+CM-07(04) Unauthorized Software — Deny-by-exception
|
CM-07(04) Unauthorized Software — Deny-by-exception
Control
- Identify [Assignement: software programs];
- Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and
- Review and update the list of unauthorized software programs [Assignement: frequency].
Discussion
Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses.
Assessment Objective
- [Assignement: software programs] are identified;
- an allow-all, deny-by-exception policy is employed to prohibit the execution of unauthorized software programs on the system;
- the list of unauthorized software programs is reviewed and updated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list of software programs not authorized to execute on the system
system component inventory
common secure configuration checklists
review and update records associated with list of unauthorized software programs
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for identifying software not authorized to execute on the system
organizational personnel with information security responsibilities
system/network administrators
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|