NIST 800-53 REV 5 • ACCESS CONTROL
AC-25 — Reference Monitor
Implement a reference monitor for {{ insert: param, ac-25_odp }} that is tamperproof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.
Supplemental Guidance
A reference monitor is a set of design requirements on a reference validation mechanism that, as a key component of an operating system, enforces an access control policy over all subjects and objects. A reference validation mechanism is always invoked, tamper-proof, and small enough to be subject to analysis and tests, the completeness of which can be assured (i.e., verifiable). Information is represented internally within systems using abstractions known as data structures. Internal data structures can represent different types of entities, both active and passive. Active entities, also known as subjects, are associated with individuals, devices, or processes acting on behalf of individuals. Passive entities, also known as objects, are associated with data structures, such as records, buffers, communications ports, tables, files, and inter-process pipes. Reference monitors enforce access control policies that restrict access to objects based on the identity of subjects or groups to which the subjects belong. The system enforces the access control policy based on the rule set established by the policy. The tamper-proof property of the reference monitor prevents determined adversaries from compromising the functioning of the reference validation mechanism. The always invoked property prevents adversaries from bypassing the mechanism and violating the security policy. The smallness property helps to ensure completeness in the analysis and testing of the mechanism to detect any weaknesses or deficiencies (i.e., latent flaws) that would prevent the enforcement of the security policy.
Practitioner Notes
A reference monitor is a security component that mediates all access requests, is tamper-proof, and is small enough to be verified correct. This is a foundational security architecture concept.
Example 1: The Windows Security Reference Monitor (SRM) is the kernel component that enforces access control decisions. It is always invoked (complete mediation), runs in kernel mode (tamper-proof), and has been extensively analyzed. Ensure you are not bypassing it by running applications as SYSTEM unnecessarily.
Example 2: SELinux on Linux acts as a reference monitor — it intercepts every system call, checks it against the security policy, and allows or denies the action. Ensure SELinux is in enforcing mode (not permissive) by checking getenforce. In enforcing mode, the reference monitor is actively mediating all access.