SC-11

SC-11 TRUSTED PATH

Overview

Number	Title	Impact	Priority	Subject Area
SC-11	Trusted Path		P0	System And Communications Protection

Instructions
The information system establishes a trusted communications path between the user and the following security functions of the system: Assignment: organization-defined security functions to include at a minimum, information system authentication and re-authentication.

Guidance
Trusted paths are mechanisms by which users (through input devices) can communicate directly with security functions of information systems with the requisite assurance to support information security policies. The mechanisms can be activated only by users or the security functions of organizational information systems. User responses via trusted paths are protected from modifications by or disclosure to untrusted applications. Organizations employ trusted paths for high-assurance connections between security functions of information systems and users (e.g., during system logons). Enforcement of trusted communications paths is typically provided via an implementation that meets the reference monitor concept.

Guidance

Trusted paths are mechanisms by which users (through input devices) can communicate directly with security functions of information systems with the requisite assurance to support information security policies. The mechanisms can be activated only by users or the security functions of organizational information systems. User responses via trusted paths are protected from modifications by or disclosure to untrusted applications. Organizations employ trusted paths for high-assurance connections between security functions of information systems and users (e.g., during system logons). Enforcement of trusted communications paths is typically provided via an implementation that meets the reference monitor concept.

Enhancements

SC-11 (1) Logical Isolation

The information system provides a trusted communications path that is logically isolated and distinguishable from other paths.