3.4.2e

Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, [Selection (one or more): remove the components; place the components in a quarantine or remediation network] to facilitate patching, re-configuration, or other mitigations.

DISCUSSION

System components used to process, store, transmit, or protect CUI are monitored and checked against the authoritative source (i.e., hardware and software inventory and associated baseline configurations). From an automated assessment perspective, the system description provided by the authoritative source is referred to as the desired state. Using automated tools, the desired state is compared to the actual state to check for compliance or deviations. Security responses to system components that are unknown or that deviate from approved configurations can include removing the components; halting system functions or processing; placing the system components in a quarantine or remediation network that facilitates patching, re-configuration, or other mitigations; or issuing alerts and/or notifications to personnel when there is an unauthorized modification of an organization-defined configuration item. Responses can be automated, manual, or procedural. Components that are removed from the system are rebuilt from the trusted configuration baseline established by the authoritative source. [IR 8011-1] provides guidance on using automation support to assess system configurations.

PROTECTION STRATEGY

Penetration-Resistant Architecture.

ADVERSARY EFFECTS

See [SP 800-160-2]: [Preclude (Expunge, Preempt); Impede (Contain); Expose (Detect)].

ASSESSMENT OBJECTIVE

Determine if:

3.4.2e_ODP[1] One or more of the following is/are selected: remove the components; place the components in a quarantine or remediation network.

3.4.2e[a] Automated mechanisms to detect misconfigured or unauthorized system components are identified.

3.4.2e[b] Automated mechanisms are employed to detect misconfigured or unauthorized system components.

3.4.2e[c] Misconfigured or unauthorized system components are detected.

3.4.2e[d] After detection, system components are <3.4.2.e_ODP[1]: removed and/or placed in a quarantine or remediation network> to facilitate patching, re-configuration, or other mitigations.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; authoritative source or repository; enterprise architecture documentation; system design documentation; system architecture and configuration documentation; system procedures addressing system configuration change control; configuration settings and associated documentation; change control records; change control audit and review reports; agenda/minutes from configuration change control oversight meetings; alerts/notifications of unauthorized baseline configuration changes; security plan; system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for configuration management; organizational personnel responsible for information security; organizational personnel responsible for configuration change control; system developers; system/network administrators; members of a change control board or similar roles].

Test: [SELECT FROM: Automated mechanisms supporting configuration control of the baseline configuration; automated mechanisms that implement security responses to changes to the baseline configurations; automated mechanisms that implement configuration change control; automated mechanisms that detect misconfigured or unauthorized system components].