+SI-07 [M] Software, Firmware, and Information Integrity
---+SI-07(01) [M] Integrity Checks
---+SI-07(07) [M] Integration of Detection and Response

SI-07 [M] Software, Firmware, and Information Integrity

Control

  1. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignement: organization-defined software, firmware, and information] ; and
  2. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignement: organization-defined actions].

Discussion

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.

Assessment Objective

    1. integrity verification tools are employed to detect unauthorized changes to [Assignement: software];
    2. integrity verification tools are employed to detect unauthorized changes to [Assignement: firmware];
    3. integrity verification tools are employed to detect unauthorized changes to [Assignement: information];
    1. [Assignement: actions] are taken when unauthorized changes to the software, are detected;
    2. [Assignement: actions] are taken when unauthorized changes to the firmware are detected;
    3. [Assignement: actions] are taken when unauthorized changes to the information are detected.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity personally identifiable information processing policy system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security and privacy responsibilities system/network administrators

1. Panoramica

SI-07(01) [M] Integrity Checks

Control

Perform an integrity check of [Assignement: organization-defined software, firmware, and information] [Selection(one-or-more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].

Discussion

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.

Assessment Objective

  1. an integrity check of [Assignement: software] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.03 }} ; {{ insert: param, si-07.01_odp.04 }} ];
  2. an integrity check of [Assignement: firmware] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.07 }} ; {{ insert: param, si-07.01_odp.08 }} ];
  3. an integrity check of [Assignement: information] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.11 }} ; {{ insert: param, si-07.01_odp.12 }} ].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity testing system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records of integrity scans system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities system/network administrators system developer
SI-07(07) [M] Integration of Detection and Response

Control

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].

Discussion

Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.

Assessment Objective

the detection of [Assignement: changes] are incorporated into the organizational incident response capability.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity procedures addressing incident response system design documentation system configuration settings and associated documentation incident response records audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities organizational personnel with incident response responsibilities

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by SI-07 [M] Software, Firmware, and Information Integrity – Assessment Procedure
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Safeguarding Data Over Open Networks
is blocked by Input Data Validation
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.