+SI-07 [H] Software, Firmware, and Information Integrity
---+SI-07(01) [H] Integrity Checks
---+SI-07(02) [H] Automated Notifications of Integrity Violations
---+SI-07(05) [H] Automated Response to Integrity Violations
---+SI-07(07) [H] Integration of Detection and Response
---+SI-07(15) [H] Code Authentication

SI-07 [H] Software, Firmware, and Information Integrity

Control

  1. Employ integrity verification tools to detect unauthorized changes to the following software, firmware, and information: [Assignement: organization-defined software, firmware, and information] ; and
  2. Take the following actions when unauthorized changes to the software, firmware, and information are detected: [Assignement: organization-defined actions].

Discussion

Unauthorized changes to software, firmware, and information can occur due to errors or malicious activity. Software includes operating systems (with key internal components, such as kernels or drivers), middleware, and applications. Firmware interfaces include Unified Extensible Firmware Interface (UEFI) and Basic Input/Output System (BIOS). Information includes personally identifiable information and metadata that contains security and privacy attributes associated with information. Integrity-checking mechanisms—including parity checks, cyclical redundancy checks, cryptographic hashes, and associated tools—can automatically monitor the integrity of systems and hosted applications.

Assessment Objective

    1. integrity verification tools are employed to detect unauthorized changes to [Assignement: software];
    2. integrity verification tools are employed to detect unauthorized changes to [Assignement: firmware];
    3. integrity verification tools are employed to detect unauthorized changes to [Assignement: information];
    1. [Assignement: actions] are taken when unauthorized changes to the software, are detected;
    2. [Assignement: actions] are taken when unauthorized changes to the firmware are detected;
    3. [Assignement: actions] are taken when unauthorized changes to the information are detected.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity personally identifiable information processing policy system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records generated or triggered by integrity verification tools regarding unauthorized software, firmware, and information changes system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security and privacy responsibilities system/network administrators

1. Overzicht

SI-07(01) [H] Integrity Checks

Control

Perform an integrity check of [Assignement: organization-defined software, firmware, and information] [Selection(one-or-more): at startup; at {{ insert: param, si-7.1_prm_3 }} ; {{ insert: param, si-7.1_prm_4 }} ].

Discussion

Security-relevant events include the identification of new threats to which organizational systems are susceptible and the installation of new hardware, software, or firmware. Transitional states include system startup, restart, shutdown, and abort.

Assessment Objective

  1. an integrity check of [Assignement: software] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.03 }} ; {{ insert: param, si-07.01_odp.04 }} ];
  2. an integrity check of [Assignement: firmware] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.07 }} ; {{ insert: param, si-07.01_odp.08 }} ];
  3. an integrity check of [Assignement: information] is performed [Selection(one-or-more): at startup; at {{ insert: param, si-07.01_odp.11 }} ; {{ insert: param, si-07.01_odp.12 }} ].

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity testing system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records of integrity scans system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities system/network administrators system developer
SI-07(02) [H] Automated Notifications of Integrity Violations

Control

Employ automated tools that provide notification to [Assignement: personnel or roles] upon discovering discrepancies during integrity verification.

Discussion

The employment of automated tools to report system and information integrity violations and to notify organizational personnel in a timely matter is essential to effective risk response. Personnel with an interest in system and information integrity violations include mission and business owners, system owners, senior agency information security official, senior agency official for privacy, system administrators, software developers, systems integrators, information security officers, and privacy officers.

Assessment Objective

automated tools that provide notification to [Assignement: personnel or roles] upon discovering discrepancies during integrity verification are employed.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity personally identifiable information processing policy system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records of integrity scans automated tools supporting alerts and notifications for integrity discrepancies notifications provided upon discovering discrepancies during integrity verifications system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security and privacy responsibilities system administrators software developers
SI-07(05) [H] Automated Response to Integrity Violations

Control

Automatically [Selection(one-or-more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] when integrity violations are discovered.

Discussion

Organizations may define different integrity-checking responses by type of information, specific information, or a combination of both. Types of information include firmware, software, and user data. Specific information includes boot firmware for certain types of machines. The automatic implementation of controls within organizational systems includes reversing the changes, halting the system, or triggering audit alerts when unauthorized modifications to critical security files occur.

Assessment Objective

[Selection(one-or-more): shut down the system; restart the system; implement {{ insert: param, si-07.05_odp.02 }} ] are automatically performed when integrity violations are discovered.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity system design documentation system configuration settings and associated documentation integrity verification tools and associated documentation records of integrity scans records of integrity checks and responses to integrity violations audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities system/network administrators system developer
SI-07(07) [H] Integration of Detection and Response

Control

Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].

Discussion

Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.

Assessment Objective

the detection of [Assignement: changes] are incorporated into the organizational incident response capability.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity procedures addressing incident response system design documentation system configuration settings and associated documentation incident response records audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities organizational personnel with incident response responsibilities
SI-07(15) [H] Code Authentication

Control

Implement cryptographic mechanisms to authenticate the following software or firmware components prior to installation: [Assignement: software or firmware components].

Discussion

Cryptographic authentication includes verifying that software or firmware components have been digitally signed using certificates recognized and approved by organizations. Code signing is an effective method to protect against malicious code. Organizations that employ cryptographic mechanisms also consider cryptographic key management solutions.

Assessment Objective

cryptographic mechanisms are implemented to authenticate [Assignement: software or firmware components] prior to installation.

Assessment Method

Examine

System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity system design documentation system configuration settings and associated documentation cryptographic mechanisms and associated documentation system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for software, firmware, and/or information integrity organizational personnel with information security responsibilities system/network administrators system developer

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen

Gekoppelde issues

Koppelingen
is blocked by SI-07 [H] Software, Firmware, and Information Integrity – Assessment Procedure
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Safeguarding Data Over Open Networks
is blocked by Input Data Validation