Skip to main content

💼 SC-7 BOUNDARY PROTECTION

  • ID: /frameworks/nist-sp-800-53-r4/sc/07

Description​

The information system: SC-7a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b. Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Similar​

  • Internal
    • ID: dec-c-537a8fb7

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1863no data
💼 NIST CSF v1.1 → 💼 PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)1044no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented4791no data
💼 NIST CSF v1.1 → 💼 PR.PT-4: Communications and control networks are protected1044no data

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 SC-7 (1) PHYSICALLY SEPARATED SUBNETWORKSno data
💼 SC-7 (2) PUBLIC ACCESSno data
💼 SC-7 (3) ACCESS POINTSno data
💼 SC-7 (4) EXTERNAL TELECOMMUNICATIONS SERVICESno data
💼 SC-7 (5) DENY BY DEFAULT _ ALLOW BY EXCEPTIONno data
💼 SC-7 (6) RESPONSE TO RECOGNIZED FAILURESno data
💼 SC-7 (7) PREVENT SPLIT TUNNELING FOR REMOTE DEVICESno data
💼 SC-7 (8) ROUTE TRAFFIC TO AUTHENTICATED PROXY SERVERSno data
💼 SC-7 (9) RESTRICT THREATENING OUTGOING COMMUNICATIONS TRAFFICno data
💼 SC-7 (10) PREVENT UNAUTHORIZED EXFILTRATIONno data
💼 SC-7 (11) RESTRICT INCOMING COMMUNICATIONS TRAFFICno data
💼 SC-7 (12) HOST-BASED PROTECTIONno data
💼 SC-7 (13) ISOLATION OF SECURITY TOOLS _ MECHANISMS _ SUPPORT COMPONENTSno data
💼 SC-7 (14) PROTECTS AGAINST UNAUTHORIZED PHYSICAL CONNECTIONSno data
💼 SC-7 (15) ROUTE PRIVILEGED NETWORK ACCESSESno data
💼 SC-7 (16) PREVENT DISCOVERY OF COMPONENTS _ DEVICESno data
💼 SC-7 (17) AUTOMATED ENFORCEMENT OF PROTOCOL FORMATSno data
💼 SC-7 (18) FAIL SECUREno data
💼 SC-7 (19) BLOCKS COMMUNICATION FROM NON-ORGANIZATIONALLY CONFIGURED HOSTSno data
💼 SC-7 (20) DYNAMIC ISOLATION _ SEGREGATIONno data
💼 SC-7 (21) ISOLATION OF INFORMATION SYSTEM COMPONENTSno data
💼 SC-7 (22) SEPARATE SUBNETS FOR CONNECTING TO DIFFERENT SECURITY DOMAINSno data
💼 SC-7 (23) DISABLE SENDER FEEDBACK ON PROTOCOL VALIDATION FAILUREno data

Policies (31)​

PolicyLogic CountFlagsCompliance
🛡️ AWS EC2 Security Group allows public IPv4 (0.0.0.0/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows public IPv6 (::/0) access to admin ports🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ AWS EC2 Security Group allows unrestricted traffic to Oracle DBMS🟢1🟢 x6no data
🛡️ AWS S3 Bucket is not configured to block public access🟢1🟢 x6no data
🛡️ AWS S3 Bucket Policy is not set to deny HTTP requests🟢1🟢 x6no data
🛡️ Google Cloud SQL Instance External Authorized Networks whitelists all public IP addresses🟢1🟢 x6no data
🛡️ Google Cloud SQL Instance SSL Connections are not enforced🟢1🟢 x6no data
🛡️ Google GCE Instance has a public IP address🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted CiscoSecure/WebSM traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted DNS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted FTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted HTTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted LDAP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted NetBIOS traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted POP3 traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SMTP traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted SSH traffic🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Cassandra🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Directory services"🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Elasticsearch🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Memcached🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MongoDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to MySQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to OracleDB🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to PostgreSQL🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted traffic to Redis🟢1🟢 x6no data
🛡️ Google GCE Network allows unrestricted Telnet traffic🟢1🟢 x6no data
🛡️ Google GKE Cluster Network policy is disabled.🟢1🟢 x6no data
🛡️ Google GKE Cluster Node Pool uses default Service account🟢1🟢 x6no data
🛡️ Google HTTPS or SSL Proxy Load Balancer permits SSL policies with weak cipher suites🟢⚪🟢 x2, ⚪ x1no data

Internal Rules​

RulePoliciesFlags
✉️ dec-x-637372481
✉️ dec-x-bcae85fb2
✉️ dec-x-d5fbfc401
✉️ dec-x-ec547a7c1
✉️ dec-z-c82c9f971