3.13.4 has a weight of -1 points
(System and Communication Protection Family) 4/16
Prevent unauthorized and unintended information transfer via shared system resources.
Example of Sysytem Security Plan (SSP):
Preventing Unauthorized and Unintended Information Transfer via Shared System Resources
- Policy Statement: The organization ensures that information produced by prior users or roles is not accessible to current users or roles when accessing shared system resources, preventing unauthorized and unintended information transfer.
- Shared System Resources: These include registers, cache memory, main memory, and hard disks.
- Object Reuse and Residual Information Protection: Control of information in shared system resources is referred to as object reuse and residual information protection.
- Scope: This requirement applies to encrypted representations of information as well.
- Limitations: This requirement does not address information remanence (residual data from nominally deleted information), covert channels (manipulating shared resources to violate information flow restrictions), or components with only single users or roles.
- Implementation: Mechanisms must be in place to ensure that information produced by previous users or processes is not available to current users or processes accessing the shared resources.
- Benefits: Preventing unauthorized information transfer ensures data confidentiality and integrity, reducing the risk of data exposure or misuse.
- Guidance: Organizations should implement proper access controls and data sanitization methods to prevent information leakage through shared system resources. [SP 800-88 Rev. 1] provides guidance on media sanitization. [SP 800-53 Rev. 5] offers security controls guidance for system and organizational security.
Example of Plan of Action and Milestones ( POA & M):
Milestone 1: Policy Development and Communication
- Develop a comprehensive policy statement that emphasizes the prevention of unauthorized and unintended information transfer via shared system resources. Clearly outline the scope of the policy and its limitations. Communicate the policy to all relevant personnel and stakeholders. [Target Date]
Milestone 2: Identification of Shared System Resources
- Identify all shared system resources within the organization, including registers, cache memory, main memory, and hard disks. Determine the types of information that may be accessible through these resources and the potential risks associated with unauthorized access. [Target Date]
Milestone 3: Object Reuse and Residual Information Protection
- Define and implement mechanisms for object reuse and residual information protection in shared system resources. Ensure that information produced by prior users or roles is not accessible to current users or processes accessing the shared resources. [Target Date]
Milestone 4: Implementation of Access Controls
- Implement proper access controls to restrict access to shared system resources. Ensure that only authorized users or processes have access to specific resources and that information is appropriately isolated to prevent unintended information transfer. [Target Date]
Milestone 5: Data Sanitization Methods
- Implement data sanitization methods to remove residual information from shared system resources. Ensure that data remnants from prior users or processes are effectively erased to prevent unauthorized access. Refer to [SP 800-88 Rev. 1] for guidance on media sanitization methods. [Target Date]
Milestone 6: Testing and Validation
- Conduct thorough testing and validation of the implemented mechanisms for object reuse and residual information protection. Verify that information produced by previous users or processes is not accessible to current users or processes accessing the shared resources. [Target Date]
Milestone 7: Compliance and Reporting
- Ensure compliance with the policy statement and the established mechanisms for preventing unauthorized information transfer via shared system resources. Regularly monitor and assess the effectiveness of access controls and data sanitization methods. Provide periodic reports on the security posture and the successful implementation of prevention measures. [Target Date]
Milestone 8: Training and Awareness
- Conduct training and awareness programs for all personnel involved in accessing shared system resources. Educate employees about the importance of preventing unauthorized information transfer and the role they play in maintaining data confidentiality and integrity. [Target Date]
Milestone 9: Continuous Improvement
- Foster a culture of continuous improvement by soliciting feedback from personnel, conducting regular assessments, and staying informed about emerging best practices and technologies. Regularly review and update the policy and prevention measures to adapt to evolving security threats and requirements. [Target Date]
RELEVANT INFORMATION:
The control of information in shared system resources (e.g., registers, cache memory, main memory, hard disks) is also commonly referred to as object reuse and residual information protection. This requirement prevents information produced by the actions of prior users or roles (or the actions of processes acting on behalf of prior users or roles) from being available to any current users or roles (or current processes acting on behalf of current users or roles) that obtain access to shared system resources after those resources have been released back to the system. This requirement also applies to encrypted representations of information. This requirement does not address information remanence, which refers to residual representation of data that has been nominally deleted; covert channels (including storage or timing channels) where shared resources are manipulated to violate information flow restrictions; or components within systems for which there are only single users or roles.
Resources to consider:
Security Policy Document:
This comprehensive document outlines the organization’s security policies and procedures, including information system access controls and the specific measures implemented, such as password protection, multi-factor authentication, and device access controls. It should also cover consequences of unauthorized access and the importance of user training and awareness.
Asset Inventory and Access Control Sheet:
Create a spreadsheet that lists all information system resources in your organization, such as laptops, desktops, servers, network devices, printers, scanners, mobile devices, and paper documents. Alongside each resource, include information about authorized users, access rights, and any access restrictions.
User Account Management Log:
Maintain a log to track user account creation, modification, and removal. Include details like the date of account creation, purpose, and the individual responsible for approving the account.
Password and Multi-Factor Authentication Policy:
Combine the password policy and multi-factor authentication policy into a single document. Outline the organization’s password requirements, including complexity, length, expiration, and regular password change, as well as the implementation of multi-factor authentication for an extra layer of security.
Process and Script Accountability Log:
Maintain a log that associates automated scripts and processes with the specific authorized user who initiated them. This ensures accountability and prevents the use of generic accounts for critical processes.
Device Access Control and VPN Policy:
Merge the device access control and VPN configuration documents into a single policy. Detail the measures for controlling device access, authentication mechanisms, and VPN configuration, including which devices are allowed to connect and the authentication methods used.
Access Control Review and Monitoring Schedule:
Create a schedule for periodic reviews of access controls, including the process for adding, modifying, or revoking access rights based on personnel changes or business needs. Also, document the monitoring mechanisms implemented to track access to the information system, including logs and reports of access attempts and unusual activities.
User Training and Awareness Materials:
Prepare training materials and conduct regular sessions for authorized users. Document the topics covered, the date of the training, and the attendees.