Logic Bomb
What is Logic Bomb?
Malicious code that is deliberately inserted into a system and designed to execute when specific conditions are met, such as a particular date or the deletion of a user account.
Frameworks that govern logic bomb
What the standards actually require on logic bomb
Requirements naming logic bomb across 2 standards, quoted from the control text.
Tools used to collect or acquire evidence are chosen with care, because acting without weighing the risks can lose some or all of the evidence through the technology used, and risks are assessed to limit exposure to damage claims.
iso-iec-27037-2012::6.2.3 · 6.2.3 Potential digital evidence →The handbook's Unix template, following the SANS Linux cheat sheet: examine processes (ps, lsof by PID and processes using unlinked files, attention to UID 0); search for files with root set-user-ID permissions, very large files and files with no owner;
sans-incident-handlers-handbook-and-picerl-methodology::I-4 · I-4 Check Unix hosts for root processes, unlinked files, SUID and large files, promiscuous interfaces, cron jobs, UID 0 accounts and logs →Questions people ask about logic bomb
What is Logic Bomb?
Why is Logic Bomb important for compliance?
Which compliance frameworks address Logic Bomb?
Where can I learn more about Logic Bomb?
See how Logic Bomb applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.