16.
Decommissioning and Disposal ................................................................................................ 66
16.1.
System Decommissioning .................................................................................................. 66
16.2.
Media Usage ...................................................................................................................... 68
16.3.
Media Sanitization ............................................................................................................. 69
16.4.
Media Destruction ............................................................................................................. 70
17.
Software Security ...................................................................................................................... 71
17.1.
Standard Operating Environments .................................................................................... 71
17.2.
Application Whitelisting .................................................................................................... 74
17.3.
Web Applications............................................................................................................... 75
17.4.
Software Application Development .................................................................................. 77
17.5.
Web Application Development ......................................................................................... 78
18.
Email Security............................................................................................................................ 80
18.1.
Email Applications ............................................................................................................. 80
18.2.
Email Infrastructure ........................................................................................................... 80
19.
Access Control ........................................................................................................................... 84
19.1.
Identification and Authentication ..................................................................................... 84
19.2.
System Access .................................................................................................................... 87
19.3.
Privileged Access ............................................................................................................... 87
19.4.
Remote Access ................................................................................................................... 88
19.5.
Event Logging and Auditing ............................................................................................... 88
20.
Cryptography ............................................................................................................................ 91
20.1.
Cryptographic Fundamentals ............................................................................................ 91
20.2.
Secure Sockets Layer and Transport Layer Security .......................................................... 91
20.3.
Secure Shell ....................................................................................................................... 92
20.4.
Secure Multipurpose Internet Mail Extension .................................................................. 94
20.5.
Open PGP Message Format ............................................................................................... 94
20.6.
Internet Protocol Security ................................................................................................. 95
20.7.
Key Management............................................................................................................... 96
21.
Network Security ...................................................................................................................... 99
4