| Information flow control regulates where information is allowed to travel. This control applies to the flow of information within individual IDPS components. Internal component communication, such as between the sensors and management server, is not included in this control. The IDPS components must restrict information flow within the component to authorized communications. A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, unauthorized commands, functionality, or traffic may be allowed to infiltrate security components causing corruption or other conditions.
Examples of flow control restrictions include preventing installed applications or functions from accessing security configurations; or preventing unauthorized commands from executing on the IDPS components.
For most IDPS components, internal information flow control is a product of system design. However, this control can also be mitigated with a policy to control and prevent the installation of unauthorized tools. |
