NIST SP 800-53 rev5 · Access Control
AC-4 Information Flow Enforcement
Mitigates 158 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1199 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1209 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1219 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1229 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-207 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-4167 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-2846 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2856 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6396 techniquesAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-8626 techniquesMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
Techniques it mitigates
The 30 most used of 158, by how many ATT&CK groups and malware use them.
- T1105Ingress Tool Transfer501 users
- T1071.001Application Layer Protocol: Web Protocols410 users
- T1041Exfiltration Over C2 Channel201 users
- T1204.002User Execution: Malicious File185 users
- T1573.001Encrypted Channel: Symmetric Cryptography181 users
- T1566.001Phishing: Spearphishing Attachment141 users
- T1132.001Data Encoding: Standard Encoding130 users
- T1095Non-Application Layer Protocol101 users
- T1573.002Encrypted Channel: Asymmetric Cryptography94 users
- T1204.001User Execution: Malicious Link81 users
- T1566.002Phishing: Spearphishing Link80 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1046Network Service Discovery69 users
- T1090Proxy68 users
- T1571Non-Standard Port60 users
- T1021.002Remote Services: SMB/Windows Admin Shares59 users
- T1008Fallback Channels57 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1489Service Stop57 users
- T1203Exploitation for Client Execution56 users
- T1071.004Application Layer Protocol: DNS55 users
- T1190Exploit Public-Facing Application55 users
- T1102.002Web Service: Bidirectional Communication54 users
- T1102Web Service46 users
- T1570Lateral Tool Transfer46 users
- T1068Exploitation for Privilege Escalation42 users
- T1189Drive-by Compromise42 users
- T1552.001Unsecured Credentials: Credentials In Files41 users
- T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage41 users
- T1572Protocol Tunneling37 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.