+AC-04(28) Linear Filter Pipelines
|
AC-04(28) Linear Filter Pipelines
Control
When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
Discussion
Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. The use of linear content filter pipelines ensures that filter processes are non-bypassable and always invoked. In general, the use of parallel filtering architectures for content filtering of a single data type introduces bypass and non-invocation issues.
Assessment Objective
when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.
Assessment Method
Examine
Information flow enforcement policy
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with information flow enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|