id: "SC-48" title: "Sensor Relocation" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-48" priority: "P1" implementation_level: "system" enhancements: - sc-48.1
Statement
Relocate {{ insert: param, sc-48_odp.01 }} to {{ insert: param, sc-48_odp.02 }} under the following conditions or circumstances: {{ insert: param, sc-48_odp.03 }}.
Guidance
Adversaries may take various paths and use different approaches as they move laterally through an organization (including its systems) to reach their target or as they attempt to exfiltrate information from the organization. The organization often only has a limited set of monitoring and detection capabilities, and they may be focused on the critical or likely infiltration or exfiltration paths. By using communications paths that the organization typically does not monitor, the adversary can increase its chances of achieving its desired goals. By relocating its sensors or monitoring capabilities to new locations, the organization can impede the adversary’s ability to achieve its goals. The relocation of the sensors or monitoring capabilities might be done based on threat information that the organization has acquired or randomly to confuse the adversary and make its lateral transition through the system or organization more challenging.
Assessment Objective
{{ insert: param, sc-48_odp.01 }} are relocated to {{ insert: param, sc-48_odp.02 }} under {{ insert: param, sc-48_odp.03 }}.
System and communications protection policy
procedures addressing sensor and monitoring capability relocation
list of sensors/monitoring capabilities to be relocated
change control records
configuration management records
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
Mechanisms supporting and/or implementing sensor relocation