id: "SC-07(11)" title: "Restrict Incoming Communications Traffic" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-07.11" priority: "P1" implementation_level: "system" parent: "SC-07" enhancement: True
Statement
Only allow incoming communications from {{ insert: param, sc-07.11_odp.01 }} to be routed to {{ insert: param, sc-07.11_odp.02 }}.
Guidance
General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.
Assessment Objective
only incoming communications from {{ insert: param, sc-07.11_odp.01 }} are allowed to be routed to {{ insert: param, sc-07.11_odp.02 }}.
System and communications protection policy
procedures addressing boundary protection
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities
Mechanisms implementing boundary protection capabilities with respect to source/destination address pairs