THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-3

Security Function Isolation

US National Institute of Standards and Technology (NIST) · cited in 5 of our lessons

Explanation

What it asks for. Security functions must be isolated from non-security functions.

In practice. This means running security tooling, such as identity services, logging platforms and security agents, in protected environments with separate administrative access, and using hardware and operating system features that keep security-critical code apart from general workloads. Tiered administration models that separate identity infrastructure from ordinary servers also support this. Evidence includes architecture diagrams and administrative access separation. Security agents should have tamper protection so ordinary administrators cannot disable them.

Common gaps. Security tools are often managed with the same accounts as ordinary infrastructure, so one compromise exposes both. Identity infrastructure is frequently administered from ordinary workstations. Cloud security tooling is often hosted in the same accounts as the workloads it protects.

Open SP 800-53 at NIST
The official text
Isolate security functions from nonsecurity functions. Discussion: Security functions are isolated from nonsecurity functions by means of an isolation boundary implemented within a system via partitions and domains. The isolation boundary controls access to and protects the integrity of the hardware, software, and firmware that perform system security functions. Systems implement code separation in many ways, such as through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that protect the code on disk and address space protections that protect executing code. Systems can restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. While the ideal is for all code within the defined security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions as an exception. The isolation of security functions from nonsecurity functions can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.