id: "SI-20" title: "Tainting" family: "SI" family_name: "System and Information Integrity" sort_id: "si-20" priority: "P1" implementation_level: "system"
Statement
Embed data or capabilities in the following systems or system components to determine if organizational data has been exfiltrated or improperly removed from the organization: {{ insert: param, si-20_odp }}.
Guidance
Many cyber-attacks target organizational information, or information that the organization holds on behalf of other entities (e.g., personally identifiable information), and exfiltrate that data. In addition, insider attacks and erroneous user procedures can remove information from the system that is in violation of the organizational policies. Tainting approaches can range from passive to active. A passive tainting approach can be as simple as adding false email names and addresses to an internal database. If the organization receives email at one of the false email addresses, it knows that the database has been compromised. Moreover, the organization knows that the email was sent by an unauthorized entity, so any packets it includes potentially contain malicious code, and that the unauthorized entity may have potentially obtained a copy of the database. Another tainting approach can include embedding false data or steganographic data in files to enable the data to be found via open-source analysis. Finally, an active tainting approach can include embedding software in the data that is able to "call home," thereby alerting the organization to its "capture," and possibly its location, and the path by which it was exfiltrated or removed.
Assessment Objective
data or capabilities are embedded in {{ insert: param, si-20_odp }} to determine if organizational data has been exfiltrated or improperly removed from the organization.
System and information integrity policy
system and information integrity procedures
personally identifiable information processing policy
procedures addressing software and information integrity
system design documentation
system configuration settings and associated documentation
policy and procedures addressing the systems security engineering technique of deception
system security plan
privacy plan
other relevant documents or records
Organizational personnel responsible for detecting tainted data
organizational personnel with systems security engineering responsibilities
organizational personnel with information security and privacy responsibilities
Automated mechanisms for post-breach detection
decoys, traps, lures, and methods for deceiving adversaries
detection and notification mechanisms