ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(7) > Discussion

SC-7(7) Split Tunneling for Remote Devices - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Split tunneling is the process of allowing a remote user or device to establish a non-remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices and simultaneously, access uncontrolled networks. Split tunneling might be desirable by remote users to communicate with local system resources, such as printers or file servers. However, split tunneling can facilitate unauthorized external connections, making the system vulnerable to attack and to exfiltration of organizational information. Split tunneling can be prevented by disabling configuration settings that allow such capability in remote devices and by preventing those configuration settings from being configurable by users. Prevention can also be achieved by the detection of split tunneling (or of configuration settings that allow split tunneling) in the remote device, and by prohibiting the connection if the remote device is using split tunneling. A virtual private network (VPN) can be used to securely provision a split tunnel. A securely provisioned VPN includes locking connectivity to exclusive, managed, and named environments, or to a specific set of pre-approved addresses, without user control.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(7)

SC-7(7) Boundary Protection | Split Tunneling for Remote Devices
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prevent split tunneling for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Assignment: organization-defined safeguards].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(8) > Discussion

SC-7(8) Route Traffic to Authenticated Proxy Servers - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

External networks are networks outside of organizational control. A proxy server is a server (i.e., system or application) that acts as an intermediary for clients requesting system resources from non-organizational or other organizational servers. System resources that may be requested include files, connections, web pages, or services. Client requests established through a connection to a proxy server are assessed to manage complexity and provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers that provide access to the Internet. Proxy servers can support the logging of Transmission Control Protocol sessions and the blocking of specific Uniform Resource Locators, Internet Protocol addresses, and domain names. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites. Note that proxy servers may inhibit the use of virtual private networks (VPNs) and create the potential for "man-in-the-middle" attacks (depending on the implementation).
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(8)

SC-7(8) Boundary Protection | Route Traffic to Authenticated Proxy Servers
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Route [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(9) > Discussion

SC-7(9) Restrict Threatening Outgoing Communications Traffic - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Detecting outgoing communications traffic from internal actions that may pose threats to external systems is known as extrusion detection. Extrusion detection is carried out within the system at managed interfaces. Extrusion detection includes the analysis of incoming and outgoing communications traffic while searching for indications of internal threats to the security of external systems. Internal threats to external systems include traffic indicative of denial-of-service attacks, traffic with spoofed source addresses, and traffic that contains malicious code. Organizations have criteria to determine, update, and manage identified threats related to extrusion detection.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(9)

SC-7(9) Boundary Protection | Restrict Threatening Outgoing Communications Traffic
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

(a) Detect and deny outgoing communications traffic posing a threat to external systems; and
(b) Audit the identity of internal users associated with denied communications.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(10) > Discussion

SC-7(10) Prevent Exfiltration - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prevention of exfiltration applies to both the intentional and unintentional exfiltration of information. Techniques used to prevent the exfiltration of information from systems may be implemented at internal endpoints, external boundaries, and across managed interfaces and include adherence to protocol formats, monitoring for beaconing activity from systems, disconnecting external network interfaces except when explicitly needed, employing traffic profile analysis to detect deviations from the volume and types of traffic expected, call backs to command and control centers, conducting penetration testing, monitoring for steganography, disassembling and reassembling packet headers, and using data loss and data leakage prevention tools. Devices that enforce strict adherence to protocol formats include deep packet inspection firewalls and Extensible Markup Language (XML) gateways. The devices verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices that operate at the network or transport layers. The prevention of exfiltration is similar to data loss prevention or data leakage prevention and is closely associated with cross-domain solutions and system guards that enforce information flow requirements.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(10)

SC-7(10) Boundary Protection | Prevent Exfiltration
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

(a) Prevent the exfiltration of information; and
(b) Conduct exfiltration tests [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(11) > Discussion

SC-7(11) Restrict Incoming Communications Traffic - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(11)

SC-7(11) Boundary Protection | Restrict Incoming Communications Traffic
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Only allow incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(12) > Discussion

SC-7(12) Host-based Protection - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Host-based boundary protection mechanisms include host-based firewalls. System components that employ host-based boundary protection mechanisms include servers, workstations, notebook computers, and mobile devices.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(12)

SC-7(12) Boundary Protection | Host-based Protection
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(13) > Discussion

SC-7(13) Isolation of Security Tools, Mechanisms, and Support Components - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Physically separate subnetworks with managed interfaces are useful in isolating computer network defenses from critical operational processing networks to prevent adversaries from discovering the analysis and forensics techniques employed by organizations.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(13)

SC-7(13) Boundary Protection | Isolation of Security Tools, Mechanisms, and Support Components
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Isolate [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(14) > Discussion

SC-7(14) Protect Against Unauthorized Physical Connections - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Systems that operate at different security categories or classification levels may share common physical and environmental controls, since the systems may share space within the same facilities. In practice, it is possible that these separate systems may share common equipment rooms, wiring closets, and cable distribution paths. Protection against unauthorized physical connections can be achieved by using clearly identified and physically separated cable trays, connection frames, and patch panels for each side of managed interfaces with physical access controls that enforce limited authorized access to these items.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(14)

SC-7(14) Boundary Protection | Protect Against Unauthorized Physical Connections
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Protect against unauthorized physical connections at [Assignment: organization-defined managed interfaces].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(15) > Discussion

SC-7(15) Networked Privileged Accesses - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Privileged access provides greater accessibility to system functions, including security functions. Adversaries attempt to gain privileged access to systems through remote access to cause adverse mission or business impacts, such as by exfiltrating information or bringing down a critical system capability. Routing networked, privileged access requests through a dedicated, managed interface further restricts privileged access for increased access control and auditing.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(15)

SC-7(15) Boundary Protection | Networked Privileged Accesses
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Route networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(16) > Discussion

SC-7(16) Prevent Discovery of System Components - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Preventing the discovery of system components representing a managed interface helps protect network addresses of those components from discovery through common tools and techniques used to identify devices on networks. Network addresses are not available for discovery and require prior knowledge for access. Preventing the discovery of components and devices can be accomplished by not publishing network addresses, using network address translation, or not entering the addresses in domain name systems. Another prevention technique is to periodically change network addresses.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(16)

SC-7(16) Boundary Protection | Prevent Discovery of System Components
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prevent the discovery of specific system components that represent a managed interface.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(17) > Discussion

SC-7(17) Automated Enforcement of Protocol Formats - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

System components that enforce protocol formats include deep packet inspection firewalls and XML gateways. The components verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices operating at the network or transport layers.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(17)

SC-7(17) Boundary Protection | Automated Enforcement of Protocol Formats
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Enforce adherence to protocol formats.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(18) > Discussion

SC-7(18) Fail Secure - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Fail secure is a condition achieved by employing mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces, systems do not enter into unsecure states where intended security properties no longer hold. Managed interfaces include routers, firewalls, and application gateways that reside on protected subnetworks (commonly referred to as demilitarized zones). Failures of boundary protection devices cannot lead to or cause information external to the devices to enter the devices nor can failures permit unauthorized information releases.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(18)

SC-7(18) Boundary Protection | Fail Secure
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prevent systems from entering unsecure states in the event of an operational failure of a boundary protection device.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(19) > Discussion

SC-7(19) Block Communication from Non-organizationally Configured Hosts - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Communication clients independently configured by end users and external service providers include instant messaging clients and video conferencing software and applications. Traffic blocking does not apply to communication clients that are configured by organizations to perform authorized functions.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(19)

SC-7(19) Boundary Protection | Block Communication from Non-organizationally Configured Hosts
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Block inbound and outbound communications traffic between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(20) > Discussion

SC-7(20) Dynamic Isolation and Segregation - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

The capability to dynamically isolate certain internal system components is useful when it is necessary to partition or separate system components of questionable origin from components that possess greater trustworthiness. Component isolation reduces the attack surface of organizational systems. Isolating selected system components can also limit the damage from successful attacks when such attacks occur.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(20)

SC-7(20) Boundary Protection | Dynamic Isolation and Segregation
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Provide the capability to dynamically isolate [Assignment: organization-defined system components] from other system components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(21) > Discussion

SC-7(21) Isolation of System Components - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Organizations can isolate system components that perform different mission or business functions. Such isolation limits unauthorized information flows among system components and provides the opportunity to deploy greater levels of protection for selected system components. Isolating system components with boundary protection mechanisms provides the capability for increased protection of individual system components and to more effectively control information flows between those components. Isolating system components provides enhanced protection that limits the potential harm from hostile cyber-attacks and errors. The degree of isolation varies depending upon the mechanisms chosen. Boundary protection mechanisms include routers, gateways, and firewalls that separate system components into physically separate networks or subnetworks; cross-domain devices that separate subnetworks; virtualization techniques; and the encryption of information flows among system components using distinct encryption keys.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(21)

SC-7(21) Boundary Protection | Isolation of System Components
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Employ boundary protection mechanisms to isolate [Assignment: organization-defined system components] supporting [Assignment: organization-defined missions and/or business functions].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(22) > Discussion

SC-7(22) Separate Subnets for Connecting to Different Security Domains - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains that contain information with different security categories or classification levels.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(22)

SC-7(22) Boundary Protection | Separate Subnets for Connecting to Different Security Domains
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Implement separate network addresses to connect to systems in different security domains.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(23) > Discussion

SC-7(23) Disable Sender Feedback on Protocol Validation Failure - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Disabling feedback to senders when there is a failure in protocol validation format prevents adversaries from obtaining information that would otherwise be unavailable.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(23)

SC-7(23) Boundary Protection | Disable Sender Feedback on Protocol Validation Failure
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Disable feedback to senders on protocol format validation failure.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(24) > Discussion

SC-7(24) Personally Identifiable Information - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Managing the processing of personally identifiable information is an important aspect of protecting an individual's privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(24)

SC-7(24) Boundary Protection | Personally Identifiable Information
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

For systems that process personally identifiable information:
(a) Apply the following processing rules to data elements of personally identifiable information: [Assignment: organization-defined processing rules];
(b) Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
(c) Document each processing exception; and
(d) Review and remove exceptions that are no longer supported.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(25) > Discussion

SC-7(25) Unclassified National Security System Connections - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified national security systems and external networks.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(25)

SC-7(25) Boundary Protection | Unclassified National Security System Connections
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

Prohibit the direct connection of [Assignment: organization-defined unclassified national security system] to an external network without the use of [Assignment: organization-defined boundary protection device].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-7 > SC-7(26) > Discussion

SC-7(26) Classified National Security System Connections - Discussion
Family: System and Communications Protection (SC) > SC-7 Boundary Protection

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between classified national security systems and external networks. In addition, approved boundary protection devices (typically managed interface or cross-domain systems) provide information flow enforcement from systems to external networks.