+SC-07(04) [H] External Telecommunications Services

SC-07(04) [H] External Telecommunications Services

Control

  1. Implement a managed interface for each external telecommunication service;
  2. Establish a traffic flow policy for each managed interface;
  3. Protect the confidentiality and integrity of the information being transmitted across each interface;
  4. Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
  5. Review exceptions to the traffic flow policy [Assignement: frequency] and remove exceptions that are no longer supported by an explicit mission or business need;
  6. Prevent unauthorized exchange of control plane traffic with external networks;
  7. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
  8. Filter unauthorized control plane traffic from external networks.

Discussion

External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.

Assessment Objective

  1. a managed interface is implemented for each external telecommunication service;
  2. a traffic flow policy is established for each managed interface;
    1. the confidentiality of the information being transmitted across each interface is protected;
    2. the integrity of the information being transmitted across each interface is protected;
  4. each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;
    1. exceptions to the traffic flow policy are reviewed [Assignement: frequency];
    2. exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;
  6. unauthorized exchanges of control plan traffic with external networks are prevented;
  7. information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;
  8. unauthorized control plane traffic is filtered from external networks.

Assessment Method

Examine

System and communications protection policy traffic flow policy information flow control policy procedures addressing boundary protection system security architecture system design documentation boundary protection hardware and software system architecture and configuration documentation system configuration settings and associated documentation records of traffic flow policy exceptions system audit records system security plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with boundary protection responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by SC-07(04) [H] External Telecommunications Services – Assessment Procedure
is blocked by External Telecommunications Services