id: "SI-10(06)" title: "Injection Prevention" family: "SI" family_name: "System and Information Integrity" sort_id: "si-10.06" priority: "P1" implementation_level: "system" parent: "SI-10" enhancement: True
Statement
Prevent untrusted data injections.
Guidance
Untrusted data injections may be prevented using a parameterized interface or output escaping (output encoding). Parameterized interfaces separate data from code so that injections of malicious or unintended data cannot change the semantics of commands being sent. Output escaping uses specified characters to inform the interpreter’s parser whether data is trusted. Prevention of untrusted data injections are with respect to the information inputs defined by the organization in the base control ( SI-10).
Assessment Objective
untrusted data injections are prevented.
System and information integrity policy
system and information integrity procedures
procedures addressing information input validation
system design documentation
system configuration settings and associated documentation
list of trusted sources for information inputs
list of acceptable formats for input restrictions
system audit records
system security plan
other relevant documents or records
Organizational personnel responsible for information input validation
organizational personnel with information security responsibilities
system/network administrators
system developer
Organizational processes for preventing untrusted data injections
automated mechanisms supporting and/or implementing injection prevention