+SC-03(02) Access and Flow Control Functions
|
SC-03(02) Access and Flow Control Functions
Control
Isolate security functions enforcing access and information flow control from nonsecurity functions and from other security functions.
Discussion
Security function isolation occurs because of implementation. The functions can still be scanned and monitored. Security functions that are potentially isolated from access and flow control enforcement functions include auditing, intrusion detection, and malicious code protection functions.
Assessment Objective
- security functions enforcing access control are isolated from non-security functions;
- security functions enforcing access control are isolated from other security functions;
- security functions enforcing information flow control are isolated from non-security functions;
- security functions enforcing information flow control are isolated from other security functions.
Assessment Method
Examine
System and communications protection policy
procedures addressing security function isolation
list of critical security functions
system design documentation
system configuration settings and associated documentation
system audit records system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
system developer
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|