+CM-14 Signed Components
|
CM-14 Signed Components
Control
Prevent the installation of [Assignement: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.
Discussion
Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.
Assessment Objective
- the installation of [Assignement: software components] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
- the installation of [Assignement: firmware components] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.
Assessment Method
Examine
Configuration management policy
procedures addressing digitally signed certificates for software and firmware components
configuration management plan
system security plan
system design documentation
change control records
system component inventory
system security plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation
organizational personnel with information security responsibilities
system/network administrators
system developers
1. Przegląd
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
Powiązane zgłoszenia
|