SC-30 Concealment and Misdirection. Employ the following concealment and misdirection techniques for [organization-defined] at [organization-defined] to confuse and mislead adversaries: [organization-defined]
Concealment and Misdirection. Employ the following concealment and misdirection techniques for [organization-defined] at [organization-defined] to confuse and mislead adversaries: [organization-defined].
system holds itEvidence a system already holds
- Configuration or design evidence implementing each technique · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Records of adversary activity observed or misdirected during the period · Document repository
- Evidence the techniques do not impair legitimate operation or troubleshooting · Document repository
governing documentDocuments that govern the control
- The defined concealment and misdirection techniques employed, and the systems and time periods they apply to · Document repository
- Rationale linking each technique to the adversary behaviour it is intended to confuse · Document repository
First move
Common gaps auditors find
- Technique deployed permanently rather than at the defined times, so an adversary can characterise and discount it
- Concealment breaks legitimate monitoring, so operators disable it quietly
- No observation of effect, so it is impossible to say whether the technique does anything
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-29 Heterogeneity. Employ a diverse set of information technologies for the following system components in the implementation of the system: [organization-defined] · SC-31 Covert Channel Analysis. Perform a covert channel analysis to identify those aspects of communications within the system that are potential avenues for covert [organization-defined] channels; and Estimate the maximum bandwidth of those channels