CM-7 PR.PT-3 Least GSA has established a series of hardening guides and security benchmarks OCISO Semiannually Functionality for commonly used technologies (e.g., operating systems, database Oversight management systems) with defined standard configuration settings which using are designed to prohibit non-secure, risky functions, ports, protocols, and Automated services. System’s specific functions, ports, protocols, as services are defined Tools during development and then operation, as deemed appropriate by the AO. GSA uses CDM tools (e.g., BigFix, Tenable) to verify systems comply with the hardening guides and only have essential functions, ports, protocols, and services enabled. CM-7 (1) PR.PT-3, Least GSA has established a series of hardening guides and security benchmarks OCISO Semiannually Functionality | for commonly used technologies (e.g., operating systems, database Oversight Periodic Review management systems) with defined standard configuration settings which using are designed to limit unnecessary functionality (e.g., functions, ports, Automated protocols, and services). Tools GSA uses CDM tools (e.g., BigFix, Tenable) to verify systems comply with the hardening guides and do not have unnecessary functions, ports, services enabled. CM-7 (2) PR.PT-3 Least GSA’s Hardening Guides and Security Benchmarks were developed to OCISO Semiannually Functionality | configure systems only install, configure, and permit required programs on Oversight Prevent them. using Program Automated Execution GSA uses Bit9 and Tripwire to prevent unauthorized programs from Tools executing. If these tools or other ISCM/CDM tools do not identify the program as allowed to execute, its execution will be prevented. CM-7 (4) PR.PT-3 Least Software blacklisting tools identify software by a digital fingerprint and deny OCISO Semiannually Functionality | software on the blacklist from executing. Oversight Authorized using Software / GSA uses Bit9 and Tripwire to implement application blacklisting to defend Automated Blacklisting against zero-day and APT threats. Tools
CM-7 PR.PT-3 Least Functionality GSA has established a series of hardening guides and security benchmarks for commonly used technologies (e.g., operating systems, database management systems) with defined standard configuration settings which are designed to prohibit non-secure, risky functions, ports, protocols, and services. System’s specific functions, ports, protocols, as services are defined during development and then operation, as deemed appropriate by the AO. GSA uses CDM tools (e.g., BigFix, Tenable) to verify systems comply with the hardening guides and only have essential functions, ports, protocols, and services enabled. OCISO Oversight using Automated Tools Semiannually CM-7 (1) PR.PT-3, Least Functionality | Periodic Review GSA has established a series of hardening guides and security benchmarks for commonly used technologies (e.g., operating systems, database management systems) with defined standard configuration settings which are designed to limit unnecessary functionality (e.g., functions, ports, protocols, and services). GSA uses CDM tools (e.g., BigFix, Tenable) to verify systems comply with the hardening guides and do not have unnecessary functions, ports, services enabled. OCISO Oversight using Automated Tools Semiannually CM-7 (2) PR.PT-3 Least Functionality | Prevent Program Execution GSA’s Hardening Guides and Security Benchmarks were developed to configure systems only install, configure, and permit required programs on them. GSA uses Bit9 and Tripwire to prevent unauthorized programs from executing. If these tools or other ISCM/CDM tools do not identify the program as allowed to execute, its execution will be prevented. OCISO Oversight using Automated Tools Semiannually CM-7 (4) PR.PT-3 Least Functionality | Authorized Software / Blacklisting Software blacklisting tools identify software by a digital fingerprint and deny software on the blacklist from executing. GSA uses Bit9 and Tripwire to implement application blacklisting to defend against zero-day and APT threats. OCISO Oversight using Automated Tools Semiannually