| SC-5 (1) Restrict Internal Users | | Restricting the ability of individuals to launch denial of service attacks requires that the mechanisms used for such attacks are unavailable. Individuals of concern can include, for example, hostile insiders or external adversaries that have successfully breached the information system and are using the system as a platform to launch cyber attacks on third parties. Organizations can restrict the ability of individuals to connect and transmit arbitrary information on the transport medium (i.e., network, wireless spectrum). Organizations can also limit the ability of individuals to use excessive information system resources. Protection against individuals having the ability to launch denial of service attacks may be implemented on specific information systems or on boundary devices prohibiting egress to potential target systems. The information system restricts the ability of individuals to launch Assignment: organization-defined denial of service attacks against other information systems. | SC-5 (2) Excess Capacity / Bandwidth / Redundancy | | Managing excess capacity ensures that sufficient capacity is available to counter flooding attacks. Managing excess capacity may include, for example, establishing selected usage priorities, quotas, or partitioning. The information system manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding denial of service attacks. | SC-5 (3) Detection / Monitoring | | Organizations consider utilization and capacity of information system resources when managing risk from denial of service due to malicious attacks. Denial of service attacks can originate from external or internal sources. Information system resources sensitive to denial of service include, for example, physical disk storage, memory, and CPU cycles. Common safeguards to prevent denial of service attacks related to storage utilization and capacity include, for example, instituting disk quotas, configuring information systems to automatically alert administrators when specific storage capacity thresholds are reached, using file compression technologies to maximize available storage space, and imposing separate partitions for system and user data. The organization: SC-5 (3)(a) Employs Assignment: organization-defined monitoring tools to detect indicators of denial of service attacks against the information system; and SC-5 (3)(b) Monitors Assignment: organization-defined information system resources to determine if sufficient resources exist to prevent effective denial of service attacks. | 