+AC-03(15) Discretionary and Mandatory Access Control

AC-03(15) Discretionary and Mandatory Access Control

Control

  1. Enforce [Assignement: organization-defined mandatory access control policy] over the set of covered subjects and objects specified in the policy; and
  2. Enforce [Assignement: organization-defined discretionary access control policy] over the set of covered subjects and objects specified in the policy.

Discussion

Simultaneously implementing a mandatory access control policy and a discretionary access control policy can provide additional protection against the unauthorized execution of code by users or processes acting on behalf of users. This helps prevent a single compromised user or process from compromising the entire system.

Assessment Objective

    1. [Assignement: mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
    2. [Assignement: mandatory access control policy] is enforced over the set of covered objects specified in the policy;
    1. [Assignement: discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
    2. [Assignement: discretionary access control policy] is enforced over the set of covered objects specified in the policy.

Assessment Method

Examine

Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies system audit records system security plan other relevant documents or records

Interview

Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by AC-03(15) Discretionary and Mandatory Access Control – Assessment Procedure