SI-10 Information Input Validation

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	System	6 (0 in a baseline)

Control statement

Check the validity of the following information inputs: [Assignment: organization-defined information inputs].

NIST discussion

Checking the valid syntax and semantics of system inputs—including character set, length, numerical range, and acceptable values—verifies that inputs match specified definitions for format and content. For example, if the organization specifies that numerical values between 1-100 are the only acceptable inputs for a field in a given application, inputs of “387,” “abc,” or “%K%” are invalid inputs and are not accepted as input to the system. Valid inputs are likely to vary from field to field within a software application. Applications typically follow well-defined protocols that use structured messages (i.e., commands or queries) to communicate between software modules or system components. Structured messages can contain raw or unstructured data interspersed with metadata or control information. If software applications use attacker-supplied inputs to construct structured messages without properly encoding such messages, then the attacker could insert malicious commands or special characters that can cause the data to be interpreted as control information or metadata. Consequently, the module or component that receives the corrupted output will perform the wrong operations or otherwise interpret the data incorrectly. Prescreening inputs prior to passing them to interpreters prevents the content from being unintentionally interpreted as commands. Input validation ensures accurate and correct inputs and prevents attacks such as cross-site scripting and a variety of injection attacks.

Control enhancements

SI-10(1) Manual Override Capability

Baselines: Not in a baseline

• (a) Provide a manual override capability for input validation of the following information inputs: [Assignment: organization-defined information inputs];
• (b) Restrict the use of the manual override capability to only [Assignment: organization-defined authorized individuals] ; and
• (c) Audit the use of the manual override capability.

Discussion and assessment objectives for SI-10(1)

In certain situations, such as during events that are defined in contingency plans, a manual override capability for input validation may be needed. Manual overrides are used only in limited circumstances and with the inputs defined by the organization.

Determine if:

• SI-10(01)(a) a manual override capability for the validation of [Assignment: organization-defined information inputs] is provided;
• SI-10(01)(b) the use of the manual override capability is restricted to only [Assignment: organization-defined authorized individuals];
• SI-10(01)(c) the use of the manual override capability is audited.

Examine: System and information integrity policy; system and information integrity procedures; access control policy and procedures; separation of duties policy and procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Organizational processes for the use of a manual override capability; mechanisms supporting and/or implementing a manual override capability for input validation; mechanisms supporting and/or implementing auditing of the use of a manual override capability.

SI-10(2) Review and Resolve Errors

Baselines: Not in a baseline

Review and resolve input validation errors within [Assignment: organization-defined time period].

Discussion and assessment objectives for SI-10(2)

Resolution of input validation errors includes correcting systemic causes of errors and resubmitting transactions with corrected input. Input validation errors are those related to the information inputs defined by the organization in the base control ( SI-10).

Determine if:

• SI-10(02)[01] input validation errors are reviewed within [Assignment: organization-defined time period];
• SI-10(02)[02] input validation errors are resolved within [Assignment: organization-defined time period].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; review records of information input validation errors and resulting resolutions; information input validation error logs or records; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators.

Test: Organizational processes for the review and resolution of input validation errors; mechanisms supporting and/or implementing the review and resolution of input validation errors.

SI-10(3) Predictable Behavior

Baselines: Not in a baseline

Verify that the system behaves in a predictable and documented manner when invalid inputs are received.

Discussion and assessment objectives for SI-10(3)

A common vulnerability in organizational systems is unpredictable behavior when invalid inputs are received. Verification of system predictability helps ensure that the system behaves as expected when invalid inputs are received. This occurs by specifying system responses that allow the system to transition to known states without adverse, unintended side effects. The invalid inputs are those related to the information inputs defined by the organization in the base control ( SI-10).

Determine if:

• SI-10(03)[01] the system behaves in a predictable manner when invalid inputs are received;
• SI-10(03)[02] the system behaves in a documented manner when invalid inputs are received.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Automated mechanisms supporting and/or implementing predictable behavior when invalid inputs are received.

SI-10(4) Timing Interactions

Baselines: Not in a baseline

Account for timing interactions among system components in determining appropriate responses for invalid inputs.

Discussion and assessment objectives for SI-10(4)

In addressing invalid system inputs received across protocol interfaces, timing interactions become relevant, where one protocol needs to consider the impact of the error response on other protocols in the protocol stack. For example, 802.11 standard wireless network protocols do not interact well with Transmission Control Protocols (TCP) when packets are dropped (which could be due to invalid packet input). TCP assumes packet losses are due to congestion, while packets lost over 802.11 links are typically dropped due to noise or collisions on the link. If TCP makes a congestion response, it takes the wrong action in response to a collision event. Adversaries may be able to use what appear to be acceptable individual behaviors of the protocols in concert to achieve adverse effects through suitable construction of invalid input. The invalid inputs are those related to the information inputs defined by the organization in the base control ( SI-10).

Determine if timing interactions among system components are accounted for in determining appropriate responses for invalid inputs.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Organizational processes for determining appropriate responses to invalid inputs; automated mechanisms supporting and/or implementing responses to invalid inputs.

SI-10(5) Restrict Inputs to Trusted Sources and Approved Formats

Baselines: Not in a baseline

Restrict the use of information inputs to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].

Discussion and assessment objectives for SI-10(5)

Restricting the use of inputs to trusted sources and in trusted formats applies the concept of authorized or permitted software to information inputs. Specifying known trusted sources for information inputs and acceptable formats for such inputs can reduce the probability of malicious activity. The information inputs are those defined by the organization in the base control ( SI-10).

Determine if the use of information inputs is restricted to [Assignment: organization-defined trusted sources] and/or [Assignment: organization-defined formats].

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; list of trusted sources for information inputs; list of acceptable formats for input restrictions; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Organizational processes for restricting information inputs; automated mechanisms supporting and/or implementing restriction of information inputs.

SI-10(6) Injection Prevention

Baselines: Not in a baseline

Prevent untrusted data injections.

Discussion and assessment objectives for SI-10(6)

Untrusted data injections may be prevented using a parameterized interface or output escaping (output encoding). Parameterized interfaces separate data from code so that injections of malicious or unintended data cannot change the semantics of commands being sent. Output escaping uses specified characters to inform the interpreter’s parser whether data is trusted. Prevention of untrusted data injections are with respect to the information inputs defined by the organization in the base control ( SI-10).

Determine if untrusted data injections are prevented.

Examine: System and information integrity policy; system and information integrity procedures; procedures addressing information input validation; system design documentation; system configuration settings and associated documentation; list of trusted sources for information inputs; list of acceptable formats for input restrictions; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Organizational processes for preventing untrusted data injections; automated mechanisms supporting and/or implementing injection prevention.

Assessment objectives (SP 800-53A)

Objectives and methods for SI-10

Determine if the validity of the [Assignment: organization-defined information inputs] is checked.

Examine: System and information integrity policy; system and information integrity procedures; access control policy and procedures; separation of duties policy and procedures; procedures addressing information input validation; documentation for automated tools and applications to verify the validity of information; list of information inputs requiring validity checks; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records.

Interview: Organizational personnel responsible for information input validation; organizational personnel with information security responsibilities; system/network administrators; system developer.

Test: Mechanisms supporting and/or implementing validity checks on information inputs.

Policy statement

• The System owner shall ensure the system checks the validity of Fill in: information inputs to the system requiring validity checks Typical: all inputs from users, external systems and interfaces, including web forms, API requests, file uploads and query parameters. (SI-10)

From the System and Information Integrity Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

SI-10 asks the system to check the validity of the information inputs you name. NIST’s SI-10 discussion says checking valid syntax and semantics, including character set, length, numerical range and acceptable values, verifies that inputs match their specified format and content. It explains that software which builds structured messages, such as commands or queries, from attacker-supplied input without properly encoding it lets the attacker insert commands, and that prescreening inputs before passing them to interpreters prevents this. It names cross-site scripting and injection attacks as what input validation prevents. SI-10 is in the Moderate and High baselines, not Low.

SI-10 is a property of the system’s software, so it is met mostly in development: secure coding standards, code review and security testing (SA-11), and the developer’s process (SA-15). For commercial products, the system relies on the vendor, and the evidence comes from the vendor’s testing and the organization’s own scans.

Common implementations. Validation on the server side, against an allow list of the expected type, length, format and range for each field, using the framework’s validation features rather than code written field by field. Parameterized database queries and safe APIs that keep data separate from commands, and output encoding for anything shown in a browser. Schema validation of API requests and of files exchanged with other systems. File uploads checked for type and size, and scanned for malicious code (SI-3). Static analysis and dynamic application security testing in the build pipeline, which find missing validation before release. A web application firewall in front of public applications as an additional layer, not a substitute.

Organization-defined parameters. Typical value, from the System and Information Integrity policy, which your organization may set differently:

Parameter	Typical value
Information inputs checked for validity	All inputs from users, external systems and interfaces, including web forms, API requests, file uploads and query parameters

Naming every input is the safe choice: assessors and testers will try any input they find, and a list that covers only some of them leaves the rest to argue about.

Evidence assessors ask for.

• The secure coding standard or developer guidance that requires input validation and parameterized queries
• Static and dynamic application security test results for the current release, with how input validation findings were fixed
• Code review records, or a walk-through of how a sample of inputs is validated
• The results of the assessor’s own testing, such as injection and cross-site scripting attempts against the system’s forms and APIs
• For commercial products, the vendor’s security testing statement or the organization’s scan results

Inheritance. Usually system-specific: each application owns its own validation. A shared platform can provide part of it, such as a web application firewall or an API gateway that validates requests against a schema, recorded in the system security plan as a common control the system inherits for that part. A software as a service product’s validation is the provider’s, covered by its authorization or audit report.

Common findings.

• Validation only in the browser, which an attacker bypasses by sending requests directly.
• SQL or command strings built by joining user input, found by scans or penetration tests.
• A web application firewall offered as the only answer to injection findings.
• Internal APIs and file imports trusted without validation because they are not public.
• Deny lists of “bad characters” instead of allow lists of expected input.

Enhancements in the Moderate baseline. None. SI-10 has no enhancements in any baseline. Six are in no baseline: SI-10(1) a restricted, audited manual override, SI-10(2) reviewing and resolving input validation errors within a set time, SI-10(3) predictable behavior when invalid inputs are received, SI-10(4) timing interactions, SI-10(5) restricting inputs to trusted sources and approved formats, and SI-10(6) injection prevention. NIST’s SI-10(6) discussion names parameterized interfaces and output escaping as the ways to prevent untrusted data injection, the same practices the common implementations above rely on.

Artifacts

• System and Information Integrity Decision Worksheet
• System and Information Integrity Policy