Navigate

SC-18

SC-18: Mobile Code

The organization:

a: Defines acceptable and unacceptable mobile code and mobile code technologies;

b: Establishes usage restrictions and implementation guidance for acceptable mobile code and mobile code technologies; and

c: Authorizes, monitors, and controls the use of mobile code within the information system.

Supplemental

Decisions regarding the employment of mobile code within organizational information systems are based on the potential for the code to cause damage to the systems if used maliciously. Mobile code technologies include, for example, Java, JavaScript, ActiveX, Postscript, PDF, Shockwave movies, Flash animations, and VBScript. Usage restrictions and implementation guidance apply to both the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices (e.g., smart phones). Mobile code policy and procedures address preventing the development, acquisition, or introduction of unacceptable mobile code within organizational information systems.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
DE.CM-5

Related Controls

The controls below (if any) were marked by NIST as being related to SC-18.

Control	Description
AU-2	The organization: a: Determines that the information system is capable of auditing the following events: [organization-defined auditable events]; b: Coordinates the security audit function with other organizational entities requiring audit-related information to enhance mutual support and to help guide the selection of auditable events; c: Provides a rationale for why the auditable events are deemed to be adequate to support after-the-fact investigations of security incidents; and d: Determines that the following events are to be audited within the information system: [organization-defined audited events (the subset of the auditable events defined in AU-2 a.) along with the frequency of (or situation requiring) auditing for each identified event].
AU-12	The information system: a: Provides audit record generation capability for the auditable events defined in AU-2 a. at [organization-defined information system components]; b: Allows [organization-defined personnel or roles] to select which auditable events are to be audited by specific components of the information system; and c: Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
CM-2	The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
CM-6	The organization: a: Establishes and documents configuration settings for information technology products employed within the information system using [organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; b: Implements the configuration settings; c: Identifies, documents, and approves any deviations from established configuration settings for [organization-defined information system components] based on [organization-defined operational requirements]; and d: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
SI-3	The organization: a: Employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code; b: Updates malicious code protection mechanisms whenever new releases are available in accordance with organizational configuration management policy and procedures; c: Configures malicious code protection mechanisms to: 1: Perform periodic scans of the information system [organization-defined frequency] and real-time scans of files from external sources at [one or more of endpoint/network entry/exit points] as the files are downloaded, opened, or executed in accordance with organizational security policy; and 2: [one or more of block malicious code/quarantine malicious code/send alert to administrator/ {{ insert: param, si-3_prm_4 }} ] in response to malicious code detection; and d: Addresses the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availability of the information system.

Enhancements

The controls below (if any) add on to the requirements of SC-18.

Control	Description
SC-18(1)	The information system identifies [organization-defined unacceptable mobile code] and takes [organization-defined corrective actions].
SC-18(2)	The organization ensures that the acquisition, development, and use of mobile code to be deployed in the information system meets [organization-defined mobile code requirements].
SC-18(3)	The information system prevents the download and execution of [organization-defined unacceptable mobile code].
SC-18(4)	The information system prevents the automatic execution of mobile code in [organization-defined software applications] and enforces [organization-defined actions] prior to executing the code.
SC-18(5)	The organization allows execution of permitted mobile code only in confined virtual machine environments.

Related CCIs

The CCIs below are tied to SC-18.

CCI	Definition
CCI-001160	Defines acceptable and unacceptable mobile code and mobile code technologies.
CCI-001161	The organization establishes usage restrictions for acceptable mobile code and mobile code technologies.
CCI-001162	The organization establishes implementation guidance for acceptable mobile code and mobile code technologies.
CCI-001163	Authorize the use of mobile code within the system.
CCI-001164	Monitor the use of mobile code within the system.
CCI-001165	Control the use of mobile code within the system.