SC-7: Boundary Protection
Control Family:
Threats Addressed:
Next Version:
- NIST Special Publication 800-53 Revision 5:
- SC-7: Boundary Protection
Control Statement
The information system:
- Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system;
- Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and
- Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.
Supplemental Guidance
Managed interfaces include, for example, gateways, routers, firewalls, guards, network-based malicious code analysis and virtualization systems, or encrypted tunnels implemented within a security architecture (e.g., routers protecting firewalls or application gateways residing on protected subnetworks). Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational information systems includes, for example, restricting external web traffic to designated web servers within managed interfaces and prohibiting external traffic that appears to be spoofing internal addresses. Organizations consider the shared nature of commercial telecommunications services in the implementation of security controls associated with the use of such services. Commercial telecommunications services are commonly based on network components and consolidated management systems shared by all attached commercial customers, and may also include third party-provided access lines and other service elements. Such transmission services may represent sources of increased risk despite contract security provisions.
Control Enhancements
SC-7(3): Access Points
Baseline(s):
- Moderate
- High
The organization limits the number of external network connections to the information system.
SC-7(4): External Telecommunications Services
Baseline(s):
- Moderate
- High
The organization: Implements a managed interface for each external telecommunication service; Establishes a traffic flow policy for each managed interface; Protects the confidentiality and integrity of the information being transmitted across each interface; Documents each exception to the traffic flow policy with a supporting mission/business need and duration of that need; and Reviews exceptions to…
SC-7(5): Deny By Default / Allow By Exception
Baseline(s):
- Moderate
- High
The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
SC-7(7): Prevent Split Tunneling For Remote Devices
Baseline(s):
- Moderate
- High
The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.
SC-7(8): Route Traffic To Authenticated Proxy Servers
Baseline(s):
- High
The information system routes [Assignment: organization-defined internal communications traffic] to [Assignment: organization-defined external networks] through authenticated proxy servers at managed interfaces.
SC-7(9): Restrict Threatening Outgoing Communications Traffic
Baseline(s):
The information system: Detects and denies outgoing communications traffic posing a threat to external information systems; and Audits the identity of internal users associated with denied communications.
SC-7(10): Prevent Unauthorized Exfiltration
Baseline(s):
The organization prevents the unauthorized exfiltration of information across managed interfaces.
SC-7(11): Restrict Incoming Communications Traffic
Baseline(s):
The information system only allows incoming communications from [Assignment: organization-defined authorized sources] to be routed to [Assignment: organization-defined authorized destinations].
SC-7(12): Host-Based Protection
Baseline(s):
The organization implements [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined information system components].
SC-7(13): Isolation Of Security Tools / Mechanisms / Support Components
Baseline(s):
The organization isolates [Assignment: organization-defined information security tools, mechanisms, and support components] from other internal information system components by implementing physically separate subnetworks with managed interfaces to other components of the system.
SC-7(14): Protects Against Unauthorized Physical Connections
Baseline(s):
The organization protects against unauthorized physical connections at [Assignment: organization-defined managed interfaces].
SC-7(15): Route Privileged Network Accesses
Baseline(s):
The information system routes all networked, privileged accesses through a dedicated, managed interface for purposes of access control and auditing.
SC-7(16): Prevent Discovery Of Components / Devices
Baseline(s):
The information system prevents discovery of specific system components composing a managed interface.
SC-7(17): Automated Enforcement Of Protocol Formats
Baseline(s):
The information system enforces adherence to protocol formats.
SC-7(18): Fail Secure
Baseline(s):
- High
The information system fails securely in the event of an operational failure of a boundary protection device.
SC-7(19): Blocks Communication From Non-Organizationally Configured Hosts
Baseline(s):
The information system blocks both inbound and outbound communications traffic between [Assignment: organization-defined communication clients] that are independently configured by end users and external service providers.
SC-7(20): Dynamic Isolation / Segregation
Baseline(s):
The information system provides the capability to dynamically isolate/segregate [Assignment: organization-defined information system components] from other components of the system.
SC-7(21): Isolation Of Information System Components
Baseline(s):
- High
The organization employs boundary protection mechanisms to separate [Assignment: organization-defined information system components] supporting [Assignment: organization-defined missions and/or business functions].
SC-7(22): Separate Subnets For Connecting To Different Security Domains
Baseline(s):
The information system implements separate network addresses (i.e., different subnets) to connect to systems in different security domains.
SC-7(23): Disable Sender Feedback On Protocol Validation Failure
Baseline(s):
The information system disables feedback to senders on protocol format validation failure.