SC-44 Detonation Chambers

Guidance: nonePolicy clause: noneWhat these mean

Baselines	Implementation level	Enhancements
Not in a baseline	System	None

Related controls: SC-7, SC-18, SC-25, SC-26, SC-30, SC-35, SC-39, SI-3, SI-7

Control statement

Employ a detonation chamber capability within [Assignment: organization-defined system, system component, or location].

NIST discussion

Detonation chambers, also known as dynamic execution environments, allow organizations to open email attachments, execute untrusted or suspicious applications, and execute Universal Resource Locator requests in the safety of an isolated environment or a virtualized sandbox. Protected and isolated execution environments provide a means of determining whether the associated attachments or applications contain malicious code. While related to the concept of deception nets, the employment of detonation chambers is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, detonation chambers are intended to quickly identify malicious code and either reduce the likelihood that the code is propagated to user environments of operation or prevent such propagation completely.

Assessment objectives (SP 800-53A)

Objectives and methods for SC-44

Determine if a detonation chamber capability is employed within the [Assignment: organization-defined system, system component, or location].

Examine: System and communications protection policy; procedures addressing detonation chambers; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system.

Test: Mechanisms supporting and/or implementing the detonation chamber capability.