NIST SP 800-53 rev5 · Access Control
AC-20 Use of External Systems
Mitigates 64 ATT&CK techniques, used by 11 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-3062 techniquesMissing Authentication for Critical FunctionA sensitive function requires no login at all; one of the most exploited flaws in edge devices.
- CWE-11881 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-13211 techniquesImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
- CWE-2501 techniquesExecution with Unnecessary PrivilegesSoftware runs with more privilege than it needs, so any flaw in it is a flaw with full power.
- CWE-2691 techniquesImproper Privilege ManagementPrivileges are assigned or dropped incorrectly, so a low-privileged foothold becomes administrator.
- CWE-2841 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
Techniques it mitigates
The 30 most used of 64, by how many ATT&CK groups and malware use them.
- T1041Exfiltration Over C2 Channel201 users
- T1119Automated Collection71 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage41 users
- T1555Credentials from Password Stores39 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1133External Remote Services33 users
- T1136.001Create Account: Local Account31 users
- T1539Steal Web Session Cookie29 users
- T1078.002Valid Accounts: Domain Accounts26 users
- T1021.004Remote Services: SSH24 users
- T1110Brute Force23 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1114.001Email Collection: Local Email Collection20 users
- T1114.002Email Collection: Remote Email Collection17 users
- T1110.003Brute Force: Password Spraying16 users
- T1567Exfiltration Over Web Service14 users
- T1110.001Brute Force: Password Guessing13 users
- T1072Software Deployment Tools11 users
- T1530Data from Cloud Storage10 users
- T1550.001Use Alternate Authentication Material: Application Access Token10 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1136.002Create Account: Domain Account9 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1557Adversary-in-the-Middle8 users
- T1021Remote Services7 users
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB7 users
- T1111Multi-Factor Authentication Interception7 users
- T1552.005Unsecured Credentials: Cloud Instance Metadata API7 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.