SC-30 Concealment and Misdirection

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	Organization	4 (0 in a baseline)

Related controls: AC-6, SC-25, SC-26, SC-29, SC-44, SI-14

Control statement

Employ the following concealment and misdirection techniques for [Assignment: organization-defined systems] at [Assignment: organization-defined time periods] to confuse and mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques].

NIST discussion

Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of concealment and misdirection techniques and methods—including randomness, uncertainty, and virtualization—may sufficiently confuse and mislead adversaries and subsequently increase the risk of discovery and/or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system.

Control enhancements

SC-30(2) Randomness

Baselines: Not in a baseline

Employ [Assignment: organization-defined techniques] to introduce randomness into organizational operations and assets.

Discussion and assessment objectives for SC-30(2)

Randomness introduces increased levels of uncertainty for adversaries regarding the actions that organizations take to defend their systems against attacks. Such actions may impede the ability of adversaries to correctly target information resources of organizations that support critical missions or business functions. Uncertainty may also cause adversaries to hesitate before initiating or continuing attacks. Misdirection techniques that involve randomness include performing certain routine actions at different times of day, employing different information technologies, using different suppliers, and rotating roles and responsibilities of organizational personnel.

Determine if [Assignment: organization-defined techniques] are employed to introduce randomness into organizational operations and assets.

Examine: System and communications protection policy; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system architecture; list of techniques to be employed to introduce randomness into organizational operations and assets; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to implement concealment and misdirection techniques for systems.

Test: Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique.

SC-30(3) Change Processing and Storage Locations

Baselines: Not in a baseline

Change the location of [Assignment: organization-defined processing and/or storage] [Selection: [Assignment: organization-defined time frequency] ; random time intervals]].

Discussion and assessment objectives for SC-30(3)

Adversaries target critical mission and business functions and the systems that support those mission and business functions while also trying to minimize the exposure of their existence and tradecraft. The static, homogeneous, and deterministic nature of organizational systems targeted by adversaries make such systems more susceptible to attacks with less adversary cost and effort to be successful. Changing processing and storage locations (also referred to as moving target defense) addresses the advanced persistent threat using techniques such as virtualization, distributed processing, and replication. This enables organizations to relocate the system components (i.e., processing, storage) that support critical mission and business functions. Changing the locations of processing activities and/or storage sites introduces a degree of uncertainty into the targeting activities of adversaries. The targeting uncertainty increases the work factor of adversaries and makes compromises or breaches of the organizational systems more difficult and time-consuming. It also increases the chances that adversaries may inadvertently disclose certain aspects of their tradecraft while attempting to locate critical organizational resources.

Determine if the location of [Assignment: organization-defined processing and/or storage] is changed [Selection: [Assignment: organization-defined time frequency] ; random time intervals].

Examine: System and communications protection policy; configuration management policy and procedures; procedures addressing concealment and misdirection techniques for the system; list of processing/storage locations to be changed at organizational time intervals; change control records; configuration management records; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to change processing and/or storage locations.

Test: Mechanisms supporting and/or implementing changing processing and/or storage locations.

SC-30(4) Misleading Information

Baselines: Not in a baseline

Employ realistic, but misleading information in [Assignment: organization-defined system components] about its security state or posture.

Discussion and assessment objectives for SC-30(4)

Employing misleading information is intended to confuse potential adversaries regarding the nature and extent of controls deployed by organizations. Thus, adversaries may employ incorrect and ineffective attack techniques. One technique for misleading adversaries is for organizations to place misleading information regarding the specific controls deployed in external systems that are known to be targeted by adversaries. Another technique is the use of deception nets that mimic actual aspects of organizational systems but use, for example, out-of-date software configurations.

Determine if realistic but misleading information about the security state or posture of [Assignment: organization-defined system components] is employed.

Examine: System and communications protection policy; configuration management policy and procedures; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to define and employ realistic but misleading information about the security posture of system components.

Test: Mechanisms supporting and/or implementing the employment of realistic but misleading information about the security posture of system components.

SC-30(5) Concealment of System Components

Baselines: Not in a baseline

Employ the following techniques to hide or conceal [Assignment: organization-defined system components]: [Assignment: organization-defined techniques].

Discussion and assessment objectives for SC-30(5)

By hiding, disguising, or concealing critical system components, organizations may be able to decrease the probability that adversaries target and successfully compromise those assets. Potential means to hide, disguise, or conceal system components include the configuration of routers or the use of encryption or virtualization techniques.

Determine if [Assignment: organization-defined techniques] are employed to hide or conceal [Assignment: organization-defined system components].

Examine: System and communications protection policy; configuration management policy and procedures; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; list of techniques employed to hide or conceal system components; list of system components to be hidden or concealed; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to conceal system components.

Test: Mechanisms supporting and/or implementing techniques for the concealment of system components.

Withdrawn enhancements: SC-30(1).

Assessment objectives (SP 800-53A)

Objectives and methods for SC-30

Determine if [Assignment: organization-defined concealment and misdirection techniques] are employed for [Assignment: organization-defined systems] for [Assignment: organization-defined time periods] to confuse and mislead adversaries.

Examine: System and communications protection policy; procedures addressing concealment and misdirection techniques for the system; system design documentation; system configuration settings and associated documentation; system architecture; list of concealment and misdirection techniques to be employed for organizational systems; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel with the responsibility to implement concealment and misdirection techniques for systems.

Test: Mechanisms supporting and/or implementing concealment and misdirection techniques.