NIST 800-172
3.13 SYSTEM AND COMMUNICATIONS PROTECTION
3.13.4e
Employ [Selection: (one or more): [Assignment: organization-defined physical isolation techniques]; [Assignment: organization-defined logical isolation techniques]] in organizational systems and system components.
A mix of physical and logical isolation techniques (described below) implemented as part of the system architecture can limit the unauthorized flow of CUI reduce the system attack surface constrain the number of system components that must be secure and impede the movement of an adversary. When implemented with a set of managed interfaces physical and logical isolation techniques for organizational systems and components can isolate CUI into separate security domains where additional protections can be implemented. Any communications across the managed interfaces (i.e. across security domains) including for management or administrative purposes constitutes remote access even if the communications remain within the organization. Separating system components with boundary protection mechanisms allows for the increased protection of individual components and more effective control of information flows between those components. This enhanced protection limits the potential harm from and susceptibility to hostile cyber-attacks and errors. The degree of isolation can vary depending on the boundary protection mechanisms selected. Boundary protection mechanisms include routers gateways and firewalls separating system components into physically separate networks or subnetworks; virtualization and micro-virtualization techniques; encrypting information flows among system components using distinct encryption keys; cross-domain devices separating subnetworks; and complete physical separation (i.e. air gaps). System architectures include logical isolation partial physical and logical isolation or complete physical isolation between subsystems and at system boundaries between resources that store process transmit or protect CUI and other resources. Examples include: • Logical isolation: Data tagging digital rights management (DRM) and data loss prevention (DLP) that tags monitors and restricts the flow of CUI; virtual machines or containers that separate CUI and other information on hosts; and virtual local area networks (VLAN) that keep CUI and other information separate on networks. • Partial physical and logical isolation: Physically or cryptographically isolated networks dedicated hardware in data centers and secure clients that (a) may not directly access resources outside of the domain (i.e. all applications with cross-enclave connectivity execute as remote virtual applications hosted in a demilitarized zone [DMZ] or internal and protected enclave) (b) access via remote virtualized applications or virtual desktop with no file transfer capability other than with dual authorization or (c) employ dedicated client hardware (e.g. a zero or thin client) or hardware approved for multi-level secure (MLS) usage. • Complete physical isolation: Dedicated (not shared) client and server hardware; physically isolated stand-alone enclaves for clients and servers; and (a) logically separate network traffic (e.g. using a VLAN) with end-to-end encryption using Public Key Infrastructure (PKI)-based cryptography or (b) physical isolation from other networks. Isolation techniques are selected based on a risk management perspective that balances the threat the information being protected and the cost of the options for protection. Architectural and design decisions are guided and informed by the security requirements and selected solutions. Organizations consider the trustworthiness of the isolation techniques employed (e.g. the logical isolation relies on information technology that could be considered a high value target because of the function being performed) introducing its own set of vulnerabilities. [SP 800-160-1] provides guidance on developing trustworthy secure and cyber resilient systems using systems security engineering practices and security design concepts.
Click here to Start your FREE trial today!
What is a Cybersecurity Compliance Framework?
You don’t need to clutter your security and privacy programs with an ever-increasing number of tools as they become more sophisticated. The Lionfish platform offers a one-stop solution to track progress and monitor any framework, from custom-built ones to highly-specialized and in-demand top security and privacy frameworks and certifications.
With the Lionfish platform, every framework is supported with guided scoping, policies, controls, automated evidence collection, and continuous monitoring, ensuring efficient preparation for audits or attestation in minimal time.
The Lionfish platform is compatible with a wide range of security and privacy frameworks, including:
- CMMC v2
- HIPAA
- NERC CIP-002 through CIP-014 Revision 6
- NIST 800-171
- NIST 800-172
- PCI (Payment Card Industry Security Standard)
- SOC 2
- NIST 800-53
- NIST SP800-161 Supply Chain Risk Management
- NIST-CSF
- CIS Framework Controls V8
Click here to Start your FREE trial today!