THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-39

Process Isolation

US National Institute of Standards and Technology (NIST) · cited in 30 of our lessons

Explanation

What it asks for. Systems must maintain a separate execution domain for each executing process.

In practice. This is largely delivered by modern operating systems, hypervisors and container platforms through separate address spaces and privilege boundaries. Organisations support it by using supported platforms, keeping memory protection features enabled, running workloads in appropriately isolated containers or virtual machines and avoiding configurations that weaken isolation. Evidence may include platform documentation, hardening settings and container security policies. Container platforms should enforce policies that block privileged containers and restrict access to the host. Auditors may also check that address space layout randomisation and similar protections are left on.

Common gaps. Containers run with privileged mode or host namespaces undermine process isolation. Legacy systems without modern memory protections are often left in place. Isolation is assumed rather than checked, so weaknesses are found only during an incident.

Open SP 800-53 at NIST
The official text
Maintain a separate execution domain for each executing system process. Discussion: Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from other software, firmware, and data. Process isolation helps limit the access of potentially untrusted software to other system resources. The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 30.