AC-17 Remote Access

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	Organization	7 (4 in a baseline)

Related controls: AC-2, AC-3, AC-4, AC-18, AC-19, AC-20, CA-3, CM-10, IA-2, IA-3, IA-8, MA-4, PE-17, PL-2, PL-4, SC-10, SC-12, SC-13, SI-4

Control statement

• a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and
• b. Authorize each type of remote access to the system prior to allowing such connections.

NIST discussion

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of CA-3 . Enforcing access restrictions for remote access is addressed via AC-3.

Control enhancements

AC-17(1) Monitoring and Control

Baselines: Moderate, High

Employ automated mechanisms to monitor and control remote access methods.

Discussion and assessment objectives for AC-17(1)

Monitoring and control of remote access methods allows organizations to detect attacks and help ensure compliance with remote access policies by auditing the connection activities of remote users on a variety of system components, including servers, notebook computers, workstations, smart phones, and tablets. Audit logging for remote access is enforced by AU-2 . Audit events are defined in AU-2a.

Determine if:

• AC-17(01)[01] automated mechanisms are employed to monitor remote access methods;
• AC-17(01)[02] automated mechanisms are employed to control remote access methods.

Examine: Access control policy; procedures addressing remote access to the system; system design documentation; system configuration settings and associated documentation; system audit records; system monitoring records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Automated mechanisms monitoring and controlling remote access methods.

AC-17(2) Protection of Confidentiality and Integrity Using Encryption

Baselines: Moderate, High

Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.

Discussion and assessment objectives for AC-17(2)

Virtual private networks can be used to protect the confidentiality and integrity of remote access sessions. Transport Layer Security (TLS) is an example of a cryptographic protocol that provides end-to-end communications security over networks and is used for Internet communications and online transactions.

Determine if cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.

Examine: Access control policy; procedures addressing remote access to the system; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Cryptographic mechanisms protecting confidentiality and integrity of remote access sessions.

AC-17(3) Managed Access Control Points

Baselines: Moderate, High

Route remote accesses through authorized and managed network access control points.

Discussion and assessment objectives for AC-17(3)

Organizations consider the Trusted Internet Connections (TIC) initiative DHS TIC requirements for external network connections since limiting the number of access control points for remote access reduces attack surfaces.

Determine if remote accesses are routed through authorized and managed network access control points.

Examine: Access control policy; procedures addressing remote access to the system; system design documentation; list of all managed network access control points; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms routing all remote accesses through managed network access control points.

AC-17(4) Privileged Commands and Access

Baselines: Moderate, High

• (a) Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs] ; and
• (b) Document the rationale for remote access in the security plan for the system.

Discussion and assessment objectives for AC-17(4)

Remote access to systems represents a significant potential vulnerability that can be exploited by adversaries. As such, restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and the susceptibility to threats by adversaries to the remote access capability.

Determine if:

• AC-17(04)(a)
  • AC-17(04)(a)[01] the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[02] access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[03] the execution of privileged commands via remote access is authorized only for the following needs: [Assignment: organization-defined needs requiring remote access];
  • AC-17(04)(a)[04] access to security-relevant information via remote access is authorized only for the following needs: [Assignment: organization-defined needs requiring remote access];
• AC-17(04)(b) the rationale for remote access is documented in the security plan for the system.

Examine: Access control policy; procedures addressing remote access to the system; system configuration settings and associated documentation; security plan; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities.

Test: Mechanisms implementing remote access management.

AC-17(6) Protection of Mechanism Information

Baselines: Not in a baseline

Protect information about remote access mechanisms from unauthorized use and disclosure.

Discussion and assessment objectives for AC-17(6)

Remote access to organizational information by non-organizational entities can increase the risk of unauthorized use and disclosure about remote access mechanisms. The organization considers including remote access requirements in the information exchange agreements with other organizations, as applicable. Remote access requirements can also be included in rules of behavior (see PL-4 ) and access agreements (see PS-6).

Determine if information about remote access mechanisms is protected from unauthorized use and disclosure.

Examine: Access control policy; procedures addressing remote access to the system; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for implementing or monitoring remote access to the system; system users with knowledge of information about remote access mechanisms; organizational personnel with information security responsibilities.

AC-17(9) Disconnect or Disable Access

Baselines: Not in a baseline

Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].

Discussion and assessment objectives for AC-17(9)

The speed of system disconnect or disablement varies based on the criticality of missions or business functions and the need to eliminate immediate or future remote access to systems.

Determine if the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period] is provided.

Examine: Access control policy; procedures addressing disconnecting or disabling remote access to the system; system design documentation; system configuration settings and associated documentation; security plan, system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Mechanisms implementing capability to disconnect or disable remote access to system.

AC-17(10) Authenticate Remote Commands

Baselines: Not in a baseline

Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].

Discussion and assessment objectives for AC-17(10)

Authenticating remote commands protects against unauthorized commands and the replay of authorized commands. The ability to authenticate remote commands is important for remote systems for which loss, malfunction, misdirection, or exploitation would have immediate or serious consequences, such as injury, death, property damage, loss of high value assets, failure of mission or business functions, or compromise of classified or controlled unclassified information. Authentication mechanisms for remote commands ensure that systems accept and execute commands in the order intended, execute only authorized commands, and reject unauthorized commands. Cryptographic mechanisms can be used, for example, to authenticate remote commands.

Determine if [Assignment: organization-defined mechanisms] are implemented to authenticate [Assignment: organization-defined remote commands].

Examine: Access control policy; procedures addressing authentication of remote commands; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developers.

Test: Mechanisms implementing authentication of remote commands.

Withdrawn enhancements: AC-17(5), AC-17(7), AC-17(8).

Assessment objectives (SP 800-53A)

Objectives and methods for AC-17

Determine if:

• AC-17a.
  • AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed;
  • AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed;
  • AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed;
• AC-17b. each type of remote access to the system is authorized prior to allowing such connections.

Examine: Access control policy; procedures addressing remote access implementation and usage (including restrictions); configuration management plan; system configuration settings and associated documentation; remote access authorizations; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for managing remote access connections; system/network administrators; organizational personnel with information security responsibilities.

Test: Remote access management capability for the system.

Policy statement

• The Chief Information Security Officer shall establish and document usage restrictions, configuration and connection requirements, and implementation guidance for each type of remote access allowed. (AC-17a)
• The System owner shall authorize each type of remote access to the system before allowing such connections. (AC-17b)

AC-17(1) Remote access monitoring and control

• The System owner shall employ automated mechanisms to monitor and control remote access methods. (AC-17(1))

AC-17(2) Protection of confidentiality and integrity using encryption

• The System owner shall ensure cryptographic mechanisms protect the confidentiality and integrity of remote access sessions. (AC-17(2))

AC-17(3) Managed access control points

• The System owner shall ensure remote access is routed through authorized and managed network access control points. (AC-17(3))

AC-17(4) Remote privileged commands and access

• The System owner shall authorize the execution of privileged commands via remote access only for Fill in: needs requiring execution of privileged commands via remote access Typical: emergency administration outside business hours and administration of cloud-hosted components, and only in a format that provides assessable evidence. (AC-17(4)(a))
• The System owner shall authorize access to security-relevant information via remote access only for Fill in: needs requiring access to security-relevant information via remote access Typical: investigation of security incidents, and only in a format that provides assessable evidence. (AC-17(4)(a))
• The System owner shall document the rationale for such remote access in the system security plan. (AC-17(4)(b))

From the Access Control Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

AC-17 asks you to decide which kinds of remote access you allow, write down the rules for each, and authorize each kind before anyone uses it. The Moderate enhancements then require that remote access is monitored, encrypted, routed through managed entry points, and restricted for privileged work.

Common implementations. A remote access standard that lists the allowed methods, such as an organization-managed VPN, a zero trust access service or a remote desktop gateway, with the multi-factor authentication and device requirements for each. All remote sessions enter through those managed points (AC-17(3)), are encrypted (AC-17(2)), and are logged and alerted on centrally (AC-17(1)). Remote administration is limited and documented in the security plan (AC-17(4)).

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Needs allowing remote privileged commands (AC-17(4))	Emergency administration outside business hours and administration of cloud-hosted components
Needs allowing remote access to security-relevant information (AC-17(4))	Investigation of security incidents

Evidence assessors ask for.

• The remote access standard or policy listing allowed methods and requirements
• The authorization for each remote access method in the system security plan
• VPN or access gateway configuration showing encryption and multi-factor authentication
• Logs of remote sessions and the alerts built on them

Inheritance. The VPN or access service is usually a common control; the system owns which remote access it permits and any remote administration.

Common findings.

• Remote desktop or administrative ports exposed directly to the internet.
• Vendor remote access tools installed outside the approved methods.
• Remote access logs collected but never reviewed.
• Split tunneling allowed without a documented decision.

Enhancements in the Moderate baseline. AC-17(1) monitoring and control, AC-17(2) encryption, AC-17(3) managed access control points and AC-17(4) privileged commands and access.

Artifacts

• Access Control Decision Worksheet
• Access Control Policy
• Remote Access Standard