SC-34

SC-34 NON-MODIFIABLE EXECUTABLE PROGRAMS

Overview

Number	Title	Impact	Priority	Subject Area
SC-34	Non-Modifiable Executable Programs		P0	System And Communications Protection

Instructions
The information system at Assignment: organization-defined information system components: SC-34a. Loads and executes the operating environment from hardware-enforced, read-only media; and SC-34b. Loads and executes Assignment: organization-defined applications from hardware-enforced, read-only media.

Guidance
The term operating environment is defined as the specific code that hosts applications, for example, operating systems, executives, or monitors including virtual machine monitors (i.e., hypervisors). It can also include certain applications running directly on hardware platforms. Hardware-enforced, read-only media include, for example, Compact Disk-Recordable (CD-R)/Digital Video Disk-Recordable (DVD-R) disk drives and one-time programmable read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable read-only memory can be accepted as read-only media provided: (i) integrity can be adequately protected from the point of initial writing to the insertion of the memory into the information system; and (ii) there are reliable hardware protections against reprogramming the memory while installed in organizational information systems.

Guidance

The term operating environment is defined as the specific code that hosts applications, for example, operating systems, executives, or monitors including virtual machine monitors (i.e., hypervisors). It can also include certain applications running directly on hardware platforms. Hardware-enforced, read-only media include, for example, Compact Disk-Recordable (CD-R)/Digital Video Disk-Recordable (DVD-R) disk drives and one-time programmable read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable read-only memory can be accepted as read-only media provided: (i) integrity can be adequately protected from the point of initial writing to the insertion of the memory into the information system; and (ii) there are reliable hardware protections against reprogramming the memory while installed in organizational information systems.

Enhancements

SC-34 (1) No Writable Storage

This control enhancement: (i) eliminates the possibility of malicious code insertion via persistent, writeable storage within the designated information system components; and (ii) applies to both fixed and removable storage, with the latter being addressed directly or as specific restrictions imposed through access controls for mobile devices.

The organization employs Assignment: organization-defined information system components with no writeable storage that is persistent across component restart or power on/off.

SC-34 (2) Integrity Protection / Read-Only Media

Security safeguards prevent the substitution of media into information systems or the reprogramming of programmable read-only media prior to installation into the systems. Security safeguards include, for example, a combination of prevention, detection, and response.

The organization protects the integrity of information prior to storage on read-only media and controls the media after such information has been recorded onto the media.

SC-34 (3) Hardware-Based Protection

The organization:

SC-34 (3)(a)

Employs hardware-based, write-protect for Assignment: organization-defined information system firmware components; and

SC-34 (3)(b)

Implements specific procedures for Assignment: organization-defined authorized individuals to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode.