Threat Actors:   

A wildly successful attack vector used by threat actors is the exploitation of unpatched system vulnerabilities. Failing to remain current on various software/system patches can greatly increase your attack surface and result in compromise.

·  Policy or procedures that address flaw remediation,

·  Security-relevant software updates (patches, service pack updates, hot fixes, or signature updates) in response to reported system flaws or vulnerabilities,

Threat Actors:   

There are several methods in which threat actors can deliver malicious code to your system:

i) Email/phishing

ii) Malicious websites

iii) Portable storage devices such as thumb drives, etc

iv) Off the shelf commercial software packages

An inventory of malicious code protections provided to systems at designated locations.

Threat Actors:   

i) May assume you are not currently updating your protection mechanisms (anti-virus signatures, reputation mechanisms)

ii) May assume you and vendors do not rapidly update protections and may exploit this window via “zero-day” attacks

iii) May use Malware to insert logic bombs, back doors, etc.

iv) May assume you may not be sufficiently protecting your organization from custom software vulnerabilities (secure coding, config management, good procurement processes, monitoring scope of software functions)

Malicious code protections are updated when new releases are available and also updated based on your organizational configuration management process.

Threat Actors:   

i) Will try to insert malicious code via external measures (email, SMS, etc.)

ii) May assume that your protection mechanisms will fail to detect malicious content

iii) May also assume that your company does not scan existing systems or existing data/files

iv) Will used advanced techniques such as steganography - which is the practice of concealing a file, message, image, or video within another file, message, image, or video.

Security scans of files from an external source are scanned when downloaded, opened, or executed.  (This would include files downloaded from websites, email attachments, embedded links, or from other interfaces with external systems.)

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·      Procedures to identify how the organizations receive security alerts, advisories, and directives from external organizations and how internal alerts of similar nature are generated and effectively communicated.

·      Procedures and processes to ensure an appropriate action is taken in response to the alerts and advisories with relevant external entities, such as supply chain partners.

Threat Actors:   

i) may take advantage of a poor network monitoring capability and use intrusion techniques to gain persistent access to your network

·  Procedures that addresses system monitoring tools and methods used to detect potential threats for all inbound and outbound communications, as well as,  unauthorized local, network or remote connectivity.

·  Supporting documentation that identifies network monitoring tools, security detection and monitoring systems, roles and responsibilities of individuals that monitor and respond to potential threats, or any third-party services supporting this practice.

·  If emails are scanned for malicious code, links, or attachments. 

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Procedures that addresses system monitoring tools and methods used to determine if authorized and unauthorized use of the system is defined.

·  Process on how the organization monitors the system for misuse.

·  Process on how unauthorized use will be detected (such as log monitoring).

Various data protection and data loss prevention (DLP) tools may also be used in support of this practice.