+SR-09 Tamper Resistance and Detection
---+SR-09(01) Multiple Stages of System Development Life Cycle

SR-09 Tamper Resistance and Detection

Control

Implement a tamper protection program for the system, system component, or system service.

Discussion

Anti-tamper technologies, tools, and techniques provide a level of protection for systems, system components, and services against many threats, including reverse engineering, modification, and substitution. Strong identification combined with tamper resistance and/or tamper detection is essential to protecting systems and components during distribution and when in use.

Assessment Objective

a tamper protection program is implemented for the system, system component, or system service.

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection procedures addressing tamper resistance and detection tamper protection program documentation tamper protection tools and techniques documentation tamper resistance and detection tools and techniques documentation acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system security plan other relevant documents or records

Interview

Organizational personnel with tamper protection program responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities

1. Przegląd

SR-09(01) Multiple Stages of System Development Life Cycle

Control

Employ anti-tamper technologies, tools, and techniques throughout the system development life cycle.

Discussion

The system development life cycle includes research and development, design, manufacturing, acquisition, delivery, integration, operations and maintenance, and disposal. Organizations use a combination of hardware and software techniques for tamper resistance and detection. Organizations use obfuscation and self-checking to make reverse engineering and modifications more difficult, time-consuming, and expensive for adversaries. The customization of systems and system components can make substitutions easier to detect and therefore limit damage.

Assessment Objective

anti-tamper technologies, tools, and techniques are employed throughout the system development life cycle.

Assessment Method

Examine

Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing tamper resistance and detection tamper protection program documentation tamper protection tools and techniques documentation tamper resistance and detection tools (technologies) and techniques documentation system development life cycle documentation procedures addressing supply chain protection system development life cycle procedures acquisition documentation service level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan other relevant documents or records

Interview

Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities organizational personnel with SDLC responsibilities

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje

Powiązane zgłoszenia

Powiązania
is blocked by SR-09 Tamper Resistance and Detection – Assessment Procedure
is blocked by Logical Tampering Protection
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.