+SC-34 Non-modifiable Executable Programs
---+SC-34(01) No Writable Storage
---+SC-34(02) Integrity Protection on Read-only Media

SC-34 Non-modifiable Executable Programs

Control

For [Assignement: system components] , load and execute:
  1. The operating environment from hardware-enforced, read-only media; and
  2. The following applications from hardware-enforced, read-only media: [Assignement: applications].

Discussion

The operating environment for a system contains the code that hosts applications, including operating systems, executives, or virtual machine monitors (i.e., hypervisors). It can also include certain applications that run directly on hardware platforms. Hardware-enforced, read-only media include Compact Disc-Recordable (CD-R) and Digital Versatile Disc-Recordable (DVD-R) disk drives as well as one-time, programmable, read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable, read-only memory can be accepted as read-only media provided that integrity can be adequately protected from the point of initial writing to the insertion of the memory into the system, and there are reliable hardware protections against reprogramming the memory while installed in organizational systems.

Assessment Objective

  1. the operating environment for [Assignement: system components] is loaded and executed from hardware-enforced, read-only media;
  2. [Assignement: applications] for [Assignement: system components] are loaded and executed from hardware-enforced, read-only media.

Assessment Method

Examine

System and communications protection policy procedures addressing non-modifiable executable programs system design documentation system configuration settings and associated documentation system architecture list of operating system components to be loaded from hardware-enforced, read-only media list of applications to be loaded from hardware-enforced, read-only media media used to load and execute the system operating environment media used to load and execute system applications system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer organizational personnel installing, configuring, and/or maintaining the system system developers/integrators

1. Panoramica

SC-34(01) No Writable Storage

Control

Employ [Assignement: system components] with no writeable storage that is persistent across component restart or power on/off.

Discussion

Disallowing writeable storage eliminates the possibility of malicious code insertion via persistent, writeable storage within the designated system components. The restriction applies to fixed and removable storage, with the latter being addressed either directly or as specific restrictions imposed through access controls for mobile devices.

Assessment Objective

[Assignement: system components] are employed with no writeable storage that is persistent across component restart or power on/off.

Assessment Method

Examine

System and communications protection policy procedures addressing non-modifiable executable programs system design documentation system configuration settings and associated documentation system architecture list of system components to be employed without writeable storage capabilities system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system system developers/integrators
SC-34(02) Integrity Protection on Read-only Media

Control

Protect the integrity of information prior to storage on read-only media and control the media after such information has been recorded onto the media.

Discussion

Controls prevent the substitution of media into systems or the reprogramming of programmable read-only media prior to installation into the systems. Integrity protection controls include a combination of prevention, detection, and response.

Assessment Objective

  1. the integrity of information is protected prior to storage on read-only media;
  2. the media is controlled after such information has been recorded onto the media;

Assessment Method

Examine

System and communications protection policy procedures addressing non-modifiable executable programs system design documentation system configuration settings and associated documentation system architecture system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system system developers/integrators

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by SC-34 Non-modifiable Executable Programs – Assessment Procedure
is blocked by Non-Modifiable Executable Programs