+SA-08(18) Trusted Communications Channels
|
SA-08(18) Trusted Communications Channels
Control
Implement the security design principle of trusted communications channels in [Assignement: systems or system components].
Discussion
The principle of trusted communication channels states that when composing a system where there is a potential threat to communications between components (i.e., the interconnections between components), each communication channel is trustworthy to a level commensurate with the security dependencies it supports (i.e., how much it is trusted by other components to perform its security functions). Trusted communication channels are achieved by a combination of restricting access to the communication channel (to ensure an acceptable match in the trustworthiness of the endpoints involved in the communication) and employing end-to-end protections for the data transmitted over the communication channel (to protect against interception and modification and to further increase the assurance of proper end-to-end communication).
Assessment Objective
[Assignement: systems or system components] implement the security design principle of trusted communications channels.
Assessment Method
Examine
System and services acquisition policy
procedures addressing the security design principle of trusted communications channels used in the specification, design, development, implementation, and modification of the system
system design documentation
security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
other relevant documents or records
Interview
Organizational personnel with the responsibility for determining system security and privacy requirements
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
organizational personnel with information security responsibilities
1. Pregled
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
Povezane zadeve
|