+AC-04(01) Object Security and Privacy Attributes

AC-04(01) Object Security and Privacy Attributes

Control

Use [Assignement: organization-defined security and privacy attributes] associated with [Assignement: organization-defined information, source, and destination objects] to enforce [Assignement: information flow control policies] as a basis for flow control decisions.

Discussion

Information flow enforcement mechanisms compare security and privacy attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. A dataset of personally identifiable information may be tagged with restrictions against combining with other types of datasets and, thus, would not be allowed to flow to the restricted dataset. Security and privacy attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security or privacy attributes can be used, for example, to control the release of certain types of information.

Assessment Objective

  1. [Assignement: security attributes] associated with [Assignement: information objects], [Assignement: source objects] , and [Assignement: destination objects] are used to enforce [Assignement: information flow control policies] as a basis for flow control decisions;
  2. [Assignement: privacy attributes] associated with [Assignement: information objects], [Assignement: source objects] , and [Assignement: destination objects] are used to enforce [Assignement: information flow control policies] as a basis for flow control decisions.

Assessment Method

Examine

Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of security and privacy attributes and associated source and destination objects system audit records system security plan privacy plan other relevant documents or records

Interview

System/network administrators organizational personnel with information security responsibilities organizational personnel with privacy responsibilities system developers

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai

3. Susiję teisės aktai

Teisės aktai

Susietos užduotys

Saitai
is blocked by AC-04(01) Object Security and Privacy Attributes – Assessment Procedure
is blocked by Object Security Attributes