AC-4 — Information Flow Enforcement

Information flow enforcement mechanisms compare security and privacy attributes associated with information (i.e., data content and structure) and source and destination objects and respond appropriately when the enforcement mechanisms encounter information flows not explicitly allowed by information flow policies. For example, an information object labeled Secret would be allowed to flow to a destination object labeled Secret, but an information object labeled Top Secret would not be allowed to flow to a destination object labeled Secret. A dataset of personally identifiable information may be tagged with restrictions against combining with other types of datasets and, thus, would not be allowed to flow to the restricted dataset. Security and privacy attributes can also include source and destination addresses employed in traffic filter firewalls. Flow enforcement using explicit security or privacy attributes can be used, for example, to control the release of certain types of information.

1. AC-04(01)[01][Organization-defined: security attributes] associated with [Organization-defined: information objects], [Organization-defined: source objects] , and [Organization-defined: destination objects] are used to enforce [Organization-defined: information flow control policies] as a basis for flow control decisions;
2. AC-04(01)[02][Organization-defined: privacy attributes] associated with [Organization-defined: information objects], [Organization-defined: source objects] , and [Organization-defined: destination objects] are used to enforce [Organization-defined: information flow control policies] as a basis for flow control decisions.

Protected processing domains within systems are processing spaces that have controlled interactions with other processing spaces, enabling control of information flows between these spaces and to/from information objects. A protected processing domain can be provided, for example, by implementing domain and type enforcement. In domain and type enforcement, system processes are assigned to domains, information is identified by types, and information flows are controlled based on allowed information accesses (i.e., determined by domain and type), allowed signaling among domains, and allowed process transitions to other domains.

protected processing domains are used to enforce [Organization-defined: information flow control policies] as a basis for flow control decisions.

Organizational policies regarding dynamic information flow control include allowing or disallowing information flows based on changing conditions or mission or operational considerations. Changing conditions include changes in risk tolerance due to changes in the immediacy of mission or business needs, changes in the threat environment, and detection of potentially harmful or adverse events.

[Organization-defined: information flow control policies] are enforced.

Flow control mechanisms include content checking, security policy filters, and data type identifiers. The term encryption is extended to cover encoded data not recognized by filtering mechanisms.

encrypted information is prevented from bypassing [Organization-defined: information flow control mechanisms] by [Organization-defined: ac-04.04_odp.02].

Embedding data types within other data types may result in reduced flow control effectiveness. Data type embedding includes inserting files as objects within other files and using compressed or archived data types that may include multiple embedded data types. Limitations on data type embedding consider the levels of embedding and prohibit levels of data type embedding that are beyond the capability of the inspection tools.

[Organization-defined: limitations] are enforced on embedding data types within other data types.

Metadata is information that describes the characteristics of data. Metadata can include structural metadata describing data structures or descriptive metadata describing data content. Enforcement of allowed information flows based on metadata enables simpler and more effective flow control. Organizations consider the trustworthiness of metadata regarding data accuracy (i.e., knowledge that the metadata values are correct with respect to the data), data integrity (i.e., protecting against unauthorized changes to metadata tags), and the binding of metadata to the data payload (i.e., employing sufficiently strong binding techniques with appropriate assurance).

information flow control enforcement is based on [Organization-defined: metadata].

One-way flow mechanisms may also be referred to as a unidirectional network, unidirectional security gateway, or data diode. One-way flow mechanisms can be used to prevent data from being exported from a higher impact or classified domain or system while permitting data from a lower impact or unclassified domain or system to be imported.

one-way information flows are enforced through hardware-based flow control mechanisms.

Organization-defined security or privacy policy filters can address data structures and content. For example, security or privacy policy filters for data structures can check for maximum file lengths, maximum field sizes, and data/file types (for structured and unstructured data). Security or privacy policy filters for data content can check for specific words, enumerated values or data value ranges, and hidden content. Structured data permits the interpretation of data content by applications. Unstructured data refers to digital information without a data structure or with a data structure that does not facilitate the development of rule sets to address the impact or classification level of the information conveyed by the data or the flow enforcement decisions. Unstructured data consists of bitmap objects that are inherently non-language-based (i.e., image, video, or audio files) and textual objects that are based on written or printed languages. Organizations can implement more than one security or privacy policy filter to meet information flow control objectives.

1. AC-04(08)(a)
   1. AC-04(08)(a)[01]information flow control is enforced using [Organization-defined: security policy filter] as a basis for flow control decisions for [Organization-defined: information flows];
   2. AC-04(08)(a)[02]information flow control is enforced using [Organization-defined: privacy policy filter] as a basis for flow control decisions for [Organization-defined: information flows];
2. AC-04(08)(b)[Organization-defined: ac-04.08_odp.05] data after a filter processing failure in accordance with [Organization-defined: security policy]; [Organization-defined: ac-04.08_odp.05] data after a filter processing failure in accordance with [Organization-defined: privacy policy].

Organizations define security or privacy policy filters for all situations where automated flow control decisions are possible. When a fully automated flow control decision is not possible, then a human review may be employed in lieu of or as a complement to automated security or privacy policy filtering. Human reviews may also be employed as deemed necessary by organizations.

human reviews are used for [Organization-defined: information flows] under [Organization-defined: conditions].

For example, as allowed by the system authorization, administrators can enable security or privacy policy filters to accommodate approved data types. Administrators also have the capability to select the filters that are executed on a specific data flow based on the type of data that is being transferred, the source and destination security domains, and other security or privacy relevant features, as needed.

1. AC-04(10)[01]capability is provided for privileged administrators to enable and disable [Organization-defined: security filters] under [Organization-defined: conditions];
2. AC-04(10)[02]capability is provided for privileged administrators to enable and disable [Organization-defined: privacy filters] under [Organization-defined: conditions].

Documentation contains detailed information for configuring security or privacy policy filters. For example, administrators can configure security or privacy policy filters to include the list of inappropriate words that security or privacy policy mechanisms check in accordance with the definitions provided by organizations.

1. AC-04(11)[01]capability is provided for privileged administrators to configure [Organization-defined: security policy filters] to support different security or privacy policies;
2. AC-04(11)[02]capability is provided for privileged administrators to configure [Organization-defined: privacy policy filters] to support different security or privacy policies.

Data type identifiers include filenames, file types, file signatures or tokens, and multiple internal file signatures or tokens. Systems only allow transfer of data that is compliant with data type format specifications. Identification and validation of data types is based on defined specifications associated with each allowed data format. The filename and number alone are not used for data type identification. Content is validated syntactically and semantically against its specification to ensure that it is the proper data type.

when transferring information between different security domains, [Organization-defined: data type identifiers] are used to validate data essential for information flow decisions.

Decomposing information into policy-relevant subcomponents prior to information transfer facilitates policy decisions on source, destination, certificates, classification, attachments, and other security- or privacy-related component differentiators. Policy enforcement mechanisms apply filtering, inspection, and/or sanitization rules to the policy-relevant subcomponents of information to facilitate flow enforcement prior to transferring such information to different security domains.

when transferring information between different security domains, information is decomposed into [Organization-defined: policy-relevant subcomponents] for submission to policy enforcement mechanisms.

Data structure and content restrictions reduce the range of potential malicious or unsanctioned content in cross-domain transactions. Security or privacy policy filters that restrict data structures include restricting file sizes and field lengths. Data content policy filters include encoding formats for character sets, restricting character data fields to only contain alpha-numeric characters, prohibiting special characters, and validating schema structures.

1. AC-04(14)[01]when transferring information between different security domains, implemented [Organization-defined: security policy filters] require fully enumerated formats that restrict data structure and content;
2. AC-04(14)[02]when transferring information between different security domains, implemented [Organization-defined: privacy policy filters] require fully enumerated formats that restrict data structure and content.

Unsanctioned information includes malicious code, information that is inappropriate for release from the source network, or executable code that could disrupt or harm the services or systems on the destination network.

1. AC-04(15)[01]when transferring information between different security domains, information is examined for the presence of [Organization-defined: unsanctioned information];
2. AC-04(15)[02]when transferring information between different security domains, transfer of [Organization-defined: unsanctioned information] is prohibited in accordance with the [Organization-defined: security policy];
3. AC-04(15)[03]when transferring information between different security domains, transfer of [Organization-defined: unsanctioned information] is prohibited in accordance with the [Organization-defined: privacy policy].

Attribution is a critical component of a security and privacy concept of operations. The ability to identify source and destination points for information flowing within systems allows the forensic reconstruction of events and encourages policy compliance by attributing policy violations to specific organizations or individuals. Successful domain authentication requires that system labels distinguish among systems, organizations, and individuals involved in preparing, sending, receiving, or disseminating information. Attribution also allows organizations to better maintain the lineage of personally identifiable information processing as it flows through systems and can facilitate consent tracking, as well as correction, deletion, or access requests from individuals.

source and destination points are uniquely identified and authenticated by [Organization-defined: ac-04.17_odp] for information transfer.

All information (including metadata and the data to which the metadata applies) is subject to filtering and inspection. Some organizations distinguish between metadata and data payloads (i.e., only the data to which the metadata is bound). Other organizations do not make such distinctions and consider metadata and the data to which the metadata applies to be part of the payload.

1. AC-04(19)[01]when transferring information between different security domains, [Organization-defined: security policy filters] are implemented on metadata;
2. AC-04(19)[02]when transferring information between different security domains, [Organization-defined: privacy policy filters] are implemented on metadata.

Organizations define approved solutions and configurations in cross-domain policies and guidance in accordance with the types of information flows across classification boundaries. The National Security Agency (NSA) National Cross Domain Strategy and Management Office provides a listing of approved cross-domain solutions. Contact [ncdsmo@nsa.gov](mailto:ncdsmo@nsa.gov) for more information.

[Organization-defined: solutions in approved configurations] are employed to control the flow of [Organization-defined: information] across security domains.

Enforcing the separation of information flows associated with defined types of data can enhance protection by ensuring that information is not commingled while in transit and by enabling flow control by transmission paths that are not otherwise achievable. Types of separable information include inbound and outbound communications traffic, service requests and responses, and information of differing security impact or classification levels.

1. AC-04(21)[01]information flows are separated logically using [Organization-defined: mechanisms and/or techniques] to accomplish [Organization-defined: required separations];
2. AC-04(21)[02]information flows are separated physically using [Organization-defined: mechanisms and/or techniques] to accomplish [Organization-defined: required separations].

The system provides a capability for users to access each connected security domain without providing any mechanisms to allow users to transfer data or information between the different security domains. An example of an access-only solution is a terminal that provides a user access to information with different security classifications while assuredly keeping the information separate.

access is provided from a single device to computing platforms, applications, or data that reside in multiple different security domains while preventing information flow between the different security domains.

Modifying non-releasable information can help prevent a data spill or attack when information is transferred across security domains. Modification actions include masking, permutation, alteration, removal, or redaction.

when transferring information between security domains, non-releasable information is modified by implementing [Organization-defined: modification action].

Converting data into normalized forms is one of most of effective mechanisms to stop malicious attacks and large classes of data exfiltration.

1. AC-04(24)[01]when transferring information between different security domains, incoming data is parsed into an internal, normalized format;
2. AC-04(24)[02]when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.

Data sanitization is the process of irreversibly removing or destroying data stored on a memory device (e.g., hard drives, flash memory/solid state drives, mobile devices, CDs, and DVDs) or in hard copy form.

when transferring information between different security domains, data is sanitized to minimize [Organization-defined: ac-04.25_odp.01] in accordance with [Organization-defined: policy].

Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. Content filtering actions and the results of filtering actions are recorded for individual messages to ensure that the correct filter actions were applied. Content filter reports are used to assist in troubleshooting actions by, for example, determining why message content was modified and/or why it failed the filtering process. Audit events are defined in [AU-2](#au-2) . Audit records are generated in [AU-12](#au-12).

1. AC-04(26)[01]when transferring information between different security domains, content-filtering actions are recorded and audited;
2. AC-04(26)[02]when transferring information between different security domains, results for the information being filtered are recorded and audited.

Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. Redundant and independent content filtering eliminates a single point of failure filtering system. Independence is defined as the implementation of a content filter that uses a different code base and supporting libraries (e.g., two JPEG filters using different vendors’ JPEG libraries) and multiple, independent system processes.

when transferring information between security domains, implemented content filtering solutions provide redundant and independent filtering mechanisms for each data type.

Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined policy. The use of linear content filter pipelines ensures that filter processes are non-bypassable and always invoked. In general, the use of parallel filtering architectures for content filtering of a single data type introduces bypass and non-invocation issues.

when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.

Content filtering is the process of inspecting information as it traverses a cross-domain solution and determines if the information meets a predefined security policy. An orchestration engine coordinates the sequencing of activities (manual and automated) in a content filtering process. Errors are defined as either anomalous actions or unexpected termination of the content filter process. This is not the same as a filter failing content due to non-compliance with policy. Content filter reports are a commonly used mechanism to ensure that expected filtering actions are completed successfully.

1. AC-04(29)(a)when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering mechanisms successfully complete execution without errors;
2. AC-04(29)(b)
   1. AC-04(29)(b)[01]when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions occur in the correct order;
   2. AC-04(29)(b)[02]when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions comply with [Organization-defined: policy].

The use of multiple processes to implement content filtering mechanisms reduces the likelihood of a single point of failure.

when transferring information between security domains, content-filtering mechanisms using multiple processes are implemented.

Content that failed filtering checks can corrupt the system if transferred to the receiving domain.

when transferring information between different security domains, the transfer of failed content to the receiving domain is prevented.

The processes transferring information between filter pipelines have minimum complexity and functionality to provide assurance that the processes operate correctly.

1. AC-04(32)(a)when transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content;
2. AC-04(32)(b)when transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata;
3. AC-04(32)(c)when transferring information between different security domains, the process that transfers information between filter pipelines ensures that the content with the filtering metadata has successfully completed filtering;
4. AC-04(32)(d)when transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.