id: "SC-07(09)" title: "Restrict Threatening Outgoing Communications Traffic" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.09" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True
Detect and deny outgoing communications traffic posing a threat to external systems; and
Audit the identity of internal users associated with denied communications.
Guidance
Detecting outgoing communications traffic from internal actions that may pose threats to external systems is known as extrusion detection. Extrusion detection is carried out within the system at managed interfaces. Extrusion detection includes the analysis of incoming and outgoing communications traffic while searching for indications of internal threats to the security of external systems. Internal threats to external systems include traffic indicative of denial-of-service attacks, traffic with spoofed source addresses, and traffic that contains malicious code. Organizations have criteria to determine, update, and manage identified threats related to extrusion detection.
Assessment Objective: outgoing communications traffic posing a threat to external systems is detected;
Assessment Objective: outgoing communications traffic posing a threat to external systems is denied;
Assessment Objective: the identity of internal users associated with denied communications is audited.
System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
Mechanisms implementing boundary protection capabilities
mechanisms implementing the detection and denial of threatening outgoing communications traffic
mechanisms implementing auditing of outgoing communications traffic