+SC-08 [H] Transmission Confidentiality and Integrity
---+SC-08(01) [H] Cryptographic Protection

SC-08 [H] Transmission Confidentiality and Integrity

Control

Protect the [Selection(one-or-more): confidentiality; integrity] of transmitted information.

Discussion

Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.

Assessment Objective

the [Selection(one-or-more): confidentiality; integrity] of transmitted information is/are protected.

Assessment Method

Examine

System and communications protection policy procedures addressing transmission confidentiality and integrity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer

1. Panoramica

SC-08(01) [H] Cryptographic Protection

Control

Implement cryptographic mechanisms to [Selection(one-or-more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Discussion

Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidentiality and integrity of information during transmission include TLS and IPSec. Cryptographic mechanisms used to protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.

Assessment Objective

cryptographic mechanisms are implemented to [Selection(one-or-more): prevent unauthorized disclosure of information; detect changes to information] during transmission.

Assessment Method

Examine

System and communications protection policy procedures addressing transmission confidentiality and integrity system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities system developer

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by SC-08 [H] Transmission Confidentiality and Integrity – Assessment Procedure
is blocked by Encrypting Data In Transit
is blocked by Integrity of Data In Transit