations from approved baselines
|
|
PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
|
StatementSoftware is maintained, replaced, and removed commensurate with risk GuidancePerform routine and emergency patching within the timeframes specified in the vulnerability management plan GuidanceUpdate container images, and deploy new container instances to replace rather than update existing instances GuidanceReplace end-of-life software and service versions with supported, maintained versions GuidanceUninstall and remove unauthorized software and services that pose undue risks GuidanceUninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse GuidanceDefine and implement plans for software and service end-of-life maintenance support and obsolescence
|
|
PR.PS-03 Hardware is maintained, replaced, and removed commensurate with risk
|
StatementHardware is maintained, replaced, and removed commensurate with risk GuidanceReplace hardware when it lacks needed security capabilities or when it cannot support software with needed security capabilities GuidanceDefine and implement plans for hardware end-of-life maintenance support and obsolescence GuidancePerform hardware disposal in a secure, responsible, and auditable manner
|
|
PR.PS-04 Log records are generated and made available for continuous monitoring
|
StatementLog records are generated and made available for continuous monitoring GuidanceConfigure all operating systems, applications, and services (including cloud-based services) to generate log records GuidanceConfigure log generators to securely share their logs with the organization's logging infrastructure systems and services GuidanceConfigure log generators to record the data needed by zero-trust architectures
|
|
PR.PS-05 Installation and execution of unauthorized software are prevented
|
StatementInstallation and execution of unauthorized software are prevented GuidanceWhen risk warrants it, restrict software execution to permitted products only or deny the execution of prohibited and unauthorized software GuidanceVerify the source of new software and the software's integrity before installing it GuidanceConfigure platforms to use only approved DNS services that block access to known malicious domains GuidanceConfigure platforms to allow the installation of organization-approved software only
|
|
PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
|
StatementSecure software development practices are integrated, and their performance is monitored throughout the software development life cycle GuidanceProtect all components of organization-developed software from tampering and unauthorized access GuidanceSecure all software produced by the organization, with minimal vulnerabilities in their releases GuidanceMaintain the software used in production environments, and securely dispose of software once it is no longer needed
|
1.1 Tagairtí
1.2 Ceanglais aitheanta
1.3 Rialacháin ghaolmhara
2. Ceanglais aitheanta
Ceanglais
| Foinse |
Ceanglas |
3. Rialacháin ghaolmhara
Rialacháin
| Foinse |
Rialáil |
Saincheisteanna nasctha
- NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.
DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.
|