id: "SA-08(17)" title: "Secure Distributed Composition" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-08.17" priority: "P1" implementation_level: "system" parent: "SA-08" enhancement: True
Statement
Implement the security design principle of secure distributed composition in {{ insert: param, sa-08.17_odp }}.
Guidance
The principle of secure distributed composition states that the composition of distributed components that enforce the same system security policy result in a system that enforces that policy at least as well as the individual components do. Many of the design principles for secure systems deal with how components can or should interact. The need to create or enable a capability from the composition of distributed components can magnify the relevancy of these principles. In particular, the translation of security policy from a stand-alone to a distributed system or a system-of-systems can have unexpected or emergent results. Communication protocols and distributed data consistency mechanisms help to ensure consistent policy enforcement across a distributed system. To ensure a system-wide level of assurance of correct policy enforcement, the security architecture of a distributed composite system is thoroughly analyzed.
Assessment Objective
{{ insert: param, sa-08.17_odp }} implement the security design principle of secure distributed composition.
System and services acquisition policy
procedures addressing the security design principle of secure distributed composition used in the specification, design, development, implementation, and modification of the system
system design documentation
security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
other relevant documents or records
Organizational personnel with the responsibility for determining system security and privacy requirements
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
organizational personnel with information security responsibilities
Organizational processes for applying the security design principle of secure distributed composition in system specification, design, development, implementation, and modification
mechanisms supporting the application of the security design principle of secure distributed composition in system specification, design, development, implementation, and modification