PR.PS-02.245
Has your organization implemented a process to identify and remove unnecessary software components and utilities from systems?
Explanation
Unnecessary software components and utilities increase the attack surface of systems, providing potential entry points or tools that attackers can exploit. Examples include unused operating system utilities, sample applications, development tools left on production systems, or legacy components no longer required.
Evidence could include a documented software inventory management process, results from recent system hardening activities, or reports from automated tools that identify and flag unnecessary software components across your environment.
Implementation Example
Uninstall and remove any unnecessary software components (e.g., operating system utilities) that attackers might misuse
ID: PR.PS-02.245
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Software is maintained, replaced, and removed commensurate with risk
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
