CMMC Practice SC.L2-3.13.13 – Mobile Code: Control and monitor the use of mobile code.
Links to Publicly Available Resources
This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. This article describes what malicious mobile code is and how to protect against it. This article outlines several best practices for safeguarding sensitive information that is processed by mobile apps use by an organization. This NIST Special Publication provides an overview of active content and mobile code technologies in use today and offer insights for making informed IT security decisions. This article describes the security guidelines for mobile code. This article describes the two main categories of mobile code security risks
Discussion [NIST SP 800-171 R2]
Mobile code technologies include Java, JavaScript, ActiveX, Postscript, PDF, Flash animations, and VBScript. Decisions regarding the use of mobile code in organizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Usage restrictions and implementation guidance apply to the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations, notebook computers, and devices (e.g., smart phones). Mobile code policy and procedures address controlling or preventing the development, acquisition, or introduction of unacceptable mobile code in systems, including requiring mobile code to be digitally signed by a trusted source.
Further Discussion
Ensure mobile code is authorized to execute in company systems only in accordance with policy and technical configuration, and that unauthorized mobile code is not. Monitor the use of mobile code through boundary devices (e.g., firewalls), audit logs, or security utilities (e.g., mobile device management, advanced endpoint protection) and implement remediation activities as needed.
The first intent of this practice is to ensure the limits of mobile code usage and usage restrictions are documented and enforced. This includes documenting all authorizations for the use of mobile code and ensuring it is not used in other ways. Usage restrictions and implementation guidance apply to the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices to include all mobile devices and smart phones.
The second intent is to monitor the use of mobile code and implement remediation steps if its use does not align with policy.