SC-02 Separation of System and User Functionality
All changes in this version
Title
Separation of System and User Functionality
Control
Separate user functionality, including user interface services, from system management functionality.
Discussion
System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).
Related controls
ac-6, sa-4, sa-8, sc-22, sc-3, sc-32, sc-39, sc-7
Assessment objective
SC-02 user functionality, including user interface services, is separated from system management functionality.
STIG rules that implement this control 11
Application Security and Development V6R5
- APSC-DV-002150 CAT II The application user interface must be either physically or logically separated from data storage and management interfaces.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-701030 CAT II RHEL 10 must restrict access to the kernel message buffer.
- RHEL-10-701040 CAT II RHEL 10 must prevent kernel profiling by nonprivileged users.
- RHEL-10-701060 CAT II RHEL 10 must restrict exposed kernel pointer address access.
- RHEL-10-701140 CAT II RHEL 10 must restrict usage of ptrace to descendant processes.
- RHEL-10-800030 CAT II RHEL 10 must disable access to the network bpf system call from nonprivileged processes.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-213010 CAT II RHEL 9 must restrict access to the kernel message buffer.
- RHEL-09-213015 CAT II RHEL 9 must prevent kernel profiling by nonprivileged users.
- RHEL-09-213025 CAT II RHEL 9 must restrict exposed kernel pointer addresses access.
- RHEL-09-213075 CAT II RHEL 9 must disable access to network bpf system call from nonprivileged processes.
- RHEL-09-213080 CAT II RHEL 9 must restrict usage of ptrace to descendant processes.