07/09/2024
CJISSECPOL v5.9.5
173
5.10 SYSTEMS AND COMMUNICATIONS PROTECTION (SC)
Examples of systems and comm unications safeguards range from boundary and transmission protection to securing an agency’s virtualized environment. In addition, applications, services, or information systems must have the capability to ensure system integrity through the detection and protection against unauthorized changes to softwa re and information. Th is section details the requirements for protecting systems and communications infrastructures.
SC-1 POLICY AND PROCEDURES
[Priority 2]
Control:
a. Develop, document, and disseminate to organizational personnel with system and communications protection responsibilities:
1. Agency-level system and communications protection policy that:
(a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
2. Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls; b. Designate organizational personnel with information security responsibilities to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and
c. Review and update the current system and communications protection:
1. Policy annually and following any changes and security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI; and
2. Procedures annually and following any changes and security incidents involving unauthorized access to CJI or systems used to process, store, or transmit CJI.
Discussion: System and communications protection policy and procedures address the controls in the SC family that are implemented within systems and organizations. The risk management strategy is an important factor in establis hing such policies and pr ocedures. Policies and procedures contribute to security and privacy assu rance. Therefore, it is important that security and privacy programs collaborate on the develo pment of system and communications protection policy and procedures. Security and privacy progr am policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy progr ams, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate docum ents. Events that may
07/09/2024
CJISSECPOL v5.9.5
174
precipitate an update to system and communica tions protection policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guideli nes. Simply restating controls does not constitute an organizational policy or procedure.
Related Controls: PS-8, SA-8, SI-12.
SC-2 SEPARATION OF SYSTEM AND USER FUNCTIONALITY
[Existing] [Priority 2]
Control:
Separate user functio nality, including user interface serv ices, from system management functionality.
Discussion: System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. Thes e functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods.
Separation of system management functions from user functions includes web administrative interfaces that employ separate au thentication methods for users of any other system resources.
Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access c ontrols. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in SA-8.
Related Controls: AC-6, SA-4, SA-8, SC-7, SC-22, SC-39.
SC-4 INFORMATION IN SHARED SYSTEM RESOURCES
[Existing] [Priority 2]
Control:
Prevent unauthorized and unintended information transfer via shared system resources.
Discussion: Preventing unauthorized and unintende d information transfer via shared system resources stops information produced by the actions of prior users or roles (or the actions of processes acting on behalf of prior users or roles) from being available to current users or roles (or current processes acting on behalf of current users or roles) that obtain access to shared system resources after those resources have been releas ed back to the system. Information in shared system resources also applies to encrypted repr esentations of information. In other contexts, control of information in shared system resour ces is referred to as object reuse and residual information protection. Information in shared system resources does not address information remanence, which refers to the residual representation of data that has been nominally deleted; covert channels (including storage and timing channels), where shared system resources are
07/09/2024
CJISSECPOL v5.9.5
175
manipulated to violate information flow restrictions; or components within systems for which there are only single users or roles.
Related Controls: AC-3, AC-4, SA-8.
SC-5 DENIAL-OF-SERVICE PROTECTION
[Priority 2]
Control:
a. Protect against or limit the effects of the following types of denial-of-service events:
distributed denial of service, DNS Denial of Service, etc.; and b. Employ the following controls to achieve the denial-of-service objective: boundary protection devices and intrusion detection or prevention devices.
Discussion: Denial-of-service events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of denial-of-service events. Fo r example, boundary protection devi ces can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of denial-of-service a ttacks. Employing increased ne twork capacity and bandwidth combined with service redundancy also reduces the susceptibility to denial-of-service events.
Related Controls: CP-2, IR-4, SC-7.
SC-7 BOUNDARY PROTECTION
[Existing] [Priority 1]
Control:
a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;
b. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
Discussion: Managed interfaces include gateways, routers, fi rewalls, guards, network-based malicious code analysis, virtua lization systems, or encrypted tunnels implemented within a security architecture. Subnetwor ks that are physically or l ogically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems incl udes restricting external web tr affic to designated web servers within managed interfaces, prohibiting external tr affic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-
07/09/2024
CJISSECPOL v5.9.5
176
189] provides additional in formation on source address validati on techniques to prevent ingress and egress of traffic with s poofed addresses. Co mmercial telecommunica tions services are provided by network components and consolidated management systems shared by customers.
These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is gr eater than a system-sp ecific boundary (i.e., an authorization boundary).
Related Controls: AC-4, AC-17, AC-18, AC-19, AC-20, CA-3, CM-2, CM-4, CM-7, CM-10, CP- 8, CP-10, IR-4, MA-4, PE-3, PL-8, SA-8, SC-5.
Control Enhancements:
(3) BOUNDARY PROTECTION | ACCESS POINTS
[Priority 1]
Control:
Limit the number of external network connections to the system.
Discussion: Limiting the number of external ne twork connections faci litates monitoring of inbound and outbound communications traffic. A Trus ted Internet Connection (TIC) initiative is an example of a federal guideline that requires limits on the number of external network connections. Limiting the number of external netw ork connections to the system is important during transition periods from older to newer te chnologies (e.g., transitioning from IPv4 to IPv6 network protocols). Such transitions may require implementing the older and newer technologies simultaneously during the transiti on period and thus increase the number of access points to the system.
Related Controls: None.
(4) BOUNDARY PROTECTION | EXTERNAL TELECOMMUNICATIONS SERVICES [Priority 1]
Control:
a. Implement a managed interface for each external telecommunication service; b. Establish a traffic flow policy for each managed interface; c. Protect the confidentiality and integrity of the information being transmitted across each interface;
d. Document each exception to the traffic flow policy with a supporting mission or business need and duration of that need;
e. Review exceptions to the traffic flow policy annually, after any incident, and after any major changes impacting the information system, while removing exceptions that are no longer supported by an explicit mission or business need;
f. Prevent unauthorized exchange of control plane traffic with external networks;
07/09/2024
CJISSECPOL v5.9.5
177
g. Publish information to enable remote networks to detect unauthorized control plane traffic from internal networks; and
h. Filter unauthorized control plane traffic from external networks.
Discussion: External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic in clude Border Gateway Pr otocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189] for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.
Related Controls: AC-3, SC-8, SC-20, SC-21, SC-22.
(5) BOUNDARY PROTECTION | DENY BY DEFAULT — ALLOW BY EXCEPTION [Priority 1]
Control:
Deny network communications tra ffic by default and allow networ k communications traffic by exception at boundary devices for information systems used to process, store, or transmit CJI.
Discussion: Denying by defau lt and allowing by exception applies to inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those system connections that are essential and approved are allowed.
Deny by default, allow by exception also applies to a system that is connected to an external system.
Related Controls: None.
(7) BOUNDARY PROTECTION | SPLIT TUNNELING FOR REMOTE DEVICES [Priority 1]
Control:
Prevent split tunneling for remote devices connecting to organizational systems.
Discussion: Split tunneling is the process of allowing a remote user or device to establish a non- remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices and simultaneously, access uncontrolled networks. Split tunne ling might be desirable by remote users to communicate with local system resources, such as printers or file servers.
However, split tunneling can fac ilitate unauthorized external c onnections, making the system vulnerable to attack and to exfiltration of organizational informati on. Split tunneling can be prevented by disabling configuration settings that allow such capability in remote devices and by preventing those configuration settings from being configurable by users. Prevention can also be achieved by the detection of split tunneling (or of configuration settings that allow split tunneling) in the remote device, and by prohibiting the connection if the remote device is using split tunneling.
A virtual private network (VPN) can be used to securely provision a split tunnel. A securely provisioned VPN includes locking connectivity to exclusive, managed, and named environments, or to a specific set of pre-approved addresses, without user control.
Related Controls: None.
07/09/2024
CJISSECPOL v5.9.5
178
(8) BOUNDARY PROTECTION | ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERS [Existing] [Priority 1]
Control:
Route all internal communications traffic that may be proxied, except traffic specifically exempted by organizational personne l with information security respons ibilities, to all untrusted networks through authenticated proxy servers at managed interfaces.
Discussion: External networks are networks outside of organizational control. A proxy server is a server (i.e., system or application) that acts as an intermediary for clients requesting system resources from non-organizational or other organizational servers. System resources that may be requested include files, connections, web pages, or services. Client requests established through a connection to a proxy server are assessed to manage complexity and provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers that provide access to the Internet. Proxy servers can support the logging of Transmission Control Protocol sessions and the blocking of specific Unifor m Resource Locators, Internet Protocol addresses, and domain names. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites. Note that proxy servers may inhibit the use of virtual private networks (VPNs) and create the potentia l for “man-in-the-middle” attacks (depending on the implementation).
Related Controls: AC-3.
(24) BOUNDARY PROTECTION | PERSONALLY IDENTIFIABLE INFORMATION [Priority 1]
Control:
For systems that process personally identifiable information:
a. Apply the following processing rules to data elements of personally identifiable information:
all applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
b. Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system;
c. Document each processing exception; and
d. Review and remove exceptions that are no longer supported.
Discussion: Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifia ble information is processed only in accordance with established privacy requirements.
Related Controls: None.
SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY
[Existing] [Priority 2]
07/09/2024
CJISSECPOL v5.9.5
179
Control:
Protect the confidentiality and integrity of transmitted information.
Metadata derived from unencrypted CJI shall be protected in the same manner as CJI and shall not be used for any advertising or other commercia l purposes by any cloud service provider or other associated entity.
Discussion: Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop co mputers, mobile devices , printers, copiers, scanners, facsimile machines, and radios. Unprot ected communication paths are exposed to the possibility of interception and modification. Protecting the conf identiality and integrity of information can be accomplished by physical or logical means. Physi cal protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques.
Organizations that rely on co mmercial providers who offer tran smission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations dete rmine what types of confidentiality or integrity services are available in standard, commercial tel ecommunications service pa ckages. If it is not feasible to obtain the necessary controls an d assurances of contro l effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.
The agency may permit limited use of metadata derived from unencrypted CJI when specifically approved by the agency and its “intended use” is detailed within the service agreement. Such authorized uses of metadata may include but are not limited to the following: spam and spyware filtering, data loss prevention, spilla ge reporting, transaction logs (events and content–similar to the AU controls), data usage/indexing metrics, and diagnostic/syslog data.
Related Controls: AC-17, AC-18, IA-3, IA-8, MA-4, PE-4, SA-4, SA-8, SC-7, SC-20, SC-23, SC-
28. Control Enhancements:
(1) TRANSMISSION CONFIDENTIALITY AND INTEGRITY | CRYPTOGRAPHIC
PROTECTION
[Existing] [Priority 2]
Control:
Implement cryptographic mechanisms to prevent unauthorized disclosure and detect unauthorized changes or access to CJI during transmission.
Discussion: Encryption protects information from unauthorized disclosure and modification during transmission. Cryptographic mechanisms that protect the confidenti ality and integrity of information during transmission include TLS an d IPSec. Cryptographic mechanisms used to
07/09/2024
CJISSECPOL v5.9.5
180
protect information integrity include cryptographic hash functions that have applications in digital signatures, checksums, and message authentication codes.
Related Controls: SC-12, SC-13.
SC-10 NETWORK DISCONNECT
[Priority 3]
Control:
Terminate the network connection associated with a communications session at the end of the session or after one (1) hour of inactivity.
NOTE: In the interest of safety, devices that are: (1) part of a criminal justice conveyance; or (2) used to perform dispatch functions and located within a physically secure location; or (3) terminals designated solely for the purpose of receiving aler t notifications (i.e., receive only terminals or ROT) and used within physically secure locati on facilities that remain staffed when in operation, are exempt from this requirement.
Discussion: Network disconnect a pplies to internal and external networks. Terminating network connections associated with specific communi cations sessions includes de-allocating TCP/IP address or port pairs at the ope rating system level and de-alloca ting the networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. Periods of inactivity may be establishe d by organizations and include time periods by type of network access or for specific network accesses.
Related Controls: AC-17, SC-23.
SC-12 CRYPTOGRAPHIC KEY ESTABLISHMENT AND MANAGEMENT
[Existing] [Priority 2]
Control:
Establish and manage cr yptographic keys when cryptography is employed within the system in accordance with the following key management requirements: encr yption key generation, distribution, storage, access, and destruction is controlled by the agency.
Discussion: Cryptographic key ma nagement and establishment can be performed using manual procedures or automated mechanisms with suppo rting manual procedures. Organizations define key management requirements in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines and specify appr opriate options, parameters, and levels. Organizations mana ge trust stores to ensure that onl y approved trust anchors are part of such trust stores. This includes certificates with visibility external to organizational systems and certificates related to the internal operations of systems. [NIST CMVP] and [NIST CAVP] provide additional information on validat ed cryptographic modules and algor ithms that can be used in cryptographic key management and establishment.
Related Controls: AC-17, AU-9, CM-3, IA-3, IA-7, SA-4, SA-8, SA-9, SC-8, SC-12, SC-13, SC- 17, SC-20, SI-3, SI-7.
07/09/2024
CJISSECPOL v5.9.5
181
SC-13 CRYPTOGRAPHIC PROTECTION
[Existing] [Priority 2]
Control:
a. Determine the use of encryption for CJI in-transit when outside a physically secure location; and
b. Implement the following types of cryptography required for each specified cryptographic use: cryptographic modules which are Federal Information Processing Standard (FIPS) 140-3 certified, or FIPS validated algorithm for symmetric key encryption and decryption (FIPS 197 [AES]), with a symmetric cipher key of at least 128-bit strength for CJI in-transit.
NOTE: Subsequent versions of approved cryptographic modules that are under current review for FIPS 140-3 compliancy can be used in the inte rim until certification is complete. FIPS 140-2 certificates will not be acceptable after September 21, 2026.
Discussion: Cryptography can be employed to suppor t a variety of security solutions, including the protection of classified information and controlled unclassified information, the provision and implementation of digital signatures, and the enforcement of information separation when authorized individuals have the necessary clearances but lack the necessary formal access approvals. Cryptography can also be used to support random number a nd hash generation.
Generally applicable cryptogr aphic standards include FIPS-v alidated cryptography and NSA- approved cryptography. For example, organizations that need to protect classified information may specify the use of NSA-approved cryptograph y. Organizations that need to provision and implement digital signatures may specify the use of FIPS-v alidated cryptography. Cryptography is implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Related Controls: AC-2, AC-3, AC-7, AC-17, AC-18, AC-19, AU-9, CM-11, CP-9, IA-3, IA-5, IA-7, MA-4, MP-2, MP-4, MP- 5, SA-4, SA-8, SA-9, SC-8, SC -12, SC-20, SC-23, SC-28, SI-3, SI-7.
SC-15 COLLABORATIVE COMPUTING DEVICES AND APPLICATIONS
[Priority 2]
Control:
a. Prohibit remote activation of collaborative computing devices and applications; and b. Provide an explicit indication of use to users physically present at the devices.
Discussion: Collaborative computing devices and applications include remote meeting devices and applications, networked white boa rds, cameras, and microphones. The explicit indication of use includes signals to users when collaborative computing devices and applications are activated.
Related Controls: AC-21.
07/09/2024
CJISSECPOL v5.9.5
182
SC-17 PUBLIC KEY INFRASTRUCTURE CERTIFICATES
[Existing] [Priority 2]
Control:
a. Issue public key certificates under an agency-level certificate authority or obtain public key certificates from an approved service provider; and
b. Include only approved trust anchors in trust stores or certificate stores managed by the organization.
Discussion: Public key infrastructure (PKI) certificates are certificates with visibility external to organizational systems and certificates related to the internal operations of systems, such as application-specific time services. In cryptographic systems with a hierarchical structure, a trust anchor is an authoritative source (i.e., a certifi cate authority) for which trust is assumed and not derived. A root certificate for a PKI system is an example of a trust anchor. A trust store or certificate store maintains a list of trusted root certificates.
Related Controls: IA-5, SC-12.
SC-18 MOBILE CODE
[Priority 3]
Control:
a. Define acceptable and unacceptable mobile code and mobile code technologies; and b. Authorize, monitor, and control the use of mobile code within the system.
Discussion: Mobile code include s any program, application, or c ontent that can be transmitted across a network (e.g., embedded in an email, document, or website) and executed on a remote system. Decisions regarding the us e of mobile code within orga nizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, WebGL, and VBScript. Usage restrictions and implementation guidelines apply to both the se lection and use of mobile code installed on servers and mobile code downloaded and execu ted on individual workstations and devices, including notebook computers and smart phones. M obile code policy and procedures address specific actions taken to prevent the developmen t, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
Related Controls: AU-2, AU-12, CM-2, CM-6, SI-3.
SC-20 SECURE NAME/ADDRESS RESOLUTION SERVICE (AUTHORITATIVE
SOURCE)
[Priority 2]
Control:
07/09/2024
CJISSECPOL v5.9.5
183
a. Provide additional data origin authentication and integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries; and
b. Provide the means to indicate the security status of child zones and (if the child supports secure resolution services) to enable verification of a chain of trust among parent and child domains, when operating as part of a distributed, hierarchical namespace.
Discussion: Providing authoritative source information enables external clients, including remote Internet clients, to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service. Systems that provide name and address resolution services include domai n name system (DNS) servers.
Additional artifacts include DNS Security Extensions (DNSSEC) digital signatures and cryptographic keys. Authoritative data includes DNS resource record s. The means for indicating the security status of child zones include the use of delegation signer resource records in the DNS.
Systems that use technologies other than the DNS to map between host and service names and network addresses provide other means to assure the authenticity and integrity of response data.
Related Controls: SC-8, SC-12, SC-13, SC-21, SC-22.
SC-21 SECURE NAME/ADDRESS RESOLUTION SERVICE (RECURSIVE OR
CACHING RESOLVER)
[Priority 2]
Control:
Request and perform data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources.
Discussion: Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Systems that provide name and address resolution services for local clients include recursive resolving or caching domain name system (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations. Systems that use technologies other than the DNS to map between host and service names and network addresses provide some other means to enable clients to verify the authenticity and integrity of response data.
Related Controls: SC-20, SC-22.
SC-22 ARCHITECTURE AND PROVISIONING FOR NAME/ADDRESS RESOLUTION
SERVICE
[Priority 2]
Control:
Ensure the systems that collectively provide na me/address resolution service for an organization are fault-tolerant and implement internal and external role separation.
07/09/2024
CJISSECPOL v5.9.5
184
Discussion: Systems that provide name and address resolution services include domain name system (DNS) servers. To elimin ate single points of failure in systems and enhance redundancy, organizations employ at least two authoritative do main name system servers—one configured as the primary server and the other configured as the secondary server. Additionally, organizations typically deploy the servers in two geographically separated network subnetworks (i.e., not located in the same physical facility). For role separati on, DNS servers with internal roles only process name and address resolution requests from within organizations (i.e., from internal clients). DNS servers with external roles only process name and address resolution information requests from clients external to organizations (i.e., on external networks, including the Internet). Organizations specify clients that can access authoritative DNS servers in certain roles (e.g., by address ranges and explicit lists).
Related Controls: SC-2, SC-20, SC-21.
SC-23 SESSION AUTHENTICITY
[Priority 2]
Control:
Protect the authenticity of communications sessions.
Discussion: Protecting session au thenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes pr otecting against “man-i n-the-middle” attacks, session hijacking, and the insertion of false information into sessions.
Related Controls: SC-8, SC-10.
SC-28 PROTECTION OF INFORMATION AT REST
[Existing] [Priority 2]
Control:
Protect the confidentiality and integrity of the following information at rest: CJI when outside physically secure locations us ing cryptographic modules which are certified FIPS 140-3 with a symmetric cipher key of at least 128-bit strength, or FIPS 197 with a symmetric cipher key of at least 256-bit strength.
Metadata derived from unencrypted CJI shall be protected in the same manner as CJI and shall not be used for any advertising or other commercia l purposes by any cloud service provider or other associated entity.
The storage of CJI, regardless of encryption status, shall only be permitted in cloud environments (e.g., government or third-party/co mmercial datacenters, etc.) whic h reside within the physical boundaries of APB-member country (i.e., United St ates, U.S. territories, Indian Tribes, and Canada) and are under legal aut hority of an APB-member agency (i.e., United States– federal/state/territory, Indian Tribe, or the Royal Canadian Mounted Police).
07/09/2024
CJISSECPOL v5.9.5
185
Note: This restriction does not apply to exchanges of CJI with foreign government agencies under international exchange agreements (e.g., th e Preventing and Combating Serious Crime agreements, fugitive extracts, and exchanges made for humanitarian and criminal investigatory purposes in particular circumstances).
Discussion: Information at rest refers to the stat e of information when it is not in process or in transit and is located on system components. Such components include internal or external hard disk drives, storage area network devices, or databases. However, the focus of protecting information at rest is not on the type of storag e device or frequency of access but rather on the state of the information. Information at rest addresses the confidenti ality and integrity of information and covers user information and system information. System-related information that requires protection includes confi gurations or rule sets for fi rewalls, intrusion detection and prevention systems, filtering routers, and authen tication information. Organizations may employ different mechanisms to achieve confidentiality and integrity protections, including the use of cryptographic mechanisms and file share scanni ng. Integrity protection can be achieved, for example, by implementing write-once-read-m any (WORM) technologies. When adequate protection of information at rest cannot otherw ise be achieved, organizations may employ other controls, including frequent scanning to identify malicious code at rest and secure offline storage in lieu of online storage. The agency may permit limited use of metadata derived from unencrypted CJI when specifically approved by the agency and its “intended use” is detailed within the service agreement. Such authorized uses of metadata may include but are not limited to the following:
spam and spyware filtering, data loss prevention, spillage reporting, transaction logs (events and content–similar to the AU controls), data usage/indexing metrics, and diagnostic/syslog data.
Related Controls: AC-3, AC- 4, AC-6, AC-19, CA-7, CM-3, CM -5, CM-6, CP-9, MP-4, MP-5, PE-3, SC-8, SC-12, SC-13, SI-3, SI-7, SI-16.
Control Enhancements:
(1) PROTECTION OF INFORMATION AT REST | CRYPTOGRAPHIC PROTECTION [Existing] [Priority 2]
Control:
Implement cryptographic mechanisms to prevent unauthorized disclosure and modification of the following information at rest on information syst ems and digital media outside physically secure locations: CJI.
Discussion: The selection of cr yptographic mechanisms is based on the need to protect the confidentiality and inte grity of organizationa l information. The strength of mechanism is commensurate with the security category or classification of the information. Organizations have the flexibility to encrypt information on system co mponents or media or encrypt data structures, including files, records, or fields.
Related Controls: AC-19, SC-12, SC-13.
07/09/2024
CJISSECPOL v5.9.5
186
SC-39 PROCESS ISOLATION
[Existing] [Priority 2]
Control:
Maintain a separate execution domain for each executing system process.
Discussion: Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one proce ss cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from othe r software, firmware, and data.
Process isolation helps limit the access of potentially untrusted software to other system resources.
The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.
Related Controls: AC-3, AC-4, AC-6, SA-8, SC-2, SI-16.
Figure 13 – System and Communications Protection and Information Integrity Use Cases Use Case 1 – A Local Police Department’s Information Systems & Communications Protections A local police department implemented a replac ement CAD system within a physically secure location that was authorized to process CJI using a FIPS 140-2 encrypted VPN tunnel over the Internet to the state’s CSA. In addition to the policies, physical and personnel controls already in place, the police department employed firewalls both at their border and at key points within their network, intrusion detection systems, a patch-management strategy that included automatic patch updates where possible, vi rus scanners, spam and spywar e detection mechanisms that update signatures automatically, and subscribed to various security alert mailing lists and addressed vulnerabilities raised through the alerts as needed.
Use Case 2 – Faxing from a Single/Multi-function Device over a Traditional Telephone Line A dispatcher from county A runs a NCIC query on an individual. The results are printed and then sent to an adjoining county using a single/mul ti-function device with facsimile capability. For faxing, the device is only connected to a traditional telephone line as is the device at the receiving county. Encryption of a document containing CJI is not required because the document travels over a traditional telephone line.
Use Case 3 – Faxing from a Multi-function Device over a Network
07/09/2024
CJISSECPOL v5.9.5
187
A dispatcher from city A runs a NCIC query on an individual. The results are printed and the dispatcher uses a multi-function c opier to fax the file to a city in another state. The dispatcher enters the fax number of the receiver and sends the document. The document containing CJI is automatically converted to a digital file and rout ed to the receiver over the agency network and the Internet. Because the device uses a ne twork and the Internet for transmitting documents containing CJI, encryption in transit using FI PS 140-2 certified 128 bit symmetric encryption is required.