SC-15 Collaborative Computing Devices and Applications

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High	System	3 (0 in a baseline)

Related controls: AC-21, SC-42

Control statement

• a. Prohibit remote activation of collaborative computing devices and applications with the following exceptions: [Assignment: organization-defined exceptions where remote activation is to be allowed] ; and
• b. Provide an explicit indication of use to users physically present at the devices.

NIST discussion

Collaborative computing devices and applications include remote meeting devices and applications, networked white boards, cameras, and microphones. The explicit indication of use includes signals to users when collaborative computing devices and applications are activated.

Control enhancements

SC-15(1) Physical or Logical Disconnect

Baselines: Not in a baseline

Provide [Selection (one or more): physical; logical] disconnect of collaborative computing devices in a manner that supports ease of use.

Discussion and assessment objectives for SC-15(1)

Failing to disconnect from collaborative computing devices can result in subsequent compromises of organizational information. Providing easy methods to disconnect from such devices after a collaborative computing session ensures that participants carry out the disconnect activity without having to go through complex and tedious procedures. Disconnect from collaborative computing devices can be manual or automatic.

Determine if the [Selection (one or more): physical; logical] disconnect of collaborative computing devices is/are provided in a manner that supports ease of use.

Examine: System and communications protection policy; procedures addressing collaborative computing; access control policy and procedures; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with responsibilities for managing collaborative computing devices.

Test: Mechanisms supporting and/or implementing the physical disconnect of collaborative computing devices.

SC-15(3) Disabling and Removal in Secure Work Areas

Baselines: Not in a baseline

Disable or remove collaborative computing devices and applications from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].

Discussion and assessment objectives for SC-15(3)

Failing to disable or remove collaborative computing devices and applications from systems or system components can result in compromises of information, including eavesdropping on conversations. A Sensitive Compartmented Information Facility (SCIF) is an example of a secure work area.

Determine if collaborative computing devices and applications are disabled or removed from [Assignment: organization-defined systems or system components] in [Assignment: organization-defined secure work areas].

Examine: System and communications protection policy; procedures addressing collaborative computing; access control policy and procedures; system design documentation; system configuration settings and associated documentation; system audit records; list of secure work areas; systems or system components in secured work areas where collaborative computing devices are to be disabled or removed; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing collaborative computing devices.

Test: Mechanisms supporting and/or implementing the capability to disable collaborative computing devices.

SC-15(4) Explicitly Indicate Current Participants

Baselines: Not in a baseline

Provide an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences].

Discussion and assessment objectives for SC-15(4)

Explicitly indicating current participants prevents unauthorized individuals from participating in collaborative computing sessions without the explicit knowledge of other participants.

Determine if an explicit indication of current participants in [Assignment: organization-defined online meetings and teleconferences] is provided.

Examine: System and communications protection policy; procedures addressing collaborative computing; access control policy and procedures; system design documentation; system configuration settings and associated documentation; system audit records; list of types of meetings and teleconferences requiring explicit indication of current participants; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with responsibilities for managing collaborative computing devices.

Test: Mechanisms supporting and/or implementing the capability to indicate participants on collaborative computing devices.

Withdrawn enhancements: SC-15(2).

Assessment objectives (SP 800-53A)

Objectives and methods for SC-15

Determine if:

• SC-15a. remote activation of collaborative computing devices and applications is prohibited except [Assignment: organization-defined exceptions where remote activation is to be allowed];
• SC-15b. an explicit indication of use is provided to users physically present at the devices.

Examine: System and communications protection policy; procedures addressing collaborative computing; access control policy and procedures; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; system developer; organizational personnel with responsibilities for managing collaborative computing devices.

Test: Mechanisms supporting and/or implementing the management of remote activation of collaborative computing devices; mechanisms providing an indication of use of collaborative computing devices.

Policy statement

• The System owner shall prohibit remote activation of collaborative computing devices and applications, with these exceptions: Fill in: exceptions where remote activation is to be allowed Typical: none, except conference room equipment that support staff activate for maintenance with the room owner’s approval. (SC-15a)
• The System owner shall ensure collaborative computing devices and applications give an explicit indication of use to users physically present at the devices. (SC-15b)

From the System and Communications Protection Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SC-15 asks for two things about collaborative computing devices and applications, which NIST’s discussion says include remote meeting devices and applications, networked whiteboards, cameras and microphones. First, nobody may switch them on remotely, except in cases you name. Second, whenever they are in use, the people physically present must be able to tell, for example from a light or an on-screen signal. The concern is eavesdropping: a camera or microphone turned on from elsewhere without the people in the room knowing.

Common implementations. Conference room systems managed from a central management platform, with auto-answer turned off, so a call cannot connect and open the camera and microphone without someone in the room accepting it. Room devices and laptops whose cameras have an indicator light that comes on whenever the camera does, and physical privacy shutters or microphone mute switches in rooms where sensitive discussions happen. Meeting applications that show when the camera, microphone or screen sharing is active, and do not let a host turn on another participant’s camera or microphone without that person’s consent. Remote activation for support staff limited to the exception the policy names, and logged.

Organization-defined parameters. Typical value, from the System and Communications Protection policy, which your organization may set differently:

Parameter	Typical value
Exceptions where remote activation is allowed (a)	None, except conference room equipment that support staff activate for maintenance with the room owner’s approval

Keep the exception narrow and recorded: who approved each activation, and when. The indication of use in item b has no parameter and applies even during an approved exception.

Evidence assessors ask for.

• An inventory of collaborative computing devices, such as conference room systems, networked whiteboards and room cameras
• Configuration from the room management platform and the meeting service, showing auto-answer off and remote activation disabled or limited to the named exception
• The approvals for remote activations under the exception, and the platform’s logs of them
• A demonstration that devices show an indication of use when active

Inheritance. The meeting service provider supplies the application’s indicators and settings, and the organization’s collaboration team usually configures room systems and the meeting service once for everyone, as a common control. A system with its own collaborative devices, such as cameras in a lab or operations center, applies SC-15 to them itself.

Common findings.

• Auto-answer turned on for conference room systems.
• A room management platform or meeting service that lets administrators or hosts start a room’s camera or microphone remotely, with no approval or record.
• Devices with no indication of use, such as a networked camera or microphone with its indicator light turned off.
• Collaborative devices missing from the inventory, so no one checks their settings.

Enhancements in the Moderate baseline. SC-15 has no enhancements in any baseline. SC-15(1) physical or logical disconnect, SC-15(3) disabling and removal in secure work areas and SC-15(4) explicitly indicating current participants are in no baseline. A meeting application that shows everyone the list of current participants, including those who joined by phone, supports SC-15(4). SC-15(2) is withdrawn.

Artifacts

• System and Communications Protection Decision Worksheet
• System and Communications Protection Policy