AC-4: Information Flow Enforcement
Control Family:
Threats Addressed:
Baselines:
- Low
N/A
- Moderate
- AC-4
- High
- AC-4
- (4)
- Privacy
N/A
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- AC-4: Information Flow Enforcement
Control Statement
Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: organization-defined information flow control policies].
Supplemental Guidance
Information flow control regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include blocking external traffic that claims to be from within the organization, keeping export-controlled information from being transmitted in the clear to the Internet, restricting web requests that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between organizations may require an agreement specifying how the information flow is enforced (see CA-3). Transferring information between systems in different security or privacy domains with different security or privacy policies introduces the risk that such transfers violate one or more domain security or privacy policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between connected systems. Organizations consider mandating specific architectural solutions to enforce specific security and privacy policies. Enforcement includes prohibiting information transfers between connected systems (i.e., allowing access only), verifying write permissions before accepting information from another security or privacy domain or connected system, employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels.
Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Organizations also consider the trustworthiness of filtering and/or inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 32 primarily address cross-domain solution needs that focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, such as high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf products. Information flow enforcement also applies to control plane traffic (e.g., routing and DNS).
Control Enhancements
AC-4(1): Object Security and Privacy Attributes
Baseline(s):
Use [Assignment: organization-defined security and privacy attributes] associated with [Assignment: organization-defined information, source, and destination objects] to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
AC-4(2): Processing Domains
Baseline(s):
Use protected processing domains to enforce [Assignment: organization-defined information flow control policies] as a basis for flow control decisions.
AC-4(3): Dynamic Information Flow Control
Baseline(s):
Enforce [Assignment: organization-defined information flow control policies].
AC-4(4): Flow Control of Encrypted Information
Baseline(s):
- High
Prevent encrypted information from bypassing [Assignment: organization-defined information flow control mechanisms] by [Assignment (one or more): decrypting the information, blocking the flow of the encrypted information, terminating communications sessions attempting to pass encrypted information, [Assignment: organization-defined procedure or method] ].
AC-4(5): Embedded Data Types
Baseline(s):
Enforce [Assignment: organization-defined limitations] on embedding data types within other data types.
AC-4(6): Metadata
Baseline(s):
Enforce information flow control based on [Assignment: organization-defined metadata].
AC-4(7): One-way Flow Mechanisms
Baseline(s):
Enforce one-way information flows through hardware-based flow control mechanisms.
AC-4(8): Security and Privacy Policy Filters
Baseline(s):
Enforce information flow control using [Assignment: organization-defined security or privacy policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows]; and [Assignment (one or more): Block, Strip, Modify, Quarantine] data after a filter processing failure in accordance with [Assignment: organization-defined security or privacy policy].
AC-4(9): Human Reviews
Baseline(s):
Enforce the use of human reviews for [Assignment: organization-defined information flows] under the following conditions: [Assignment: organization-defined conditions].
AC-4(10): Enable and Disable Security or Privacy Policy Filters
Baseline(s):
Provide the capability for privileged administrators to enable and disable [Assignment: organization-defined security or privacy policy filters] under the following conditions: [Assignment: organization-defined conditions].
AC-4(11): Configuration of Security or Privacy Policy Filters
Baseline(s):
Provide the capability for privileged administrators to configure [Assignment: organization-defined security or privacy policy filters] to support different security or privacy policies.
AC-4(12): Data Type Identifiers
Baseline(s):
When transferring information between different security domains, use [Assignment: organization-defined data type identifiers] to validate data essential for information flow decisions.
AC-4(13): Decomposition into Policy-relevant Subcomponents
Baseline(s):
When transferring information between different security domains, decompose information into [Assignment: organization-defined policy-relevant subcomponents] for submission to policy enforcement mechanisms.
AC-4(14): Security or Privacy Policy Filter Constraints
Baseline(s):
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] requiring fully enumerated formats that restrict data structure and content.
AC-4(15): Detection of Unsanctioned Information
Baseline(s):
When transferring information between different security domains, examine the information for the presence of [Assignment: organization-defined unsanctioned information] and prohibit the transfer of such information in accordance with the [Assignment: organization-defined security or privacy policy].
AC-4(17): Domain Authentication
Baseline(s):
Uniquely identify and authenticate source and destination points by [Assignment (one or more): organization, system, application, service, individual] for information transfer.
AC-4(19): Validation of Metadata
Baseline(s):
When transferring information between different security domains, implement [Assignment: organization-defined security or privacy policy filters] on metadata.
AC-4(20): Approved Solutions
Baseline(s):
Employ [Assignment: organization-defined solutions in approved configurations] to control the flow of [Assignment: organization-defined information] across security domains.
AC-4(21): Physical or Logical Separation of Information Flows
Baseline(s):
Separate information flows logically or physically using [Assignment: organization-defined mechanisms and/or techniques] to accomplish [Assignment: organization-defined required separations by types of information].
AC-4(22): Access Only
Baseline(s):
Provide access from a single device to computing platforms, applications, or data residing in multiple different security domains, while preventing information flow between the different security domains.
AC-4(23): Modify Non-releasable Information
Baseline(s):
When transferring information between different security domains, modify non-releasable information by implementing [Assignment: organization-defined modification action].
AC-4(24): Internal Normalized Format
Baseline(s):
When transferring information between different security domains, parse incoming data into an internal normalized format and regenerate the data to be consistent with its intended specification.
AC-4(25): Data Sanitization
Baseline(s):
When transferring information between different security domains, sanitize data to minimize [Assignment (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography encoded data, spillage of sensitive information] in accordance with [Assignment: organization-defined policy]].
AC-4(26): Audit Filtering Actions
Baseline(s):
When transferring information between different security domains, record and audit content filtering actions and results for the information being filtered.
AC-4(27): Redundant/independent Filtering Mechanisms
Baseline(s):
When transferring information between different security domains, implement content filtering solutions that provide redundant and independent filtering mechanisms for each data type.
AC-4(28): Linear Filter Pipelines
Baseline(s):
When transferring information between different security domains, implement a linear content filter pipeline that is enforced with discretionary and mandatory access controls.
AC-4(29): Filter Orchestration Engines
Baseline(s):
When transferring information between different security domains, employ content filter orchestration engines to ensure that: Content filtering mechanisms successfully complete execution without errors; and Content filtering actions occur in the correct order and comply with [Assignment: organization-defined policy].
AC-4(30): Filter Mechanisms Using Multiple Processes
Baseline(s):
When transferring information between different security domains, implement content filtering mechanisms using multiple processes.
AC-4(31): Failed Content Transfer Prevention
Baseline(s):
When transferring information between different security domains, prevent the transfer of failed content to the receiving domain.
AC-4(32): Process Requirements for Information Transfer
Baseline(s):
When transferring information between different security domains, the process that transfers information between filter pipelines: Does not filter message content; Validates filtering metadata; Ensures the content associated with the filtering metadata has successfully completed filtering; and Transfers the content to the destination filter pipeline.