03.04.02E Automated Unauthorized Component Detection

Statement

• Detect the presence of unauthorized or misconfigured system components using {{ insert: param, A.03.04.02E.ODP.01 }}.

• Take the following actions when unauthorized or misconfigured components are detected: {{ insert: param, A.03.04.02E.ODP.02 }} .

Guidance

Monitoring for unauthorized or misconfigured components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms may also be used to prevent the connection of unauthorized or misconfigured system components. Automated mechanisms can be implemented in systems or in separate system components. When acquiring and implementing automated mechanisms, organizations consider whether such mechanisms depend on the ability of the system component to support an agent or supplicant in order to be detected since some types of components do not have or cannot support agents (e.g., IoT devices, sensors). Isolation can be achieved, for example, by placing unauthorized system components in separate domains or subnets or quarantining such components. This type of component isolation is commonly referred to as "sandboxing." This requirement enhances SP 800-171 requirement 03.04.10.

Statement

• (includes expunge and preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes contain) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

the presence of unauthorized or misconfigured system components is detected using {{ insert: param, A.03.04.02E.ODP.01 }}.

Assessment objective

one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: {{ insert: param, A.03.04.02E.ODP.02 }}.

Assessment method

• Configuration management policy procedures addressing system component inventory and configuration settings configuration management plan system configuration settings and associated documentation system component inventory system design documentation change control records common secure configuration checklists alerts or notifications of unauthorized components within the system system monitoring records system maintenance records system audit records system security plan other relevant documents or records

Assessment method

• Personnel with component inventory and security configuration management responsibilities personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection personnel with information security responsibilities system/network administrators system developers

Assessment method

• Processes for the detection of unauthorized or misconfigured system components automated processes for taking action when unauthorized or misconfigured system components are detected automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final