SC-24 Fail in Known State
All changes in this version
Title
Fail in Known State
Control
Fail to a [Assignment: known system state] for the following failures on the indicated components while preserving [Assignment: system state information] in failure: [Assignment: types of system failures on system components].
Discussion
Failure in a known state addresses security concerns in accordance with the mission and business needs of organizations. Failure in a known state prevents the loss of confidentiality, integrity, or availability of information in the event of failures of organizational systems or system components. Failure in a known safe state helps to prevent systems from failing to a state that may cause injury to individuals or destruction to property. Preserving system state information facilitates system restart and return to the operational mode with less disruption of mission and business processes.
Parameters
sc-24_odp.01: types of system failures on system components
sc-24_odp.02: known system state
sc-24_odp.03: system state information
Related controls
cp-10, cp-12, cp-2, cp-4, sa-8, sc-22, sc-7, si-13
Assessment objective
SC-24 [Assignment: types of system failures on system components] fail to a [Assignment: known system state] while preserving [Assignment: system state information] in failure.
STIG rules that implement this control 9
Application Security and Development V6R5
- APSC-DV-002310 CAT I The application must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
- APSC-DV-002320 CAT II In the event of a system failure, applications must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-213015 CAT II Ubuntu 22.04 LTS must disable kernel core dumps so that it can fail to a secure state if system initialization fails, shutdown fails or aborts fail.
- UBTU-22-652010 CAT II Ubuntu 22.04 LTS must be configured to preserve log records from failure events.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100200 CAT II Ubuntu 24.04 LTS must be configured to preserve log records from failure events.
- UBTU-24-600070 CAT II Ubuntu 24.04 LTS must disable kernel core dumps.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-500000 CAT II RHEL 10 must enable the systemd-journald service.
- RHEL-10-701200 CAT II RHEL 10 must disable the kdump service.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-211040 CAT II RHEL 9 systemd-journald service must be enabled.