Detections
Analytics
800-53|SC-7(10)
Title
PREVENT UNAUTHORIZED EXFILTRATIONDescription
The organization prevents the unauthorized exfiltration of information across managed interfaces.Supplemental
Safeguards implemented by organizations to prevent unauthorized exfiltration of information from information systems include, for example: (i) strict adherence to protocol formats; (ii) monitoring for beaconing from information systems; (iii) monitoring for steganography; (iv) disconnecting external network interfaces except when explicitly needed; (v) disassembling and reassembling packet headers; and (vi) employing traffic profile analysis to detect deviations from the volume/types of traffic expected within organizations or call backs to command and control centers. Devices enforcing strict adherence to protocol formats include, for example, deep packet inspection firewalls and XML gateways. These devices verify adherence to protocol formats and specification at the application layer and serve to identify vulnerabilities that cannot be detected by devices operating at the network or transport layers. This control enhancement is closely associated with cross-domain solutions and system guards enforcing information flow requirements.Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: SI-3
Category: SYSTEM AND COMMUNICATIONS PROTECTION
Parent Title: BOUNDARY PROTECTION
Family: SYSTEM AND COMMUNICATIONS PROTECTION
Audit Items
View all Reference Audit Items