id: "SA-08(18)" title: "Trusted Communications Channels" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-08.18" priority: "P1" implementation_level: "system" parent: "SA-08" enhancement: True
Statement
Implement the security design principle of trusted communications channels in {{ insert: param, sa-08.18_odp }}.
Guidance
The principle of trusted communication channels states that when composing a system where there is a potential threat to communications between components (i.e., the interconnections between components), each communication channel is trustworthy to a level commensurate with the security dependencies it supports (i.e., how much it is trusted by other components to perform its security functions). Trusted communication channels are achieved by a combination of restricting access to the communication channel (to ensure an acceptable match in the trustworthiness of the endpoints involved in the communication) and employing end-to-end protections for the data transmitted over the communication channel (to protect against interception and modification and to further increase the assurance of proper end-to-end communication).
Assessment Objective
{{ insert: param, sa-08.18_odp }} implement the security design principle of trusted communications channels.
System and services acquisition policy
procedures addressing the security design principle of trusted communications channels used in the specification, design, development, implementation, and modification of the system
system design documentation
security and privacy requirements and specifications for the system
system security and privacy architecture
system security plan
other relevant documents or records
Organizational personnel with the responsibility for determining system security and privacy requirements
organizational personnel with system specification, design, development, implementation, and modification responsibilities
system developers
organizational personnel with information security responsibilities
Organizational processes for applying the security design principle of trusted communications channels in system specification, design, development, implementation, and modification
mechanisms supporting the application of the security design principle of trusted communications channels in system specification, design, development, implementation, and modification