03.11.11E Discoverable Information

Statement

Determine information about the system that is discoverable and take {{ insert: param, A.03.11.11E.ODP.01 }}.

Guidance

Discoverable information includes information that adversaries could obtain without compromising or breaching the system, such as by collecting information that the system is exposing or by conducting extensive web searches. Corrective actions include notifying organizational personnel, removing designated information, or changing the system to make the designated information less relevant or attractive to adversaries. This requirement excludes intentionally discoverable information that may be part of a decoy capability (e.g., honeypots, honeynets, or deception nets) implemented by the organization. This requirement enhances SP 800-171 requirement 03.11.02.

Statement

• (includes reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

discoverable information about the system is identified.

Assessment objective

{{ insert: param, A.03.11.11E.ODP.01 }} are taken when information about the system is confirmed as discoverable.

Assessment method

• Procedures addressing vulnerability scanning assessment report penetration test results vulnerability scanning results risk assessment report records of corrective actions taken on discoverable information incident response records audit records system security plan other relevant documents or records

Assessment method

• Personnel with vulnerability scanning and/or penetration testing responsibilities personnel with vulnerability scan analysis responsibilities personnel responsible for risk response personnel responsible for incident management and response personnel with information security responsibilities

Assessment method

• Processes for vulnerability scanning processes for risk response processes for incident management and response mechanisms and/or tools supporting and/or implementing vulnerability scanning mechanisms supporting and/or implementing risk response mechanisms supporting and/or implementing incident management and response

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final