AC-17 Remote Access
Access Control
Description
a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections.
Supplemental Guidance
Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of CA-03. Enforcing access restrictions for remote access is addressed via AC-03.
Changes from Rev 4
Changes control text from 'remote access' to 'each type of remote access' Adds 'information exchange' and other minor wording in discussion
Enhancements (7)
What NIST adds to this control. Select one to read its statement.
AC-17(01) Monitoring and Control ModerateHigh
Employ automated mechanisms to monitor and control remote access methods.
AC-17(02) Protection of Confidentiality and Integrity Using Encryption ModerateHigh
Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.
AC-17(03) Managed Access Control Points ModerateHigh
Route remote accesses through authorized and managed network access control points.
AC-17(04) Privileged Commands and Access ModerateHigh
a. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs]; and b. Document the rationale for remote access in the security plan for the system.
AC-17(06) Protection of Mechanism Information
Protect information about remote access mechanisms from unauthorized use and disclosure.
AC-17(09) Disconnect or Disable Access
Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].
AC-17(10) Authenticate Remote Commands
Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].
Patterns that use this control (13)
Grouped by the emphasis each pattern gives it.
Critical (3)
Important (7)
MITRE ATT&CK Techniques (81)
ATT&CK v16.1Techniques mitigated by this control, mapped via CTID.