SC-44: DETONATION CHAMBERS

NOT SELECTED FOR INDUSTRIAL CONTROL SYSTEMS

The organization employs a detonation chamber capability within [Assignment: organization-defined information system, system component, or location].

SUPPLEMENTAL GUIDANCE

Detonation chambers, also known as dynamic execution environments, allow organizations to open email attachments, execute untrusted or suspicious applications, and execute Universal Resource Locator (URL) requests in the safety of an isolated environment or virtualized sandbox. These protected and isolated execution environments provide a means of determining whether the associated attachments/applications contain malicious code. While related to the concept of deception nets, the control is not intended to maintain a long-term environment in which adversaries can operate and their actions can be observed. Rather, it is intended to quickly identify malicious code and reduce the likelihood that the code is propagated to user environments of operation (or prevent such propagation completely).

CONTROL ENHANCEMENTS

NO CONTROL ENHANCEMENTS

REFERENCES:

• NIST Special Publication 800-82 | GUIDE TO INDUSTRIAL CONTROL SYSTEMS (ICS) SECURITY