SC-7 — Boundary Protection

Limiting the number of external network connections facilitates monitoring of inbound and outbound communications traffic. The Trusted Internet Connection [DHS TIC](#4f42ee6e-86cc-403b-a51f-76c2b4f81b54) initiative is an example of a federal guideline that requires limits on the number of external network connections. Limiting the number of external network connections to the system is important during transition periods from older to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols). Such transitions may require implementing the older and newer technologies simultaneously during the transition period and thus increase the number of access points to the system.

the number of external network connections to the system is limited.

External telecommunications services can provide data and/or voice communications services. Examples of control plane traffic include Border Gateway Protocol (BGP) routing, Domain Name System (DNS), and management protocols. See [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) for additional information on the use of the resource public key infrastructure (RPKI) to protect BGP routes and detect unauthorized BGP announcements.

1. SC-07(04)(a)a managed interface is implemented for each external telecommunication service;
2. SC-07(04)(b)a traffic flow policy is established for each managed interface;
3. SC-07(04)(c)
   1. SC-07(04)(c)[01]the confidentiality of the information being transmitted across each interface is protected;
   2. SC-07(04)(c)[02]the integrity of the information being transmitted across each interface is protected;
4. SC-07(04)(d)each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need;
5. SC-07(04)(e)
   1. SC-07(04)(e)[01]exceptions to the traffic flow policy are reviewed [Organization-defined: frequency];
   2. SC-07(04)(e)[02]exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed;
6. SC-07(04)(f)unauthorized exchanges of control plan traffic with external networks are prevented;
7. SC-07(04)(g)information is published to enable remote networks to detect unauthorized control plane traffic from internal networks;
8. SC-07(04)(h)unauthorized control plane traffic is filtered from external networks.

Denying by default and allowing by exception applies to inbound and outbound network communications traffic. A deny-all, permit-by-exception network communications traffic policy ensures that only those system connections that are essential and approved are allowed. Deny by default, allow by exception also applies to a system that is connected to an external system.

1. SC-07(05)[01]network communications traffic is denied by default [Organization-defined: sc-07.05_odp.01];
2. SC-07(05)[02]network communications traffic is allowed by exception [Organization-defined: sc-07.05_odp.01].

Split tunneling is the process of allowing a remote user or device to establish a non-remote connection with a system and simultaneously communicate via some other connection to a resource in an external network. This method of network access enables a user to access remote devices and simultaneously, access uncontrolled networks. Split tunneling might be desirable by remote users to communicate with local system resources, such as printers or file servers. However, split tunneling can facilitate unauthorized external connections, making the system vulnerable to attack and to exfiltration of organizational information. Split tunneling can be prevented by disabling configuration settings that allow such capability in remote devices and by preventing those configuration settings from being configurable by users. Prevention can also be achieved by the detection of split tunneling (or of configuration settings that allow split tunneling) in the remote device, and by prohibiting the connection if the remote device is using split tunneling. A virtual private network (VPN) can be used to securely provision a split tunnel. A securely provisioned VPN includes locking connectivity to exclusive, managed, and named environments, or to a specific set of pre-approved addresses, without user control.

split tunneling is prevented for remote devices connecting to organizational systems unless the split tunnel is securely provisioned using [Organization-defined: safeguards].

External networks are networks outside of organizational control. A proxy server is a server (i.e., system or application) that acts as an intermediary for clients requesting system resources from non-organizational or other organizational servers. System resources that may be requested include files, connections, web pages, or services. Client requests established through a connection to a proxy server are assessed to manage complexity and provide additional protection by limiting direct connectivity. Web content filtering devices are one of the most common proxy servers that provide access to the Internet. Proxy servers can support the logging of Transmission Control Protocol sessions and the blocking of specific Uniform Resource Locators, Internet Protocol addresses, and domain names. Web proxies can be configured with organization-defined lists of authorized and unauthorized websites. Note that proxy servers may inhibit the use of virtual private networks (VPNs) and create the potential for "man-in-the-middle" attacks (depending on the implementation).

[Organization-defined: internal communications traffic] is routed to [Organization-defined: external networks] through authenticated proxy servers at managed interfaces.

Detecting outgoing communications traffic from internal actions that may pose threats to external systems is known as extrusion detection. Extrusion detection is carried out within the system at managed interfaces. Extrusion detection includes the analysis of incoming and outgoing communications traffic while searching for indications of internal threats to the security of external systems. Internal threats to external systems include traffic indicative of denial-of-service attacks, traffic with spoofed source addresses, and traffic that contains malicious code. Organizations have criteria to determine, update, and manage identified threats related to extrusion detection.

1. SC-07(09)(a)
   1. SC-07(09)(a)[01]outgoing communications traffic posing a threat to external systems is detected;
   2. SC-07(09)(a)[02]outgoing communications traffic posing a threat to external systems is denied;
2. SC-07(09)(b)the identity of internal users associated with denied communications is audited.

Prevention of exfiltration applies to both the intentional and unintentional exfiltration of information. Techniques used to prevent the exfiltration of information from systems may be implemented at internal endpoints, external boundaries, and across managed interfaces and include adherence to protocol formats, monitoring for beaconing activity from systems, disconnecting external network interfaces except when explicitly needed, employing traffic profile analysis to detect deviations from the volume and types of traffic expected, call backs to command and control centers, conducting penetration testing, monitoring for steganography, disassembling and reassembling packet headers, and using data loss and data leakage prevention tools. Devices that enforce strict adherence to protocol formats include deep packet inspection firewalls and Extensible Markup Language (XML) gateways. The devices verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices that operate at the network or transport layers. The prevention of exfiltration is similar to data loss prevention or data leakage prevention and is closely associated with cross-domain solutions and system guards that enforce information flow requirements.

1. SC-07(10)(a)the exfiltration of information is prevented;
2. SC-07(10)(b)exfiltration tests are conducted [Organization-defined: frequency].

General source address validation techniques are applied to restrict the use of illegal and unallocated source addresses as well as source addresses that should only be used within the system. The restriction of incoming communications traffic provides determinations that source and destination address pairs represent authorized or allowed communications. Determinations can be based on several factors, including the presence of such address pairs in the lists of authorized or allowed communications, the absence of such address pairs in lists of unauthorized or disallowed pairs, or meeting more general rules for authorized or allowed source and destination pairs. Strong authentication of network addresses is not possible without the use of explicit security protocols, and thus, addresses can often be spoofed. Further, identity-based incoming traffic restriction methods can be employed, including router access control lists and firewall rules.

only incoming communications from [Organization-defined: authorized sources] are allowed to be routed to [Organization-defined: authorized destinations].

Host-based boundary protection mechanisms include host-based firewalls. System components that employ host-based boundary protection mechanisms include servers, workstations, notebook computers, and mobile devices.

[Organization-defined: host-based boundary protection mechanisms] are implemented at [Organization-defined: system components].

Physically separate subnetworks with managed interfaces are useful in isolating computer network defenses from critical operational processing networks to prevent adversaries from discovering the analysis and forensics techniques employed by organizations.

[Organization-defined: information security tools, mechanisms, and support components] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

Systems that operate at different security categories or classification levels may share common physical and environmental controls, since the systems may share space within the same facilities. In practice, it is possible that these separate systems may share common equipment rooms, wiring closets, and cable distribution paths. Protection against unauthorized physical connections can be achieved by using clearly identified and physically separated cable trays, connection frames, and patch panels for each side of managed interfaces with physical access controls that enforce limited authorized access to these items.

[Organization-defined: managed interfaces] are protected against unauthorized physical connections.

Privileged access provides greater accessibility to system functions, including security functions. Adversaries attempt to gain privileged access to systems through remote access to cause adverse mission or business impacts, such as by exfiltrating information or bringing down a critical system capability. Routing networked, privileged access requests through a dedicated, managed interface further restricts privileged access for increased access control and auditing.

1. SC-07(15)[01]networked, privileged accesses are routed through a dedicated, managed interface for purposes of access control;
2. SC-07(15)[02]networked, privileged accesses are routed through a dedicated, managed interface for purposes of auditing.

Preventing the discovery of system components representing a managed interface helps protect network addresses of those components from discovery through common tools and techniques used to identify devices on networks. Network addresses are not available for discovery and require prior knowledge for access. Preventing the discovery of components and devices can be accomplished by not publishing network addresses, using network address translation, or not entering the addresses in domain name systems. Another prevention technique is to periodically change network addresses.

the discovery of specific system components that represent a managed interface is prevented.

System components that enforce protocol formats include deep packet inspection firewalls and XML gateways. The components verify adherence to protocol formats and specifications at the application layer and identify vulnerabilities that cannot be detected by devices operating at the network or transport layers.

adherence to protocol formats is enforced.

Fail secure is a condition achieved by employing mechanisms to ensure that in the event of operational failures of boundary protection devices at managed interfaces, systems do not enter into unsecure states where intended security properties no longer hold. Managed interfaces include routers, firewalls, and application gateways that reside on protected subnetworks (commonly referred to as demilitarized zones). Failures of boundary protection devices cannot lead to or cause information external to the devices to enter the devices nor can failures permit unauthorized information releases.

systems are prevented from entering unsecure states in the event of an operational failure of a boundary protection device.

Communication clients independently configured by end users and external service providers include instant messaging clients and video conferencing software and applications. Traffic blocking does not apply to communication clients that are configured by organizations to perform authorized functions.

1. SC-07(19)[01]inbound communications traffic is blocked between [Organization-defined: communication clients] that are independently configured by end users and external service providers;
2. SC-07(19)[02]outbound communications traffic is blocked between [Organization-defined: communication clients] that are independently configured by end users and external service providers.

The capability to dynamically isolate certain internal system components is useful when it is necessary to partition or separate system components of questionable origin from components that possess greater trustworthiness. Component isolation reduces the attack surface of organizational systems. Isolating selected system components can also limit the damage from successful attacks when such attacks occur.

the capability to dynamically isolate [Organization-defined: system components] from other system components is provided.

Organizations can isolate system components that perform different mission or business functions. Such isolation limits unauthorized information flows among system components and provides the opportunity to deploy greater levels of protection for selected system components. Isolating system components with boundary protection mechanisms provides the capability for increased protection of individual system components and to more effectively control information flows between those components. Isolating system components provides enhanced protection that limits the potential harm from hostile cyber-attacks and errors. The degree of isolation varies depending upon the mechanisms chosen. Boundary protection mechanisms include routers, gateways, and firewalls that separate system components into physically separate networks or subnetworks; cross-domain devices that separate subnetworks; virtualization techniques; and the encryption of information flows among system components using distinct encryption keys.

boundary protection mechanisms are employed to isolate [Organization-defined: system components] supporting [Organization-defined: missions and/or business functions].

The decomposition of systems into subnetworks (i.e., subnets) helps to provide the appropriate level of protection for network connections to different security domains that contain information with different security categories or classification levels.

separate network addresses are implemented to connect to systems in different security domains.

Disabling feedback to senders when there is a failure in protocol validation format prevents adversaries from obtaining information that would otherwise be unavailable.

feedback to senders is disabled on protocol format validation failure.

Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.

1. SC-07(24)(a)[Organization-defined: processing rules] are applied to data elements of personally identifiable information on systems that process personally identifiable information;
2. SC-07(24)(b)
   1. SC-07(24)(b)[01]permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
   2. SC-07(24)(b)[02]permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;
3. SC-07(24)(c)each processing exception is documented for systems that process personally identifiable information;
4. SC-07(24)(d)
   1. SC-07(24)(d)[01]exceptions for systems that process personally identifiable information are reviewed;
   2. SC-07(24)(d)[02]exceptions for systems that process personally identifiable information that are no longer supported are removed.

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified national security systems and external networks.

the direct connection of [Organization-defined: unclassified national security system] to an external network without the use of [Organization-defined: boundary protection device] is prohibited.

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between classified national security systems and external networks. In addition, approved boundary protection devices (typically managed interface or cross-domain systems) provide information flow enforcement from systems to external networks.

the direct connection of classified national security system to an external network without the use of a [Organization-defined: boundary protection device] is prohibited.

A direct connection is a dedicated physical or virtual connection between two or more systems. Organizations typically do not have complete control over external networks, including the Internet. Boundary protection devices (e.g., firewalls, gateways, and routers) mediate communications and information flows between unclassified non-national security systems and external networks.

the direct connection of [Organization-defined: unclassified, non-national security system] to an external network without the use of a [Organization-defined: boundary protection device] is prohibited.

A direct connection is a dedicated physical or virtual connection between two or more systems. A public network is a network accessible to the public, including the Internet and organizational extranets with public access.

the direct connection of the [Organization-defined: system] to a public network is prohibited.

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

subnetworks are separated [Organization-defined: sc-07.29_odp.01] to isolate [Organization-defined: critical system components and functions].