+SI-07(06) Cryptographic Protection
|
SI-07(06) Cryptographic Protection
Control
Implement cryptographic mechanisms to detect unauthorized changes to software, firmware, and information.
Discussion
Cryptographic mechanisms used to protect integrity include digital signatures and the computation and application of signed hashes using asymmetric cryptography, protecting the confidentiality of the key used to generate the hash, and using the public key to verify the hash information. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.
Assessment Objective
- cryptographic mechanisms are implemented to detect unauthorized changes to software;
- cryptographic mechanisms are implemented to detect unauthorized changes to firmware;
- cryptographic mechanisms are implemented to detect unauthorized changes to information.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated documentation
records of detected unauthorized changes to software, firmware, and information
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
system/network administrators
system developer
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|