+CM-07(05) Authorized Software — Allow-by-exception
|
CM-07(05) Authorized Software — Allow-by-exception
Control
- Identify [Assignement: software programs];
- Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
- Review and update the list of authorized software programs [Assignement: frequency].
Discussion
Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries. The concept of permitting the execution of authorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses. Organizations consider verifying the integrity of authorized software programs using digital signatures, cryptographic checksums, or hash functions. Verification of authorized software can occur either prior to execution or at system startup. The identification of authorized URLs for websites is addressed in [CA-3(5)](#ca-3.5) and [SC-7](#sc-7).
Assessment Objective
- [Assignement: software programs] are identified;
- a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system is employed;
- the list of authorized software programs is reviewed and updated [Assignement: frequency].
Assessment Method
Examine
Configuration management policy
procedures addressing least functionality in the system
configuration management plan
system design documentation
system configuration settings and associated documentation
list of software programs authorized to execute on the system
system component inventory
common secure configuration checklists
review and update records associated with list of authorized software programs
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for identifying software authorized to execute on the system
organizational personnel with information security responsibilities
system/network administrators
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|