NIST SP 800-53 rev5 · Access Control
AC-16 Security and Privacy Attributes
Mitigates 57 ATT&CK techniques, used by 11 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-772 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-782 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-221 techniquesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-231 techniquesRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-3061 techniquesMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-361 techniquesAbsolute Path TraversalAn absolute path in input points straight at a file outside the allowed directory.
- CWE-7981 techniquesUse of Hard-coded CredentialsA password or key is baked into the product, identical on every install and easy to find.
Techniques it mitigates
The 30 most used of 57, by how many ATT&CK groups and malware use them.
- T1005Data from Local System221 users
- T1041Exfiltration Over C2 Channel201 users
- T1119Automated Collection71 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1070Indicator Removal31 users
- T1040Network Sniffing25 users
- T1025Data from Removable Media24 users
- T1003.003OS Credential Dumping: NTDS22 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1003OS Credential Dumping20 users
- T1114.001Email Collection: Local Email Collection20 users
- T1114.002Email Collection: Remote Email Collection17 users
- T1564.004Hide Artifacts: NTFS File Attributes16 users
- T1222.002File and Directory Permissions Modification: Linux and Mac Permissions15 users
- T1222.001File and Directory Permissions Modification: Windows Permissions14 users
- T1567Exfiltration Over Web Service14 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1530Data from Cloud Storage10 users
- T1550.001Use Alternate Authentication Material: Application Access Token10 users
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting10 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1548.003Abuse Elevation Control Mechanism: Sudo and Sudo Caching9 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1557Adversary-in-the-Middle8 users
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB7 users
- T1552.005Unsecured Credentials: Cloud Instance Metadata API7 users
- T1114Email Collection6 users
- T1213.005Data from Information Repositories: Messaging Applications6 users
- T1552Unsecured Credentials6 users
- T1114.003Email Collection: Email Forwarding Rule5 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.