Atch 1_Endpoint Req Matrix.xlsx
XLSX spreadsheet 70 KB Posted
- Solicitation number
- CSOCall_001
About this file
The document is an Endpoint Security Requirements Matrix for the Department of Defense (DoD), detailing comprehensive technical specifications for endpoint security solutions across multiple device categories, including mobile devices, workstations, and servers. The matrix establishes rigorous criteria for endpoint protection platforms (EPP), endpoint encryption, access control, authentication, and threat prevention, with specific requirements aligned to USCYBERCOM, NIST, and other federal cybersecurity standards.
Key requirements include mandatory capabilities such as application whitelisting, blacklisting, malware detection and prevention, encryption of local disks and removable media, multi-factor authentication, centralized management, integration with threat intelligence services, and support for cloud workloads. The document emphasizes a shift from network-centric to data-centric security approaches, with a focus on protecting endpoints in cloud, mobile, and tactical environments while maintaining enterprise-level situational awareness and defensive cyberspace operations capabilities.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 2025.08.13 CSO 001 QA.pdf | ||
| CSO Call 001- Zero Trust_Amend 01.pdf | ||
| CSO Call 001- Zero Trust.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Document Instructions
| INSTRUCTIONS |
| PLEASE READ: Introduction, Intent and Scope |
| This document provides guidance in support of the April 21, 2020 “Host Based Security Solution (HBSS) Divestment - DoD Component Transition from Legacy HBSS to the modernized Endpoint Security Solution (ESS)”, which established the concept of moving toward a data-centric approach verses a network-centric approach. As the Components move towards greater autonomy to protect and defend endpoints within their areas of responsibilities, they must continue to facilitate command and control response/reporting of situational awareness information consistent with enterprise reporting requirements for DoD CIO, USCYBERCOM/JFHQ-DoDIN, and DISA. |
The scope of this document covers device endpoints, with the focus on two (2) endpoint categories: Mobile Devices, and Workstations and Servers, as the most prevalent types deployed throughout the Department of Defense Information Network (DODIN). Device endpoint security data is a critical enabler of Defensive Cyberspace Operations (DCO) and must evolve to support all device endpoints in cloud, mobile and tactical environments.
It is understood that while other endpoint types exist (i.e., Service endpoints), which can also be exposed by cloud computing, servers, containers, as well as other exposed network endpoints (i.e., web proxies, firewalls, routers, etc.) all non-device endpoints are outside the scope or intent of this document. A future version of this document will expand and address service endpoints, exposed network endpoints, and the four (4) remaining device endpoint categories; these include Networked User Support Devices, Network Infrastructure, Internet of Things (IoT), and Cyber-Physical Systems and Control Systems (CPS/CS).
This document primarily focuses on enterprise/strategic/enclave networks verses tactical networks in disrupted, disconnected, intermittent and low-bandwidth (D-DIL) environments. If for some reason the critical data cannot be provided at the established frequencies called out within this document, Components are expected to propose a compromise via a waiver or exception to policy request must be submitted through their component Authorizing Official to the Deputy DoD CIO cybersecurity.
| Matrix Criteria Tabs |
| Capture requirements one per row and align with Endpoint security component (e.g., EPP, EDR) and sub-component. |
| Components & Sub-Comps Tab |
| Lists out the main components of the high-level architecture that will be used to align the requirements. Each component is comprised of sub-components, such as threat prevention, application control, host firewall, etc. |
| References Tab & Criteria Tabs |
| When reading a Criteria Requirement - any [#] that ends requirement statement, please refer to References Tab for corresponding # and read additional information. Example: Common Criteria 1.06 states "Each solution's audit log SHALL be only accessible to administrators [21]." The References Tab item for #21 states "Event fields - Time, Date <24h>, Event Name, Event Type, Event Outcome, Source IP Address, Source Host Name, Destination IP Address, Destination Host Name, Object Name, Object Type, Geographical Information." |
Endpoint Security Criteria Requirements Matrix Unclassified
Unclassified
Components & Subcomp.
| Components & Subcomponents | |||
| Endpoint Security Components | Common | EPP | Endpoint Encryption |
| Common | Access Control, Identification and Authentication | Application Containment | Full Disk |
| EPP | Audit and Accountability | Application Control | General |
| Endpoint Encryption | Automation | Deployment Model | Media |
| Configuration Management | Device Control | ||
| Deployment Model Flexibility | Endpoint Supportability | ||
| Endpoint Supportability | Host Firewall | ||
| Integration | Management | ||
| Risk Assessment | Mobile Threat Prevention | ||
| System and Communication Protection & Integrity | Threat Prevention | ||
| Usability |
References
| References | |
| Any Tab Crieria that has a [#] at the end of the requirment please refers to this references tab. Example: "Common - Criteria 1.06 - Each solution's audit log SHALL be only accessible to administirators [21]. Therefore see Ref Number 21 below: "Event fields - Time, Date <24h>, Event Name, Event Type, Event Outcome, Source IP Address, Source Host Name, Destination IP Address, Destination Host Name, Object Name, Object Type, Geographical Information." | |
| Ref Number | Reference Description: |
| 1 | DoD CIO Update: National Defense Authorization Act, Fiscal Year 2017, Section 1653 Compliance, Information Security Continuous Monitoring, Implementing Comply-to-Connect Policy, and Limitations on Software Licensing |
| 2 | DoD Endpoint Categories - Workstations and Servers, Mobile Devices, Networked User Support Devices, Network Infrastructure, Internet of Things, and Cyber-Physical Systems and Control Systems. |
| 3 | Endpoint Authentication Methods - 802.1x, PKI Certificate, Device Fingerprinting, Network Access Control Orchestrators, Mobile Device Management, and Media Access Control Addresses. |
| 4 | Policy-based methods - Active Directory or LDAP User Credentials, Validation against an external database (e.g. MER repository), Query against organizationally unique identifier placed on the endpoint (registry entry, file, etc.), Multi-point checks against known attributes (hard serial numbers [if readable], type device, and hardware configuration), Risk compliance, Implementation of STIG and Information Assurance Vulnerability Management (IAVM), or COAMS operation attributes (directed by USCC T.O. 17-0137) |
| 5 | Approved Remediation Methods - Install/Configure Missing required software, Update endpoint configuration against an approved standard (e.g. STIG). |
| 6 | Endpoint Protection Platform (EPP), Endpoint Detection & Response (EDR), Comply to Connect (C2C), User Activity Monitoring (UAM), Identity, Credential, and Access Management (ICAM), and Governance, Risk and Compliance (GRC). |
| 7 | Authentication failure/Anomaly - Failure of user or process to authenticate. Successful authentication that arouses suspicion. |
failed authentication to accounts disabled user accounts expired user accounts privileged user accounts default/Vendor accounts application user accounts default System account(s) 8 Exfiltration - Behavior associated with unauthorized movement or export of data.
posting data or files to a website use of screen capture use of social networks visiting a blacklisted website possessing any document or file containing keywords or classification markings on a network that does not support the classification 9 Excessive Activity - Activity that, when occurring a few times, is benign, but is suspicious once a set threshold is surpassed.
Remote administrative actions after-hour administrative actions excessive document viewing file access failures file delete failures excessive copy and paste excessive printing 10 Evidence Tampering - A user erases, modifies, or otherwise tampers with audit data, access logs, or other record-keeping mechanisms, or attempts to interfere with their recording.
stop, start, view, modify, delete or clear any logs (e.g., system, security, operating system, user, web site, database, application and browser) 11 User Application keystrokes chat programs electronic mail website browsing social media usage clipboard actions (cut, paste, etc.)
Malware - Software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system.
Anti-virus software on host is disabled Anti-virus software out of date Anti-virus software detects malware Anti-virus software unable to remove malware once detect 12 User File
i. file access
ii. file modification
iii. file deletion
iv. Privilege Violation - Any attempt to access or modify information, settings, or other data that is prohibited by policy or permissions.
1. unauthorized access/modification of File Permissions
2. unauthorized access/modification of websites
3. unauthorized access/modification of user account settings
4. unauthorized access/modification of application execution
5. unauthorized access/modification of application settings
6. unauthorized access/modification of application installations
7. shared account
| 13 | Removable Media - CDs, DVDs, External Drives, Diskettes, USB Drives, and/or memory cards |
| 14 | User Account |
i. Account Change - Any unauthorized or anomalous change made to a user account or group, including, but not limited to, creation, modification, or deletion.
1. remove Admin Rights to User or group account
2. Create, deleting or modifying groups
3. creating deleting or modifying a domain account (or user accounts)
4. change to database or administrator roles
ii. System Configuration Change - Any unauthorized or anomalous action altering the configuration of the host system or subset of systems including the operational environment.
1. modify the registry
2. start or stop a service
3. modify a system or application configuration file
4. modify user directory configuration settings (e.g., LDAP) 15 Anomalous User
i. User Behavior Anomaly - A behavior that deviates from a user’s normal range of daily activity.
1. login outside normal work pattern
2. accessing critical data or files
3. account login from multiple locations that are not probable
4. print activity escalation
5. printing at odd hours per typical work activity
6. send suspicious email attachments 16 Baseline Anomaly- A system configuration that is inconsistent with established policy.
a. adding or executing an unauthorized scripts or software to the environment
b. users without a home directory
c. using non-compliant passwords 17 Network Traffic Anomaly - Network traffic that is contrary to the established policy or baseline, or matches known patterns of malicious traffic.
a. Detect network scans
b. Encounter firewall blocks
c. Detect higher network data volume compared to comparable user patterns.
| 18 | Windows SHB Images, Windows XP, Windows 7, Windows 8, Windows 10, Server 2003, Server 2008, Server 2008r2, Server 2012, Server 2012r2, Server 2016, Server 2019, Windows Mobile; Red Hat Enterprise Linux, CentOS, Debian, Ubuntu; MacOS, iOS; Android |
| 19 | Vendor will provide documentation that comparable steps to NIST validation executed and/or be able to prove that most recent version has not changed the cryptographic libraries from prior FIPS validation. |
| 20 | Cloud Workloads are defined as - Infrastructure as a Service (IaaS) instances, IaaS containerization technology, and Platform as a Service (PaaS); including CC SRG and SCCA documentation |
| 21 | Event fields - Time, Date <24h>, Event Name, Event Type, Event Outcome, Source IP Address, Source Host Name, Destination IP Address, Destination Host Name, Object Name, Object Type, Geographical Information. |
Glossary
| Glossary | ||
| Term | Definition | Source |
| Access Control | The process of granting or denying specific requests: 1) for obtaining and using information and related information processing services; and 2) to enter specific physical facilities (e.g., Federal buildings, military establishments, and border crossing entrances). | https://csrc.nist.gov/glossary/term/access_control |
| Accountability | The security objective that generates the requirement for actions of an entity to be traced uniquely to that entity. This supports non-repudiation, deterrence, fault isolation, intrusion detection and prevention, and after-action recovery and legal action. | https://csrc.nist.gov/glossary/term/accountability |
| Alerting | Notification that a specific attack has been directed at an organization’s information systems. | https://csrc.nist.gov/glossary/term/alert |
| Analytics | IT systems that process the information outputs produced by middleware. Analytic systems may be comprised of databases, data processing software, and Web services. | https://csrc.nist.gov/glossary/term/analytic_systems |
| Application containment | Application containment techniques allow secure execution of endpoint applications to process potentially malicious content (such as webpages or downloaded documents) by isolating the processing of this content from the rest of the system. Unlike application control, which limits the impact of running software of low trust, application containment limits the impact of running trusted applications that process unknown content as well as unknown processes. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Application control | Application control limits the applications and processes that may execute on an endpoint. In extremis, its goal is to apply a “default deny” enforcement model, whereby everything that is not known or trusted is not executed. This includes the execution of specific scripts. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Application exploit protection | Application exploit protection prevents software exploits. It guards against memory overflow attacks and against other attack methods that take advantage of processes in memory. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Audit | Independent review and examination of records and activities to assess the adequacy of system controls, to ensure compliance with established policies and operational procedures. | https://csrc.nist.gov/glossary/term/audit |
| Authentication | Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system. | https://csrc.nist.gov/glossary/term/authentication |
| Authorize Connection | Enforce NAC policy to deny, or provide limited or full device access based on endpoint secure configuration, vulnerability management compliance, and endpoint category. Validate endpoints seeking access to network segments, regardless of user validation. Conduct operational testing of system performance. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 11 |
| Auto remediation (Auto-Remediate) | Automate the process of ascertaining endpoint compliance with established DoD and local policies. Orchestrate the installation or restart of missing or non-functioning endpoint security tools. Orchestrate logging for discrepancies identified prior to remediation to support auditing. Isolate, remediate, and configure endpoints in accordance with the official security configuration guidance (baselines, patches, and Security Technical Implementation Guides ( STIGs)) until minimally compliant, or as part of a higher functional level orchestration protection action - 1) CPS/CS, IoT, program of record and other endpoints may be isolated (when practical), or monitored, if manual remediation is required. 2) Auto-generate notifications to initiate manual corrections when necessary. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 11 |
| Automation | The process of creating software and systems to replace repeatable processes and reduce manual intervention. | https://www.vmware.com/topics/glossary/content/it-automation.html |
| Behavioral analysis | Behavioral analysis provides prevention by ongoing monitoring for intrusions, including malware. The system is monitored for known adversarial tools, tactics and techniques, the specific behavior of a file-based malware, or specific process deviation, thus forming indicators of intrusions that may be blocked or detected. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Cloud Configuration Compliance Checks | These risks instantiate in the control plane, including admin user-based risks such as account takeover, denial of access and lockout. This includes risks such as user privilege escalation and unauthorized changes being made to the cloud deployment. You must be able to monitor all cloud platforms simultaneously; otherwise, risks emerge with missed or slow responses to incidents. Similarly, you must be able to detect automation failures and errors, including escalation of events to monitoring systems. At the control plane, all settings must be reviewed to avoid poor or missing configuration, which may cause significant risks. | Gartner's Comparing the Use of CASB, CSPM and CWPP |
Solutions to Protect Public Cloud Services - ID G00361411 Cloud Security Posture Management (CSPM) CSPM offer core enterprise integration provides the business with cloud configuration deployment and operational monitoring insights for IaaS to SIEM and analytics platforms. It detects configuration issues within IaaS and, to some extent, PaaS through customization of some third-party tools. It can provide the enterprise with a coherent security and risk picture across multiple IaaS clouds. These tools can integrate with DevSecOps capabilities to help with configuration and deployment, as well as automate some remediation. CSPM may integrate with security information tools, such as threat monitoring and threat intelligence, to enrich its risk assessment capabilities. Gartner's Comparing the Use of CASB, CSPM and CWPP Solutions to Protect Public Cloud Services - ID G00361411
| Cloud Workload Protection Platform (CWPP) | The market for cloud workload protection platforms (CWPPs) is defined by workload-centric security offerings that target the unique protection requirements of server workloads in modern hybrid, multicloud data center architectures. CWPPs should provide consistent visibility and control for physical machines, virtual machines, containers and serverless workloads, regardless of location. CWPP offerings protect the workload from attacks, typically using a combination of network segmentation, system integrity protection, application control, behavioral monitoring, host-based intrusion prevention and optional anti-malware protection. | Gartner's Market Guide for Cloud Workload Protection Platforms - ID G00356240 |
| Comply to Connect (C2C) | (U) C2C is a part of a larger ISCM strategy that provides cybersecurity orchestration of tools and technologies. JFHQ-DODIN is moving from a network-centric to a data-centric security model by developing a zero trust reference architecture, so this capability will increase cyber efficiency by enforcing endpoint security measures across the DODIN. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 10 |
| Configuration Management | A collection of activities focused on establishing and maintaining the integrity of information technology products and information systems, through control of processes for initializing, changing, and monitoring the configurations of those products and systems throughout the system development life cycle. | https://csrc.nist.gov/glossary/term/configuration_management |
| Data Loss Monitoring | Monitoring for - The exposure of proprietary, sensitive, or classified information through either data theft or data leakage. | https://csrc.nist.gov/glossary/term/data_loss |
| Data Loss Prevention | A systems ability to identify, monitor, and protect data in use (e.g. endpoint actions), data in motion (e.g. network actions), and data at rest (e.g. data storage) through deep packet content inspection, contextual security analysis of transaction (attributes of originator, data object, medium, timing, recipient/destination, etc.), within a centralized management framework. Data loss prevention capabilities are designed to detect and prevent the unauthorized use and transmission of NSS information. | https://csrc.nist.gov/glossary/term/data_loss_prevention |
| Deployment Model (Flexibility) | A subcomponent that describes what models (i.e., cloud infrastructure as a service, cloud platform as a service, cloud software as a service, on-premises, and hybrid) the solution supports for implementation. | MITRE DISA Endpoint Security Team |
| Device Control | Control access to peripheral devices for two reasons: Malware on removable devices can spread to the endpoint, and removable storage devices can lead to data loss. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Discover + Identify | Identify all endpoints connecting to the DODIN, operating either in or out-of-band. Maintain a continuous endpoint inventory, including CPS/CS and IoT. Categorize each endpoint prior to DODIN connection and create network segments for each device type, as required. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 10 |
| DOD Component | OSD, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff (CJCS) and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (referred to collectively in this instruction as the “DoD Components”) | DOD Policy standard terminology |
| Endpoint Detection and Response (EDR) | Endpoint detection and response (EDR) records and monitors endpoint activities for multiple purposes, including detection, containment and investigation of and hunting for malicious behavior. EDR also includes response capabilities. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Endpoint Protection Platform (EPP) | EPPs include multiple attack prevention, detection and remediation techniques. These include Application Exploit Protection, Signatures and heuristics, machine learning for static file analysis, application control, application containment, behavioral analysis, and EDR. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Endpoint Supportability | A subcomponent that describes what endpoint platforms (e.g., Workstations, Servers, Mobile Devices, IoT) are supported by the endpoint security solution. Additionally, this subcomponent includes endpoint management functionalities such as performance tuning. | MITRE DISA Endpoint Security Team |
| Exploit prevention and Memory Protection | Application control solutions are fallible and must be combined with exploit prevention and memory protection capabilities, either from the OS — for example, address space layout randomization (ASLR) and seccomp — or with supplemental capabilities from the CWPP vendor. | Gartner's Market Guide for Cloud Workload Protection Platforms - ID G00716192 |
| Extended Detection and Response (XDR) | Extended detection and response (XDR) describes a unified security incident detection and response platform that automatically collects and correlates data from multiple proprietary security components. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Hardening and Configuration | A process intended to eliminate a means of attack by patching vulnerabilities and turning off nonessential services. | https://csrc.nist.gov/glossary/term/hardening |
| Host Firewall (Host-based Network Firewalling) | A software-based firewall installed on a server to monitor and control its incoming and outgoing network traffic. | https://csrc.nist.gov/glossary/term/host_based_firewall |
| Identification | The process of discovering the true identity (i.e., origin, initial history) of a person or item from the entire collection of similar persons or items. | https://csrc.nist.gov/glossary/term/identification |
| Insider Threat Protection | A solution that enables...A coordinated collection of capabilities authorized by the organization and used to deter, detect, and mitigate the unauthorized disclosure of information. | https://csrc.nist.gov/glossary/term/insider_threat_program |
| Integration | A subcomponent that describes what 3rd party and external IT solutions that an endpoint security solution can communicate with for expanded protect, detect, and respond capabilities. | MITRE DISA Endpoint Security Team |
| Integrity Control | The process of obtaining assurance that data has not been modified since an authentication code or digital signature was created for that data. | https://csrc.nist.gov/glossary/term/integrity_protection |
| Interrogate | Apply access controls, to enable identity-based network access control. Check for pre-determined conditions and unknown changes to endpoint configuration. Verify endpoint and other protection products directed by USCYBERCOM and local authorities are installed and operating. Verify security software is up to date, and properly communicating with control servers or integrated tools. Fingerprint non-supportive operating system based devices for categorization and proper segregation. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 10 |
| Intrusion Detection/Prevention | Software that automates the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents and attempting to stop detected possible incidents. | https://csrc.nist.gov/glossary/term/intrusion_detection_and_prevention_system |
| Machine learning for static file analysis | Machine learning for static file analysis uses a predictive engine that identifies malware using an algorithm that has been taught to differentiate between benign and malicious files based on features extracted from the file content and metadata. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Macro & Micro-segmentation | A key requirement of workload security is firewalling/segmentation of the workload’s ability to communicate with other resources. However, some enterprises don’t need the CWPP offering to perform this function. Instead, they use the built-in segmentation of the cloud infrastructure. For this reason, we’ve placed this layer in the shaded rectangular part of the pyramid in Figure 3. Some, but not all, CWPP offerings provide their own firewalling capabilities, whereas others manage the built-in firewalls of Windows and Linux. Some CWPPs also manage the built-in segmentation of Amazon EC2 Security Groups and Microsoft Azure Network Security Groups. Some vendors focus exclusively on micro segmentation. In all cases, the solution should support the growing requirement for identity-based “micro segmentation” (more granular, software-defined segmentation The workload is segmented according to identity-based policies — in most cases using the built-in segmentation capabilities such as tagging of the underlying programmable cloud infrastructure on which the cloud workload is deployed also referred to as zero-trust network segmentation. | Gartner's Market Guide for Cloud Workload Protection Platforms - ID G00716192 |
| Management | Providing the capability for granular administration of personally identifiable information, including alteration, deletion, and selective disclosure. | https://csrc.nist.gov/glossary/term/manageability |
| Mobile Threat Prevention (Defense) | Products that protect organizations from threats on iOS and Android devices. MTD products protect at the device, network and application levels and focus on countering malicious actions. | https://www.gartner.com/reviews/market/mobile-threat-defense |
| Orchestration | Orchestration in the IT industry is the automated coordination of actions by separate systems. | JCWA ConOps |
| PDP/PA Integration | "The ability to support functions of a" - Mechanism that examines requests to access resources, and compares them to the policy that applies to all requests for accessing that resource to determine whether specific access should be granted to the particular requester who issued the request under consideration. | https://csrc.nist.gov/glossary/term/policy_decision_point |
| PDP/PE Integration | "The ability to support functions of a" - Mechanism that examines requests to access resources, and compares them to the policy that applies to all requests for accessing that resource to determine whether specific access should be granted to the particular requester who issued the request under consideration. | https://csrc.nist.gov/glossary/term/policy_decision_point |
| PEP integration | "The ability to support functions of a" - Mechanism (e.g., access control mechanism of a file system or Web server) that actually protects (in terms of controlling access to) the resources exposed by Web services. | https://csrc.nist.gov/glossary/term/policy_enforcement_point |
| Reporting | The final phase of the computer and network forensic process, which involves reporting the results of the analysis; this may include describing the actions used, explaining how tools and procedures were selected, determining what other actions need to be performed (e.g., forensic examination of additional data sources, securing identified vulnerabilities, improving existing security controls), and providing recommendations for improvement to policies, guidelines, procedures, tools, and other aspects of the forensic process. The formality of the reporting step varies greatly depending on the situation. | https://csrc.nist.gov/glossary/term/reporting |
| Response and Remediation | A subcomponent that describes the solution’s capability to enable the NIST CSF “Respond” step. | https://www.nist.gov/cyberframework/respond |
| Risk Assessment | The process of identifying risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. Synonymous with risk analysis. | https://csrc.nist.gov/glossary/term/risk_assessment |
| Search | A subcomponent that describes the solution’s capability to search events and alerts in the solution’s management interface. This may include the ability to search real time and historical data, support specific types of syntax such as regex and/or offer filtering tools for managing large sets of data. | MITRE DISA Endpoint Security Team |
| Security Technical Implementation Guides (STIG) | A Security Technical Implementation Guide (STIG) is a configuration standard consisting of cybersecurity requirements for a specific product. The use of STIGs enables a methodology for securing protocols within networks, servers, computers, and logical designs to enhance overall security. These guides, when implemented, enhance security for software, hardware, physical and logical architectures to further reduce vulnerabilities. | |
| Signatures and heuristics | Signatures and heuristics employ regular-expression-type matching (including wild cards) to identify malware within a file. Techniques like emulation are commonly used to deobfuscate files on the endpoint in memory, before a signature match is executed. Signatures are also used to identify known good files to speed up other techniques and prevent false positives. | Gartner's Guide to Endpoint Security Concepts - ID G00734678 |
| Situation Awareness & Enforcement | Continuously monitor authorized endpoint activities and in the event of exploitation, reduce the impact, by automatically containing the endpoint until fully remediated. Alert and record all actions taken. Manage overall vulnerability risk by orchestrating continual endpoint compliance scanning. Enforce device configuration via configurable, autonomous orchestration of remediation capabilities for endpoints to access the DODIN, remain connected, and access network resources. | JFHQ-DODIN Comply-to-Connect (C2C) Concept of Operations (CONOPS) April 2021 - pg. 11 |
| System and Information Integrity | A family of NIST 800-53 controls which focus on ensuring the integrity of systems and information. | https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/controls?version=5.1&family=SI |
| System and Communications Protection | A family of NIST 800-53 controls which focus on ensuring the protection and confidentiality of systems and communications between them. | https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/controls?version=5.1&family=SC |
| Threat Prevention (Anti-Virus) | A program that monitors a computer or network to identify all major types of malware and prevent or contain malware incidents. | https://csrc.nist.gov/glossary/term/antivirus_software |
| Unified Endpoint Management (UEM) | Unified endpoint management (UEM) tools combine the management of multiple endpoint types in a single console. They perform the following functions - Configure, manage and monitor iOS, Android, Windows 10, macOS, Chrome OS, Linux, UEM-manageable Internet of Things (IoT) and wearable endpoints. Unify the application of configurations, management profiles, visibility of devices and their compliance status, and application of data protection. Provide a single view of multidevice users to enhance the efficacy of end-user support and gather detailed workplace analytics. Act as a coordination point to orchestrate the activities of related endpoint technologies, such as identity services and security infrastructure. UEM systems are designed to replace enterprise mobility management (EMM) and client management tool (CMT) systems. UEM systems provide multiplatform mobile management that moves beyond smartphones and tablets to include laptops, desktops and wearables as the move to unified workspaces accelerates. | Gartner's Solution Criteria for Unified Endpoint Management Systems - ID G00428626 |
| Usability | Per ISO/IEC 9241-11: Extent to which a product can be used by specified users to achieve specified goals with effectiveness, efficiency, and satisfaction in a specified context of use. | https://csrc.nist.gov/glossary/term/usability |
| User Activity Monitoring (UAM) | A solution that enables...The technical capability to observe and record the actions and activities of an individual, at any time, on any device accessing U.S. Government information in order to detect insider threat and to support authorized investigations. | https://csrc.nist.gov/glossary/term/user_activity_monitoring |
| User Behavior Analytics (UBA) | A cybersecurity process about detection of insider threats, targeted attacks, and financial fraud that tracks a system's users. UBA looks at patterns of human behavior, and then analyzes them to detect anomalies that indicate potential threats. | https://www.gartner.com/doc/reprints?id=1-370BP2V&ct=160518&st=sb |
| User Interface | The physical or logical means by which users interact with a system, device or process. | https://csrc.nist.gov/glossary/term/user_interface |
| Visualization | A subcomponent that describes the solution’s capability to organize data in a useful visual way such as using tables, charts, and graphs. | MITRE DISA Endpoint Security Team |
| Vulnerability Management | An ISCM capability that identifies vulnerabilities [Common Vulnerabilities and Exposures (CVEs)] on devices that are likely to be used by attackers to compromise a device and use it as a platform from which to extend compromise to the network. | https://csrc.nist.gov/glossary/term/vulnerability_management |
| Vulnerability Shielding | Here, the CWPP product deeply inspects the incoming network traffic stream for attacks against known vulnerabilities and prevents them. If network-based intrusion prevention systems (IPSs) protect the workload, then this layer may be redundant. However, network-based IPS may not protect from inter-VM or inter-container-based attacks. Also, since the traffic is terminated at the host workloads, host-based intrusion prevention system (HIPS) inspection may be a better architectural option since it is performed at the host rather than in the network. HIPS becomes a valuable defense in depth control to shield from attacks on a zero-day vulnerability, until the patch can be applied or the workload’s code is rebuilt from a patched image. HIPSs are used by some organizations to reduce the frequency of server patching. They may also be critical for protecting server workloads that are difficult to patch or that are no longer supported with patches by the vendor (such as Windows Server 2008, which fell out of support at the end of 2019). | Gartner's Market Guide for Cloud Workload Protection Platforms - ID G00716192 |
| Workload EDR | This capability may be achieved via monitoring from outside the workload. Server EDR goes beyond the system integrity monitoring discussed previously (a basic form of EDR) and beyond legacy host-based intrusion detection systems (HIDSs). Server EDR monitoring looks at behaviors such as network communications, processes launched, files opened and log entries for behavior patterns that indicate malicious activity, including within containers. Another technique is to establish patterns of expected behaviors from whitelisted applications and to look for deviations in behavior. | Gartner's Market Guide for Cloud Workload Protection Platforms - ID G00716192 |
| Zero Trust (ZT) | A collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised. | https://csrc.nist.gov/glossary/term/zero_trust |
https://csrc.nist.gov/glossary/term/access_controlhttps://csrc.nist.gov/glossary/term/hardeninghttps://csrc.nist.gov/glossary/term/host_based_firewallhttps://csrc.nist.gov/glossary/term/identificationhttps://csrc.nist.gov/glossary/term/integrity_protectionhttps://csrc.nist.gov/glossary/term/intrusion_detection_and_prevention_systemhttps://csrc.nist.gov/glossary/term/manageabilityhttps://csrc.nist.gov/glossary/term/policy_decision_pointhttps://csrc.nist.gov/glossary/term/policy_decision_pointhttps://csrc.nist.gov/glossary/term/policy_enforcement_pointhttps://csrc.nist.gov/glossary/term/reportinghttps://csrc.nist.gov/glossary/term/accountabilityhttps://csrc.nist.gov/glossary/term/risk_assessmenthttps://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-searchhttps://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-searchhttps://csrc.nist.gov/glossary/term/usabilityhttps://csrc.nist.gov/glossary/term/user_interfacehttps://csrc.nist.gov/glossary/term/vulnerability_managementhttps://www.vmware.com/topics/glossary/content/it-automation.htmlhttps://csrc.nist.gov/glossary/term/insider_threat_programhttps://www.gartner.com/reviews/market/mobile-threat-defensehttps://www.nist.gov/cyberframework/respondhttps://csrc.nist.gov/glossary/term/alerthttps://csrc.nist.gov/glossary/term/antivirus_softwarehttps://csrc.nist.gov/glossary/term/user_activity_monitoringhttps://www.gartner.com/doc/reprints?id=1-370BP2V&ct=160518&st=sbhttps://csrc.nist.gov/glossary/term/zero_trusthttps://csrc.nist.gov/glossary/term/analytic_systemshttps://csrc.nist.gov/glossary/term/audithttps://csrc.nist.gov/glossary/term/authenticationhttps://csrc.nist.gov/glossary/term/configuration_managementhttps://csrc.nist.gov/glossary/term/data_losshttps://csrc.nist.gov/glossary/term/data_loss_prevention Common - Criteria
| Common Criteria | |||||||||||
| Req Number | Requirement - any [#] that ends requirement statement, please refer to References Tab for additional information. | Component Alignment | Sub-Component Alignment | USCYBERCOM Endpoint Security | JFHQ-DODIN CONOPS | NIST 800-53 | NIST Other | Other Reference | MITRE D3FEND Countermeasure(s) | Attribution | |
| 1.01 | Each Solution SHALL use the centralized authentication mechanisms of SAML, AD or LDAP. | Common | Access Control, Identification and Authentication | IA-2 | D3-MFA; D3-LAM | MITRE DISA Endpoint Security Team | |||||
| 1.02 | Each Solution SHALL implement MFA (Multi-Factor Authentication) Mechanisms compliant with U.S. DoD Common Access Card Middleware Requirements v4.0. | Common | Access Control, Identification and Authentication | IA-2(1), IA-2(2) | D3-MFA; D3-LAM | MITRE DISA Endpoint Security Team | |||||
| 1.03 | Each Solution SHALL permission objects with the lowest level of permissions needed to function. | Common | Access Control, Identification and Authentication | AC-6 | D3-LFP; D3-MAC; D3-UAP; D3-SCP; D3-LAM | MITRE DISA Endpoint Security Team | |||||
| 1.04 | Each Solution SHALL log all primary function activities of that solution conforming with the logging fields - time, date, event name, event type, event outcome, source IP address, source host name, destination IP address, destination host name, object name, object type,and geographical information events. | Common | Audit and Accountability | AU-2 | Related Countermeasures: D3-LAM | MITRE DISA Endpoint Security Team | |||||
| 1.05 | Each solution SHALL log each system activity to an audit log using the logging fields - time, date, event name, event type, event outcome, source IP address, source host name, destination IP address, destination host name, object name, object type,and geographical information. | Common | Audit and Accountability | USCYBERCOM Endpoint Security Requirements - 6.1.f | AU-2 | Related Countermeasures: D3-LAM; D3-SDM | MITRE DISA Endpoint Security Team | ||||
| 1.06 | Each solution's audit log SHALL be only accessible to administirators [21]. | Common | Audit and Accountability | USCYBERCOM Endpoint Security Requirements - 6.1.f | AU-9(4) | D3-UAP; D3-LFP | MITRE DISA Endpoint Security Team | ||||
| 1.07 | Each on-premises solution SHALL use a configurable network time service. | Common | Audit and Accountability | SC-45(1) | NIST 800-53 SC-45 | MITRE DISA Endpoint Security Team | |||||
| 1.08 | Each Solution SHALL correlate events with adversarial tactics, techniques and procedures. | ||||||||||
| Common | Audit and Accountability | AU-6(5) | MITRE ATT&CK | Related Countermeasures: D3-AI; D3-ORA | MITRE DISA Endpoint Security Team | ||||||
| 1.09 | Each solution SHALL correlate adversary tactics, techniques, and procedures for threat mitigation activities. | Common | Audit and Accountability | SA-8 | MITRE ATT&CK | Related Countermeasures: D3-AI; D3-ORA | MITRE DISA Endpoint Security Team | ||||
| 1.10 | Each Solution SHALL support open API integration using SOAP or REST over HTTPS. | Common | Automation | USCYBERCOM Endpoint Security Requirements - 6.6.e | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.11 | Acrross the endpoint solution suite of tools, one solution SHALL have a SCAP (Secure Content Automation Protocol) compliant benchmark capability for STIG benchmarks. | Common | Automation | USCYBERCOM Endpoint Security Requirements - 6.6.e | CM-6 | MITRE DISA Endpoint Security Team | |||||
| 1.12 | The Solution SHALL provide defined methods for software and signature rollback. | ||||||||||
| Common | Configuration Management | CM-2 | D3-ACH; D3-TBI | MITRE DISA Endpoint Security Team | |||||||
| 1.13 | The Solution SHALL provide defined methods for configuration and policy rollback. | Common | Configuration Management | CM-2 | D3-ACH; D3-TBI | MITRE DISA Endpoint Security Team | |||||
| 1.14 | Each Solution SHALL be deloyable in an architecture using on-premises, cloud, or hybrid deployments. | Common | Deployment Model Flexibility | USCYBERCOM Endpoint Security Requirements 6.6.c | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.15 | Each Solution SHALL function in Cloud, Mobile and D-DIL (Denied, Degraded, Intermittent and Limited) environments maintaining core protect, detect, respond, and alerting functionalities. | Common | Deployment Model Flexibility | USCYBERCOM Endpoint Security Requirements 6.6.a | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.16 | Each Solution SHALL function using on-premise virtualization deployment methods at a minimum of VMWare Hypervisor and Windows Hyper-V. | Common | Deployment Model Flexibility | USCYBERCOM Endpoint Security Requirements 6.6.h | SC-29(1) | MITRE DISA Endpoint Security Team | |||||
| 1.17 | Each Solution SHALL tune performance by throttling the solution's communications and data, task scheduling and task randomization. | Common | Endpoint Supportability | JFHQ-DODIN Endpoint Security CONOPS Appendix D - 2.b | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.18 | Solution SHALL be able to function in the Combatant Commands Unclassified and Classified network and IT environment for both operational and pre-production enclaves. | Common | Endpoint Supportability | USCYBERCOM Endpoint Security Requirements - 6.6.a | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.19 | Each Solution SHALL function on Windows SHB Images - Windows 10+, Server 2012, Server 2012r2, Server 2016, Server 2019, Windows Mobile; Red Hat Enterprise Linux v8+, Ubuntu v18.04+; MacOS 10.15+, iOS; Android based on solution’s core functions. | Common | Endpoint Supportability | USCYBERCOM Endpoint Security Requirements - 6.6.g | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.20 | Each Solution SHALL integrate with the DoD Big Data Platform and SIEM (Security Information and Event Management) for the export of logs and events. | Common | Integration | SI-4(2) | Related Countermeasures: D3-PM; D3-OSM; D3-NTA; D3-UBA | MITRE DISA Endpoint Security Team | |||||
| 1.21 | If solution provides features for mobile devices, each solution SHALL integrate with approved mobile device management solution. | Common | Integration | USCYBERCOM Endpoint Security Requirements 6.6.c | SC-43 | MITRE DISA Endpoint Security Team | |||||
| 1.22 | Each solution SHALL integrate with approved Ticket Management solution or solutions. | Common | Integration | JFHQ-DODIN-C2C CONOPS Appendix A - 5.c | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.23 | Each solution SHALL provide custom attributes for users, devices and workload objects. | Common | Integration | USCYBERCOM Endpoint Security Requirements - 6.1.c.a.x | AC-16 | Related Countermeasures: D3-UAP; D3-MAC | MITRE DISA Endpoint Security Team | ||||
| 1.24 | Each Solution SHALL functionally coexist with other security solutions and functions within the infrastructure. | Common | Risk Assessment | JFHQ-DODIN-C2C CONOPS DE.CM-8 | CA-8 | D3-ORA | MITRE DISA Endpoint Security Team | ||||
| 1.25 | Each Solution SHALL comply with the compliance mandates FISMA 2002, FISMA 2014, STIG Standards, and FedRAMP appliicable to their deployment model. | Common | Risk Assessment | USCYBERCOM Endpoint Security Requirements - 6.2.h | CM-6 | MITRE DISA Endpoint Security Team | |||||
| 1.26 | Each solution SHALL utilize a tiered model for configuration and event data reporting to USCYBERCOM, JFHQ-DODIN, and CSSPs. | ||||||||||
| Common | Risk Assessment | USCYBERCOM Endpoint Security Requirements | N/A | JFHQ-DODIN | |||||||
| 1.27 | Each Solution SHALL utilize a tiered model in the distribution of event and audit data. | Common | Risk Assessment | USCYBERCOM Endpoint Security Requirements | AU-6(4) | JFHQ-DODIN | |||||
| 1.28 | The solution SHALL implement the current FIPS140 validated algorithm(s) or in process for FIPS140 validation. | Common | System and Communication Protection & Integrity | SC-12 | Related Countermeasures: D3-FE; D3-MENCR; D3-DENCR | MITRE DISA Endpoint Security Team | |||||
| 1.29 | Each Solution SHALL disconnect and logoff idle sessions | Common | System and Communication Protection & Integrity | AC-12(3) | Related Countermeasures: D3-AL | MITRE DISA Endpoint Security Team | |||||
| 1.30 | Each solution SHALL encrypt all network, remote, and user interface connections. | Common | System and Communication Protection & Integrity | SC-8(1); SC-13 | Related Countermeasures: D3-MENCR; D3-ET | MITRE DISA Endpoint Security Team | |||||
| 1.31 | Each Solution SHALL encrypt data at rest. | Common | System and Communication Protection & Integrity | SC-28 | Related Countermeasures: D3-FE; D3-DENCR | MITRE DISA Endpoint Security Team | |||||
| 1.32 | Each solution SHALL obfuscate unauthenticated and public error, warning and information messages compliant with OWASP guidelines. | Common | System and Communication Protection & Integrity | SI-11 | OWASP - Improper Error Handling | MITRE DISA Endpoint Security Team | |||||
| 1.33 | Each Solution SHALL function with disabled vendor diagnostic data. | Common | System and Communication Protection & Integrity | MA-4 | MITRE DISA Endpoint Security Team | ||||||
| 1.34 | Each Solution SHALL configure the destination of diagnostic data. | Common | System and Communication Protection & Integrity | MA-4 | MITRE DISA Endpoint Security Team | ||||||
| 1.35 | Each Solution SHALL apply policy to custom grouped users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | Related CounterMeasures: D3-UAP; D3-LFP; D3-KBPI ; D3-BDI; D3-HBPI | MITRE DISA Endpoint Security Team | ||||
| 1.36 | |||||||||||
| Each Solution SHALL apply configuration to custom grouped users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | Related CounterMeasures: D3-UAP; D3-LFP; D3-KBPI ; D3-BDI; D3-HBPI | MITRE DISA Endpoint Security Team | |||||
| 1.37 | Each Solution SHALL apply policy to individual users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | Related CounterMeasures: D3-UAP; D3-LFP; D3-KBPI ; D3-BDI; D3-HBPI | MITRE DISA Endpoint Security Team | ||||
| 1.38 | Each Solution SHALL apply configuration to individual users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | Related CounterMeasures: D3-UAP; D3-LFP; D3-KBPI ; D3-BDI; D3-HBPI | MITRE DISA Endpoint Security Team | ||||
| 1.39 | Across the Endpoint Security Solution suite, single or multiple solutions SHALL collect and report on the Master Endpoint Record (MER) required data model elements. | Common | Audit and Accountability | AU-3 | Related Countermeasures: D3-AI | ESSG Endpoint Security Requirements Tiger Team | |||||
| 1.40 | Each Solution SHALL exempt policy to custom grouped users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.41 | Each Solution SHALL exempt configuration to custom grouped users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.42 | Each Solution SHALL exempt policy to individual users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.43 | Each Solution SHALL exempt configuration to individual users, devices and workloads. | Common | Usability | JFHQ-DODIN-C2C CONOPS Appendix E - 2 | N/A | MITRE DISA Endpoint Security Team | |||||
| 1.44 | Each Solution SHALL Protect the function that supports the ability to limit or contain the impact of a potential cybersecurity event. | Common | System and Communication Protection & Integrity | AC-6(1) | ESSG Endpoint Security Requirements Tiger Team | ||||||
| 1.45 | Each Solution SHALL have Role Based Access Control levels to create Administrator, Analyst, and Read-Only user type permission sets. | ||||||||||
| Common | Access Control, Identification and Authentication | AC-3(7) | D3-UAP; D3-MAC | MITRE DISA Endpoint Security Team | |||||||
| 1.46 | Each Solution SHALL assign severity ratings to each rule firing, alert and trigger. | Common | Audit and Accountability | AU-3 | ESSG EDR Requirements, 24 Aug 2017 - Requirement 15 | MITRE DISA Endpoint Security Team |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .