THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-8

Transmission Confidentiality and Integrity

US National Institute of Standards and Technology (NIST) · cited in 88 of our lessons

Explanation

What it asks for. The confidentiality and/or integrity of information must be protected while it is being transmitted.

In practice. This means TLS for web, API and email traffic using current protocol versions and strong cipher suites, encrypted VPNs or private links for site-to-site traffic, and encrypted management protocols such as SSH instead of Telnet. Auditors look for configuration standards, TLS scan results, certificate inventories and evidence that unencrypted protocols are disabled. ISO/IEC 27001 cryptography controls and GDPR security requirements point the same way. Certificates should be inventoried and renewed automatically to avoid outages.

Common gaps. Internal traffic is often left unencrypted on the assumption that the network is trusted. Legacy protocols and outdated TLS versions survive on older systems and appliances. Email between organisations may still travel without enforced encryption.

Open SP 800-53 at NIST
The official text
Protect the [Selection: confidentiality; integrity] of transmitted information. Discussion: Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 88.