System and Information Integrity (SI)¶

SI.L2-3.14.1 – Flaw Remediation [CUI Data]¶

Identify, report, and correct system flaws in a timely manner.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 61.

Determine if:

• [a] the time within which to identify system flaws is specified;
• [b] system flaws are identified within the specified time frame;
• [c] the time within which to report system flaws is specified;
• [d] system flaws are reported within the specified time frame;
• [e] the time within which to correct system flaws is specified; and
• [f] system flaws are corrected within the specified time frame.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 61.

Examine: [SELECT FROM: System and information integrity policy; procedures addressing flaw remediation; procedures addressing configuration management; system security plan; list of flaws and vulnerabilities potentially affecting the system; list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws); test results from the installation of software and firmware updates to correct system flaws; installation/change control records for security-relevant software and firmware updates; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for flaw remediation; personnel with configuration management responsibility].

Test: [SELECT FROM: Organizational processes for identifying, reporting, and correcting system flaws; organizational process for installing software and firmware updates; mechanisms supporting or implementing reporting, and correcting system flaws; mechanisms supporting or implementing testing software and firmware updates].

Discussion¶

Source: NIST SP 800-171 Rev. 2, pp. 40-41.

Organizations identify systems that are affected by announced software and firmware flaws including potential vulnerabilities resulting from those flaws and report this information to designated personnel with information security responsibilities. Security-relevant updates include patches, service packs, hot fixes, and anti-virus signatures. Organizations address flaws discovered during security assessments, continuous monitoring, incident response activities, and system error handling. Organizations can take advantage of available resources such as the Common Weakness Enumeration (CWE) database or Common Vulnerabilities and Exposures (CVE) database in remediating flaws discovered in organizational systems. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of factors including the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). Some types of flaw remediation may require more testing than other types of remediation. NIST SP 800-40 provides guidance on patch management technologies.

Further Discussion¶

All software and firmware have potential flaws. Many vendors work to remedy those flaws by releasing vulnerability information and updates to their software and firmware. OSAs must have a process to review relevant vendor notifications and updates about problems or weaknesses. After reviewing the information, the OSA must implement a patch management process that allows for software and firmware flaws to be fixed without adversely affecting the system functionality. OSAs must define the time frames within which flaws are identified, reported, and corrected for all systems. OSAs should consider purchasing support from their vendors to ensure timely access to updates.

Examples¶

• You know that software vendors typically release patches, service packs, hot fixes, etc. and want to make sure your software is up to date. You develop a policy that requires checking vendor websites for flaw notifications every week [a]. The policy further requires that those flaws be assessed for severity and patched on end-user computers once each week and servers once each month [c,e]. Consistent with that policy, you configure the system to check for updates weekly or daily depending on the criticality of the software [b,e]. Your team reviews available updates and implements the applicable ones according to the defined schedule [f].

Potential Assessment Considerations¶

• Is the time frame (e.g., a set number of days) within which system flaw identification activities (e.g., vulnerability scans, configuration scans, manual review) must be performed defined and documented [a]?
• Are system flaws (e.g., vulnerabilities, misconfigurations) identified in accordance with the specified time frame [b]?
• Is the time frame (e.g., a set number of days dependent on the assessed severity of a flaw) within which system flaws must be corrected defined and documented [e]?
• Are system flaws (e.g., applied security patches, made configuration changes, or implemented workarounds or mitigations) corrected in accordance with the specified time frame [f]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.1
• FAR Clause 52.204-21 b.1.xii

SI.L2-3.14.2 – Malicious Code Protection [CUI Data]¶

Provide protection from malicious code at designated locations within organizational systems.

Assessment Objectives¶

Source: NIST SP 800-171A, pp. 61-62.

Determine if:

• [a] designated locations for malicious code protection are identified; and
• [b] protection from malicious code at designated locations is provided.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, pp. 61-62.

Examine: [SELECT FROM: System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; records of malicious code protection updates; malicious code protection mechanisms; system security plan; system configuration settings and associated documentation; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; scan results from malicious code protection mechanisms; system design documentation; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for malicious code protection; personnel with configuration management responsibility].

Test: [SELECT FROM: Organizational processes for employing, updating, and configuring malicious code protection mechanisms; organizational process for addressing false positives and resulting potential impact; mechanisms supporting or implementing employing, updating, and configuring malicious code protection mechanisms; mechanisms supporting or implementing malicious code scanning and subsequent actions].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 41.

Designated locations include system entry and exit points which may include firewalls, remote access servers, workstations, electronic mail servers, web servers, proxy servers, notebook computers, and mobile devices. Malicious code includes viruses, worms, Trojan horses, and spyware. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways including web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities. Malicious code protection mechanisms include anti-virus signature definitions and reputation-based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include logic bombs, back doors, and other types of cyber-attacks that could affect organizational missions/business functions. Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including secure coding practices, configuration management and control, trusted procurement processes, and monitoring technologies to help ensure that software does not perform functions other than the functions intended. NIST SP 800-83 provides guidance on malware incident prevention.

Further Discussion¶

A designated location may be a network device such as a firewall or an end user’s computer. Malicious code, which can be delivered by a range of means (e.g., email, removable media, or websites), includes the following:

• virus – program designed to damage, steal information, change data, send email, show messages, or any combination of these things;
• spyware – program designed to gather information about a person’s activity in secret when they click on a link, usually installed without the person knowing ;
• trojan horse – type of malware made to look like legitimate software and used by cyber criminals to get access to a company’s systems; and
• ransomware – type of malware that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid.

Use anti-malware tools to stop or lessen the impact of malicious code.

Examples¶

• You are buying a new computer and want to protect your company’s information from viruses, spyware, etc. You buy and install anti-malware software [a,b].

Potential Assessment Considerations¶

• Are system components (e.g., workstations, servers, email gateways, mobile devices) for which malicious code protection must be provided identified and documented [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.2
• FAR Clause 52.204-21 b.1.xiii

SI.L2-3.14.3 – Security Alerts & Advisories¶

Monitor system security alerts and advisories and take action in response.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 62.

Determine if:

• [a] response actions to system security alerts and advisories are identified;
• [b] system security alerts and advisories are monitored; and
• [c] actions in response to system security alerts and advisories are taken.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 62.

Examine: [SELECT FROM: System and information integrity policy; procedures addressing security alerts, advisories, and directives; system security plan; records of security alerts and advisories; other relevant documents or records].

Interview: [SELECT FROM: Personnel with security alert and advisory responsibilities; personnel implementing, operating, maintaining, and using the system; personnel, organizational elements, and external organizations to whom alerts, advisories, and directives are to be disseminated; system or network administrators; personnel with information security responsibilities].

Test: [SELECT FROM: Organizational processes for defining, receiving, generating, disseminating, and complying with security alerts, advisories, and directives; mechanisms supporting or implementing definition, receipt, generation, and dissemination of security alerts, advisories, and directives; mechanisms supporting or implementing security directives].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 41.

There are many publicly available sources of system security alerts and advisories. The United States Computer Emergency Readiness Team (US-CERT) generates security alerts and advisories to maintain situational awareness across the federal government and in nonfederal organizations. Software vendors, subscription services, and relevant industry information sharing and analysis centers (ISACs) may also provide security alerts and advisories. Examples of response actions include notifying relevant external organizations, for example, external mission/business partners, supply chain partners, external service providers, and peer or supporting organizations. NIST SP 800-161 provides guidance on supply chain risk management.

Further Discussion¶

Solicit and receive security alerts, advisories, and directives from reputable external organizations. Identify sources relevant to the industry and technology used by your company. Methods to receive alerts and advisories may include:

• signing up for email distributions;
• subscribing to RSS feeds; and
• attending meetings.

Review alerts and advisories for applicability as they are received. The frequency of the reviews should be based on the frequency of the alerts and advisories to ensure you have the most up-to-date information. External alerts and advisories may prompt you to generate internal security alerts, advisories, or directives, and share these with all personnel with a need-to-know. The individuals should assess the risk related to a given alert and act to respond as appropriate. Sometimes it may require a configuration update. Other times, the information may also require adjusting system architecture in order to thwart a threat described in an advisory.

Examples¶

• You monitor security advisories each week. You review the alert emails and online subscription service alerts to determine which ones apply [b]. You create a list of the applicable alerts and research what steps you need to take to address them. Next, you generate a plan that you review with your change management group so that the work can be scheduled [c].

Potential Assessment Considerations¶

• Are the responses to system security alerts and advisories identified in relation to the assessed severity of potential flaws (e.g., communicating with responsible personnel, initiating vulnerability scans, initiating system flaw remediation activities) [a]?
• Are system security alerts and advisories addressed (e.g., assessing potential severity or likelihood, communicating with responsible personnel, initiating vulnerability scans, initiating system flaw remediation activities) [a,c]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.3

SI.L2-3.14.4 – Update Malicious Code Protection [CUI Data]¶

Update malicious code protection mechanisms when new releases are available.

Assessment Objectives¶

Source: NIST SP 800-171A, pp. 62-63.

Determine if:

• [a] malicious code protection mechanisms are updated when new releases are available.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, pp. 62-63.

Examine: [SELECT FROM: System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; malicious code protection mechanisms; records of malicious code protection updates; system security plan; system design documentation; system configuration settings and associated documentation; scan results from malicious code protection mechanisms; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for malicious code protection; personnel with configuration management responsibility].

Test: [SELECT FROM: Organizational processes for employing, updating, and configuring malicious code protection mechanisms; organizational process for addressing false positives and resulting potential impact; mechanisms supporting or implementing malicious code protection mechanisms (including updates and configurations); mechanisms supporting or implementing malicious code scanning and subsequent actions].

Discussion¶

Source: NIST SP 800-171 Rev. 2, pp. 41-42.

Malicious code protection mechanisms include anti-virus signature definitions and reputation-based technologies. A variety of technologies and methods exist to limit or eliminate the effects of malicious code. Pervasive configuration management and comprehensive software integrity controls may be effective in preventing execution of unauthorized code. In addition to commercial off-the-shelf software, malicious code may also be present in custom-built software. This could include logic bombs, back doors, and other types of cyber-attacks that could affect organizational missions/business functions.

Traditional malicious code protection mechanisms cannot always detect such code. In these situations, organizations rely instead on other safeguards including secure coding practices, configuration management and control, trusted procurement processes, and monitoring technologies to help ensure that software does not perform functions other than the functions intended.

Further Discussion¶

Malware changes on an hourly or daily basis, and it is important to update detection and protection mechanisms frequently to maintain the effectiveness of the protection.

Examples¶

• You have installed anti-malware software to protect a computer from malicious code. Knowing that malware evolves rapidly, you configure the software to automatically check for malware definition updates every day and update as needed [a].

Potential Assessment Considerations¶

• Is there a defined frequency by which malicious code protection mechanisms must be updated (e.g., frequency of automatic updates or manual processes) [a]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.4
• FAR Clause 52.204-21 b.1.xiv

SI.L2-3.14.5 – System & File Scanning [CUI Data]¶

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 63.

Determine if:

• [a] the frequency for malicious code scans is defined;
• [b] malicious code scans are performed with the defined frequency; and
• [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 63.

Examine: [SELECT FROM: System and information integrity policy; configuration management policy and procedures; procedures addressing malicious code protection; malicious code protection mechanisms; records of malicious code protection updates; system security plan; system design documentation; system configuration settings and associated documentation; scan results from malicious code protection mechanisms; record of actions initiated by malicious code protection mechanisms in response to malicious code detection; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for malicious code protection; personnel with configuration management responsibility].

Test: [SELECT FROM: Organizational processes for employing, updating, and configuring malicious code protection mechanisms; organizational process for addressing false positives and resulting potential impact; mechanisms supporting or implementing malicious code protection mechanisms (including updates and configurations); mechanisms supporting or implementing malicious code scanning and subsequent actions].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 42.

Periodic scans of organizational systems and real-time scans of files from external sources can detect malicious code. Malicious code can be encoded in various formats (e.g., UUENCODE, Unicode), contained within compressed or hidden files, or hidden in files using techniques such as steganography. Malicious code can be inserted into systems in a variety of ways including web accesses, electronic mail, electronic mail attachments, and portable storage devices. Malicious code insertions occur through the exploitation of system vulnerabilities.

Further Discussion¶

Use anti-malware software to scan for and identify viruses in your computer systems and determine how often scans are conducted. Real-time scans look at the system whenever new files are downloaded, opened, and saved. Periodic scans check previously saved files against updated malware information.

Examples¶

• You work with your company’s email provider to enable enhanced protections that will scan all attachments to identify and quarantine those that may be harmful prior to a user opening them [c]. In addition, you configure antivirus software on each computer to scan for malicious code every day [a,b]. The software also scans files that are downloaded or copied from removable media such as USB drives. It quarantines any suspicious files and notifies the security team [c].

Potential Assessment Considerations¶

• Are files from media (e.g., USB drives, CD-ROM) included in the definition of external sources and are they being scanned [c]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.5
• FAR Clause 52.204-21 b.1.xv

SI.L2-3.14.6 – Monitor Communications for Attacks¶

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

Assessment Objectives¶

Source: NIST SP 800-171A, pp. 63-64.

Determine if:

• [a] the system is monitored to detect attacks and indicators of potential attacks;
• [b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks; and
• [c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, pp. 63-64.

Examine: [SELECT FROM: System and information integrity policy; procedures addressing system monitoring tools and techniques; continuous monitoring strategy; system and information integrity policy; procedures addressing system monitoring tools and techniques; facility diagram or layout; system security plan; system monitoring tools and techniques documentation; system design documentation; locations within system where monitoring devices are deployed; system protocols; system configuration settings and associated documentation; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility monitoring the system; personnel with responsibility for the intrusion detection system].

Test: [SELECT FROM: Organizational processes for system monitoring; mechanisms supporting or implementing intrusion detection capability and system monitoring; mechanisms supporting or implementing system monitoring capability; organizational processes for intrusion detection and system monitoring; mechanisms supporting or implementing the monitoring of inbound and outbound communications traffic].

Discussion¶

Source: NIST SP 800-171 Rev. 2, pp. 42-43.

System monitoring includes external and internal monitoring. External monitoring includes the observation of events occurring at the system boundary (i.e., part of perimeter defense and boundary protection). Internal monitoring includes the observation of events occurring within the system. Organizations can monitor systems, for example, by observing audit record activities in real time or by observing other system aspects such as access patterns, characteristics of access, and other actions. The monitoring objectives may guide determination of the events. System monitoring capability is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Strategic locations for monitoring devices include selected perimeter locations and near server farms supporting critical applications, with such devices being employed at managed system interfaces. The granularity of monitoring information collected is based on organizational monitoring objectives and the capability of systems to support such objectives. System monitoring is an integral part of continuous monitoring and incident response programs. Output from system monitoring serves as input to continuous monitoring and incident response programs. A network connection is any connection with a device that communicates through a network (e.g., local area network, Internet). A remote connection is any connection with a device communicating through an external network (e.g., the Internet). Local, network, and remote connections can be either wired or wireless. Unusual or unauthorized activities or conditions related to inbound/outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. NIST SP 800-94 provides guidance on intrusion detection and prevention systems.

Further Discussion¶

Think of indicators of attack as a set of footprints an adversary leaves during an attack. Indicators of attack provide information on the steps the adversary followed and its intent. Indicators of attacks on organizational systems may include:

• internal traffic that indicates the presence of malicious code;
• anomalous activity detected during non-business hours;
• unauthorized data leaving the organization; and
• communicating to external information systems.

To detect attacks and indicators of attacks, deploy monitoring devices or agents. Place these sensors at strategic points within the systems and networks to collect essential information. Strategic points include internal and external system boundaries. Monitor both inbound traffic and outbound traffic as well as actions on hosts. This requirement, SI.L2-3.14.6, provides details for the communications of organizational systems. SI.L2-3.14.6 supports the requirement AU.L2-3.3.1, which involves creating and retaining records for monitoring, analysis, and investigations.

Examples¶

• It is your job to look for known indicators of attack or anomalous activity within your systems and communications traffic [a,b,c]. Because these indicators can show up in a variety of places on your network, you have created a checklist of places to check each week. These include the office firewall logs, the audit logs of the file server where CUI is stored, and the connection log for your VPN gateway [b]. You conduct additional reviews when you find an indicator, or something that does not perform as it should [a].

Potential Assessment Considerations¶

• Are details provided for the methodology of determining attacks and indicators of attack [a]?
• Are monitoring devices deployed within the information system to collect information that may indicate an attack [a]?
• Are communications traffic flows understood and is there a deployed capability to review that traffic [b,c]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.6

SI.L2-3.14.7 – Identify Unauthorized Use¶

Identify unauthorized use of organizational systems.

Assessment Objectives¶

Source: NIST SP 800-171A, p. 64.

Determine if:

• [a] authorized use of the system is defined; and
• [b] unauthorized use of the system is identified.

Potential Assessment Methods and Objects¶

Source: NIST SP 800-171A, p. 64.

Examine: [SELECT FROM: Continuous monitoring strategy; system and information integrity policy; procedures addressing system monitoring tools and techniques; facility diagram/layout; system security plan; system design documentation; system monitoring tools and techniques documentation; locations within system where monitoring devices are deployed; system configuration settings and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: System or network administrators; personnel with information security responsibilities; personnel installing, configuring, and maintaining the system; personnel with responsibility for monitoring the system].

Test: [SELECT FROM: Organizational processes for system monitoring; mechanisms supporting or implementing system monitoring capability].

Discussion¶

Source: NIST SP 800-171 Rev. 2, p. 43.

System monitoring includes external and internal monitoring. System monitoring can detect unauthorized use of organizational systems. System monitoring is an integral part of continuous monitoring and incident response programs. Monitoring is achieved through a variety of tools and techniques (e.g., intrusion detection systems, intrusion prevention systems, malicious code protection software, scanning tools, audit record monitoring software, network monitoring software). Output from system monitoring serves as input to continuous monitoring and incident response programs. Unusual/unauthorized activities or conditions related to inbound and outbound communications traffic include internal traffic that indicates the presence of malicious code in systems or propagating among system components, the unauthorized exporting of information, or signaling to external systems. Evidence of malicious code is used to identify potentially compromised systems or system components. System monitoring requirements, including the need for specific types of system monitoring, may be referenced in other requirements. NIST SP 800-94 provides guidance on intrusion detection and prevention systems.

Further Discussion¶

Define authorized use of your systems. Create an acceptable use policy to establish the baseline for how users access devices, internal network services, and the internet. Define authorized use by specific roles such as: user, administrator, and technician. After authorized use is defined, identify unauthorized use of systems. Monitor systems by observing audit activities from the system logs. This can be accomplished in real time using automated solutions or by manual means. To identify unauthorized use, leverage existing tools and techniques, such as:

• intrusion detection systems;
• intrusion prevention systems;
• malicious code protection software;
• scanning tools;
• audit record monitoring software; and
• network monitoring software.

This requirement, SI.L2-3.14.7, which deals with identifying unauthorized use of organizational systems, is related to requirements: AC.L2-3.1.1, AU.L2-3.3.1, IA.L2-3.5.1, and IA.L2-3.5.2. All of these requirements help create the building blocks that support SI.L2-3.14.7.

Examples¶

• You are in charge of IT operations. You need to ensure that everyone using an organizational system is authorized to do so and conforms to the written authorized use policy. To do this, you deploy an application that monitors user activity and records the information for later analysis. You review the data from this application for signs of activity that does not conform to the acceptable use policy [a,b].

• You are alerted through your Intrusion Detection System (IDS) that one of your users is connecting to a server that is from a high-risk domain (based on your commercial domain reputation service). You investigate and determine that it’s not the user, but instead an unauthorized connection attempt [b]. You add the domain to your list of blocked domains to prevent connections in the future.

Potential Assessment Considerations¶

• Is authorized use of systems defined (e.g., data types permitted for storage or processing, personnel authorized to access, times or days of permitted use, permitted software) [a]?
• Is unauthorized use of systems defined (e.g., not authorized to use systems for bitcoin mining, not authorized for pornographic content, not authorized to access gambling games/content) [b]?

Key References¶

• NIST SP 800-171 Rev. 2 3.14.7