+SI-14(02) Non-persistent Information
|
SI-14(02) Non-persistent Information
Control
- [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] ; and
- Delete information when no longer needed.
Discussion
Retaining information longer than is needed makes the information a potential target for advanced adversaries searching for high value assets to compromise through unauthorized disclosure, unauthorized modification, or exfiltration. For system-related information, unnecessary retention provides advanced adversaries information that can assist in their reconnaissance and lateral movement through the system.
Assessment Objective
- [Selection: refresh {{ insert: param, si-14.02_odp.02 }} {{ insert: param, si-14.02_odp.03 }} ; generate {{ insert: param, si-14.02_odp.04 }} on demand] is performed;
- information is deleted when no longer needed.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for ensuring that information is and remains non-persistent
organizational personnel with information security responsibilities
1. Pregled
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani propisi
2. Utvrđeni zahtjevi
3. Povezani propisi
Povezani zadaci
|