+SI-07(17) Runtime Application Self-protection
|
SI-07(17) Runtime Application Self-protection
Control
Implement [Assignement: controls] for application self-protection at runtime.
Discussion
Runtime application self-protection employs runtime instrumentation to detect and block the exploitation of software vulnerabilities by taking advantage of information from the software in execution. Runtime exploit prevention differs from traditional perimeter-based protections such as guards and firewalls which can only detect and block attacks by using network information without contextual awareness. Runtime application self-protection technology can reduce the susceptibility of software to attacks by monitoring its inputs and blocking those inputs that could allow attacks. It can also help protect the runtime environment from unwanted changes and tampering. When a threat is detected, runtime application self-protection technology can prevent exploitation and take other actions (e.g., sending a warning message to the user, terminating the user's session, terminating the application, or sending an alert to organizational personnel). Runtime application self-protection solutions can be deployed in either a monitor or protection mode.
Assessment Objective
[Assignement: controls] are implemented for application self-protection at runtime.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software and information integrity
system design documentation
system configuration settings and associated documentation
list of known vulnerabilities addressed by runtime instrumentation
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
1. Pārskats
1.1 Atsauces
1.2 Identificētās prasības
1.3 Saistītie tiesību akti
2. Identificētās prasības
3. Saistītie tiesību akti
Tiesību akti
| Avots |
Regulējums |
Saistītie uzdevumi
|