Title

Application data protection requirements must be identified and documented. (Cat II impact)

Discussion

Failure to protect organizational information from data mining may result in a compromise of information. In order to assign the appropriate data protections, application data must be identified and then protection requirements assigned. Access to sensitive data and sensitive data objects should be restricted to those authorized to access the data. Examples of sensitive data include but are not limited to; Social Security Numbers, Personally Identifiable Information, or any other data that is has been identified as being sensitive in nature by the data owner. Data storage objects include, for example, databases, database records, and database fields. Data mining prevention and detection techniques include, for example: limiting the types of responses provided to database queries; limiting the number/frequency of database queries to increase the work factor needed to determine the contents of such databases; and notifying organizational personnel when atypical database queries or accesses occur. Protection methods include but are not limited to data encryption, Role-Based Access Controls and access authentication.

Check Content

Ask the application representative for the documentation that identifies the application data elements, the protection requirements, and any associated steps that are being taken to protect the data. If the application data protection requirements are not documented, this is a finding.

Fix Text

Identify and document the application data elements and the data protection requirements.

Additional Identifiers

Rule ID: SV-222423r879700_rule

Vulnerability ID: V-222423

Group Title: SRG-APP-000323

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.