SC-04 Information in Shared System Resources
NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
All changes in this version
Title
Information in Shared System Resources
Control
Prevent unauthorized and unintended information transfer via shared system resources.
Discussion
Preventing unauthorized and unintended information transfer via shared system resources stops information produced by the actions of prior users or roles (or the actions of processes acting on behalf of prior users or roles) from being available to current users or roles (or current processes acting on behalf of current users or roles) that obtain access to shared system resources after those resources have been released back to the system. Information in shared system resources also applies to encrypted representations of information. In other contexts, control of information in shared system resources is referred to as object reuse and residual information protection. Information in shared system resources does not address information remanence, which refers to the residual representation of data that has been nominally deleted; covert channels (including storage and timing channels), where shared system resources are manipulated to violate information flow restrictions; or components within systems for which there are only single users or roles.
Related controls
ac-3, ac-4, sa-8
STIG rules that implement this control 58
Apple iOS/iPadOS 26 V1R3
- AIOS-26-003000 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud).
- AIOS-26-003200 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud document and data synchronization).
- AIOS-26-003300 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Keychain).
- AIOS-26-003450 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (Cloud Photo Library).
- AIOS-26-003500 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream).
- AIOS-26-003600 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (managed applications data stored in iCloud).
- AIOS-26-003700 CAT II Apple iOS/iPadOS 26 must not allow backup to remote systems (enterprise books).
- AIOS-26-009200 CAT II Apple iOS/iPadOS 26 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
- AIOS-26-013300 CAT II Apple iOS/iPadOS 26 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DOD-approved USB storage drives with iOS/iPadOS devices.
Apple iOS/iPadOS 27 V1R1
- AIOS-27-002700 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud).
- AIOS-27-002800 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud document and data synchronization).
- AIOS-27-002900 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Keychain).
- AIOS-27-003000 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (Cloud Photo Library).
- AIOS-27-003100 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (iCloud Photo Sharing, also known as Shared Stream or Shared Photo Stream).
- AIOS-27-003200 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (managed applications data stored in iCloud).
- AIOS-27-003300 CAT II Apple iOS/iPadOS 27 must not allow backup to remote systems (enterprise books).
- AIOS-27-008400 CAT II Apple iOS/iPadOS 27 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
- AIOS-27-012600 CAT II Apple iOS/iPadOS 27 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DoW-approved USB storage drives with iOS/iPadOS devices.
Apple macOS 15 (Sequoia) V1R8
- APPL-15-005001 CAT I The macOS system must ensure System Integrity Protection is enabled.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-005001 CAT I The macOS system must ensure System Integrity Protection (SIP) is enabled.
Application Security and Development V6R5
- APSC-DV-002380 CAT II Applications must prevent unauthorized and unintended information transfer via shared system resources.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-213010 CAT III Ubuntu 22.04 LTS must restrict access to the kernel message buffer.
- UBTU-22-232145 CAT II Ubuntu 22.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-600140 CAT III Ubuntu 24.04 LTS must restrict access to the kernel message buffer.
- UBTU-24-600150 CAT II Ubuntu 24.04 LTS must set a sticky bit on all public directories to prevent unauthorized and unintended information transferred via shared system resources.
Google Android 16 COBO Y26M10
- GOOG-16-008500 CAT II Google Android 16 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
- GOOG-16-008600 CAT II Google Android 16 must be configured to not allow backup of [all applications, configuration data] to remote systems.
- GOOG-16-012400 CAT III Google Android 16 must allow only the administrator (MDM) to perform the following management function: Disable Phone Hub.
Google Android 17 COBO Y26M06
- GOOG-17-007100 CAT II Google Android 17 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
- GOOG-17-007200 CAT II Google Android 17 must be configured to not allow backup of [all applications, configuration data] to remote systems.
- GOOG-17-009900 CAT III Google Android 17 must allow only the administrator (MDM) to perform the following management function: Disable phone hub.
Microsoft Windows 11 V2R11
- WN11-00-000060 CAT II Non-system-created file shares on a system must limit access to groups that require it.
- WN11-CC-000155 CAT I Solicited Remote Assistance must not be allowed.
- WN11-CC-000275 CAT II Local drives must be prevented from sharing with Remote Desktop Session Hosts.
- WN11-SO-000150 CAT I Anonymous enumeration of shares must be restricted.
- WN11-SO-000165 CAT I Anonymous access to Named Pipes and Shares must be restricted.
Microsoft Windows Server 2022 V2R11
- WN22-00-000230 CAT II Windows Server 2022 nonsystem-created file shares must limit access to groups that require it.
- WN22-CC-000350 CAT II Windows Server 2022 Remote Desktop Services must prevent drive redirection.
- WN22-DC-000120 CAT II Windows Server 2022 data files owned by users must be on a different logical partition from the directory server data files.
- WN22-SO-000230 CAT I Windows Server 2022 must not allow anonymous enumeration of shares.
- WN22-SO-000250 CAT I Windows Server 2022 must restrict anonymous access to Named Pipes and Shares.
Microsoft Windows Server 2025 V1R4
- WN25-00-000230 CAT II Windows Server 2025 nonsystem-created file shares must limit access to groups that require it.
- WN25-CC-000350 CAT II Windows Server 2025 Remote Desktop Services must prevent drive redirection.
- WN25-DC-000120 CAT II Windows Server 2025 data files owned by users must be on a different logical partition from the directory server data files.
- WN25-SO-000230 CAT I Windows Server 2025 must not allow anonymous enumeration of shares.
- WN25-SO-000250 CAT I Windows Server 2025 must restrict anonymous access to Named Pipes and Shares.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-400140 CAT II RHEL 10 must be configured so that world-writable directories are owned by root, sys, bin, or an application user.
- RHEL-10-400280 CAT II RHEL 10 must be configured so that a sticky bit is set on all public directories.
- RHEL-10-701030 CAT II RHEL 10 must restrict access to the kernel message buffer.
- RHEL-10-701040 CAT II RHEL 10 must prevent kernel profiling by nonprivileged users.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-213010 CAT II RHEL 9 must restrict access to the kernel message buffer.
- RHEL-09-213015 CAT II RHEL 9 must prevent kernel profiling by nonprivileged users.
- RHEL-09-232240 CAT II All RHEL 9 world-writable directories must be owned by root, sys, bin, or an application user.
- RHEL-09-232245 CAT II A sticky bit must be set on all RHEL 9 public directories.
Samsung Android 16 COBO Y26M10
- KNOX-16-007300 CAT II Samsung Android must be configured to not allow backup of all applications and configuration data to locally connected systems.
- KNOX-16-007400 CAT II Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. (This requirement applies to the Work Profile for COPE.) - Disable Data Sync Framework.
- KNOX-16-007500 CAT II Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. - Disable Backup Services.
- KNOX-16-010400 CAT III The Samsung Android device must be configured to perform the following management function: Disable Phone Hub.