ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
SC > SC-26 > Discussion

SC-26 Decoys - Discussion
Family: System and Communications Protection (SC)

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational mission and business functions. Use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. Depending on the specific usage of the decoy, consultation with the Office of the General Counsel before deployment may be needed.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-27

SC-27 Platform-independent Applications
Family: System and Communications Protection (SC)

Include within organizational systems the following platform independent applications: [Assignment: organization-defined platform-independent applications].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-27 > Discussion

SC-27 Platform-independent Applications - Discussion
Family: System and Communications Protection (SC)

Platforms are combinations of hardware, firmware, and software components used to execute software applications. Platforms include operating systems, the underlying computer architectures, or both. Platform-independent applications are applications with the capability to execute on multiple platforms. Such applications promote portability and reconstitution on different platforms. Application portability and the ability to reconstitute on different platforms increase the availability of mission-essential functions within organizations in situations where systems with specific operating systems are under attack.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28

SC-28 Protection of Information at Rest
Family: System and Communications Protection (SC)

Protect the [Selection; one or more: confidentiality; integrity] of the following information at rest: [Assignment: organization-defined information at rest].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > Discussion

SC-28 Protection of Information at Rest - Discussion
Family: System and Communications Protection (SC)

Information at rest refers to the state of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storage device or frequency of access but rather on the state of the information. Information at rest addresses the confidentiality and integrity of information and covers user information and system information. System-related information that requires protection includes configurations or rule sets for firewalls, intrusion detection and prevention systems, filtering routers, and authentication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanning. Integrity protection can be achieved, for example, by implementing write-once-read-many (WORM) technologies. When adequate protection of information at rest cannot otherwise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(1) > Discussion

SC-28(1) Cryptographic Protection - Discussion
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

The selection of cryptographic mechanisms is based on the need to protect the confidentiality and integrity of organizational information. The strength of mechanism is commensurate with the security category or classification of the information. Organizations have the flexibility to encrypt information on system components or media or encrypt data structures, including files, records, or fields.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(1)

SC-28(1) Protection of Information at Rest | Cryptographic Protection
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on [Assignment: organization-defined system components or media]: [Assignment: organization-defined information].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(2) > Discussion

SC-28(2) Offline Storage - Discussion
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

Removing organizational information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to offline storage in lieu of protecting such information in online storage.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(2)

SC-28(2) Protection of Information at Rest | Offline Storage
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(3) > Discussion

SC-28(3) Cryptographic Keys - Discussion
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

A Trusted Platform Module (TPM) is an example of a hardware-protected data store that can be used to protect cryptographic keys.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-28 > SC-28(3)

SC-28(3) Protection of Information at Rest | Cryptographic Keys
Family: System and Communications Protection (SC) > SC-28 Protection of Information at Rest

Provide protected storage for cryptographic keys [Selection: [Assignment: organization-defined safeguards] ; hardware-protected key store].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-29

SC-29 Heterogeneity
Family: System and Communications Protection (SC)

Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: organization-defined system components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-29 > Discussion

SC-29 Heterogeneity - Discussion
Family: System and Communications Protection (SC)

Increasing the diversity of information technologies within organizational systems reduces the impact of potential exploitations or compromises of specific technologies. Such diversity protects against common mode failures, including those failures induced by supply chain attacks. Diversity in information technologies also reduces the likelihood that the means adversaries use to compromise one system component will be effective against other system components, thus further increasing the adversary work factor to successfully complete planned attacks. An increase in diversity may add complexity and management overhead that could ultimately lead to mistakes and unauthorized configurations.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-29 > SC-29(1) > Discussion

SC-29(1) Virtualization Techniques - Discussion
Family: System and Communications Protection (SC) > SC-29 Heterogeneity

While frequent changes to operating systems and applications can pose significant configuration management challenges, the changes can result in an increased work factor for adversaries to conduct successful attacks. Changing virtual operating systems or applications, as opposed to changing actual operating systems or applications, provides virtual changes that impede attacker success while reducing configuration management efforts. Virtualization techniques can assist in isolating untrustworthy software or software of dubious provenance into confined execution environments.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-29 > SC-29(1)

SC-29(1) Heterogeneity | Virtualization Techniques
Family: System and Communications Protection (SC) > SC-29 Heterogeneity

Employ virtualization techniques to support the deployment of a diversity of operating systems and applications that are changed [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30

SC-30 Concealment and Misdirection
Family: System and Communications Protection (SC)

Employ the following concealment and misdirection techniques for [Assignment: organization-defined systems] at [Assignment: organization-defined time periods] to confuse and mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > Discussion

SC-30 Concealment and Misdirection - Discussion
Family: System and Communications Protection (SC)

Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of concealment and misdirection techniques and methods-including randomness, uncertainty, and virtualization-may sufficiently confuse and mislead adversaries and subsequently increase the risk of discovery and/or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(2) > Discussion

SC-30(2) Randomness - Discussion
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target information resources of organizations that support critical missions or business functions. Uncertainty may also cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating roles and responsibilities of organizational personnel.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(2)

SC-30(2) Concealment and Misdirection | Randomness
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(3) > Discussion

SC-30(3) Change Processing and Storage Locations - Discussion
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Adversaries target critical mission and business functions and the systems that support those mission and business functions while also trying to minimize the exposure of their existence and tradecraft. The static, homogeneous, and deterministic nature of organizational systems targeted by adversaries make such systems more susceptible to attacks with less adversary cost and effort to be successful. Changing processing and storage locations (also referred to as moving target defense) addresses the advanced persistent threat using techniques such as virtualization, distributed processing, and replication. This enables organizations to relocate the system components (i.e., processing, storage) that support critical mission and business functions. Changing the locations of processing activities and/or storage sites introduces a degree of uncertainty into the targeting activities of adversaries. The targeting uncertainty increases the work factor of adversaries and makes compromises or breaches of the organizational systems more difficult and time-consuming. It also increases the chances that adversaries may inadvertently disclose certain aspects of their tradecraft while attempting to locate critical organizational resources.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(3)

SC-30(3) Concealment and Misdirection | Change Processing and Storage Locations
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Change the location of [Assignment: organization-defined processing and/or storage] [Selection: [Assignment: organization-defined time frequency] ; random time intervals]].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(4) > Discussion

SC-30(4) Misleading Information - Discussion
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Employing misleading information is intended to confuse potential adversaries regarding the nature and extent of controls deployed by organizations. Thus, adversaries may employ incorrect and ineffective attack techniques. One technique for misleading adversaries is for organizations to place misleading information regarding the specific controls deployed in external systems that are known to be targeted by adversaries. Another technique is the use of deception nets that mimic actual aspects of organizational systems but use, for example, out-of-date software configurations.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(4)

SC-30(4) Concealment and Misdirection | Misleading Information
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Employ realistic, but misleading information in [Assignment: organization-defined system components] about its security state or posture.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(5) > Discussion

SC-30(5) Concealment of System Components - Discussion
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

By hiding, disguising, or concealing critical system components, organizations may be able to decrease the probability that adversaries target and successfully compromise those assets. Potential means to hide, disguise, or conceal system components include the configuration of routers or the use of encryption or virtualization techniques.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-30 > SC-30(5)

SC-30(5) Concealment and Misdirection | Concealment of System Components
Family: System and Communications Protection (SC) > SC-30 Concealment and Misdirection

Employ the following techniques to hide or conceal [Assignment: organization-defined system components]: [Assignment: organization-defined techniques].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31

SC-31 Covert Channel Analysis
Family: System and Communications Protection (SC)

a. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [Selection; one or more: storage; timing] channels; and
b. Estimate the maximum bandwidth of those channels.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > Discussion

SC-31 Covert Channel Analysis - Discussion
Family: System and Communications Protection (SC)

Developers are in the best position to identify potential areas within systems that might lead to covert channels. Covert channel analysis is a meaningful activity when there is the potential for unauthorized information flows across security domains, such as in the case of systems that contain export-controlled information and have connections to external networks (i.e., networks that are not controlled by organizations). Covert channel analysis is also useful for multilevel secure systems, multiple security level systems, and cross-domain systems.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > SC-31(1)

SC-31(1) Covert Channel Analysis | Test Covert Channels for Exploitability
Family: System and Communications Protection (SC) > SC-31 Covert Channel Analysis

Test a subset of the identified covert channels to determine the channels that are exploitable.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > SC-31(2) > Discussion

SC-31(2) Maximum Bandwidth - Discussion
Family: System and Communications Protection (SC) > SC-31 Covert Channel Analysis

The complete elimination of covert channels, especially covert timing channels, is usually not possible without significant performance impacts.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > SC-31(2)

SC-31(2) Covert Channel Analysis | Maximum Bandwidth
Family: System and Communications Protection (SC) > SC-31 Covert Channel Analysis

Reduce the maximum bandwidth for identified covert [Selection; one or more: storage; timing] channels to [Assignment: organization-defined values].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > SC-31(3) > Discussion

SC-31(3) Measure Bandwidth in Operational Environments - Discussion
Family: System and Communications Protection (SC) > SC-31 Covert Channel Analysis

Measuring covert channel bandwidth in specified operational environments helps organizations determine how much information can be covertly leaked before such leakage adversely affects mission or business functions. Covert channel bandwidth may be significantly different when measured in settings that are independent of the specific environments of operation, including laboratories or system development environments.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-31 > SC-31(3)

SC-31(3) Covert Channel Analysis | Measure Bandwidth in Operational Environments
Family: System and Communications Protection (SC) > SC-31 Covert Channel Analysis

Measure the bandwidth of [Assignment: organization-defined subset of identified covert channels] in the operational environment of the system.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-32

SC-32 System Partitioning
Family: System and Communications Protection (SC)

Partition the system into [Assignment: organization-defined system components] residing in separate [Selection: physical; logical] domains or environments based on [Assignment: organization-defined circumstances for the physical or logical separation of components].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-32 > Discussion

SC-32 System Partitioning - Discussion
Family: System and Communications Protection (SC)

System partitioning is part of a defense-in-depth protection strategy. Organizations determine the degree of physical separation of system components. Physical separation options include physically distinct components in separate racks in the same room, critical components in separate rooms, and geographical separation of critical components. Security categorization can guide the selection of candidates for domain partitioning. Managed interfaces restrict or prohibit network access and information flow among partitioned system components.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-32 > SC-32(1) > Discussion

SC-32(1) Separate Physical Domains for Privileged Functions - Discussion
Family: System and Communications Protection (SC) > SC-32 System Partitioning

Privileged functions that operate in a single physical domain may represent a single point of failure if that domain becomes compromised or experiences a denial of service.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-32 > SC-32(1)

SC-32(1) System Partitioning | Separate Physical Domains for Privileged Functions
Family: System and Communications Protection (SC) > SC-32 System Partitioning

Partition privileged functions into separate physical domains.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34

SC-34 Non-modifiable Executable Programs
Family: System and Communications Protection (SC)

For [Assignment: organization-defined system components] , load and execute:
a. The operating environment from hardware-enforced, read-only media; and
b. The following applications from hardware-enforced, read-only media: [Assignment: organization-defined applications].
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34 > Discussion

SC-34 Non-modifiable Executable Programs - Discussion
Family: System and Communications Protection (SC)

The operating environment for a system contains the code that hosts applications, including operating systems, executives, or virtual machine monitors (i.e., hypervisors). It can also include certain applications that run directly on hardware platforms. Hardware-enforced, read-only media include Compact Disc-Recordable (CD-R) and Digital Versatile Disc-Recordable (DVD-R) disk drives as well as one-time, programmable, read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable, read-only memory can be accepted as read-only media provided that integrity can be adequately protected from the point of initial writing to the insertion of the memory into the system, and there are reliable hardware protections against reprogramming the memory while installed in organizational systems.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34 > SC-34(1) > Discussion

SC-34(1) No Writable Storage - Discussion
Family: System and Communications Protection (SC) > SC-34 Non-modifiable Executable Programs

Disallowing writeable storage eliminates the possibility of malicious code insertion via persistent, writeable storage within the designated system components. The restriction applies to fixed and removable storage, with the latter being addressed either directly or as specific restrictions imposed through access controls for mobile devices.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34 > SC-34(1)

SC-34(1) Non-modifiable Executable Programs | No Writable Storage
Family: System and Communications Protection (SC) > SC-34 Non-modifiable Executable Programs

Employ [Assignment: organization-defined system components] with no writeable storage that is persistent across component restart or power on/off.
Security and Privacy Controls for Information Systems and Organizations
SC > SC-34 > SC-34(2) > Discussion

SC-34(2) Integrity Protection on Read-only Media - Discussion
Family: System and Communications Protection (SC) > SC-34 Non-modifiable Executable Programs

Controls prevent the substitution of media into systems or the reprogramming of programmable read-only media prior to installation into the systems. Integrity protection controls include a combination of prevention, detection, and response.