NIST SP 800-53 rev5 · Identification and Authentication
IA-13 Identity Providers and Authorization Servers
Mitigates 17 ATT&CK techniques, used by 8 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-2872 techniquesImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2882 techniquesAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-2902 techniquesAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-11881 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-4341 techniquesUnrestricted Upload of File with Dangerous TypeUploads aren't restricted, so an attacker uploads a script (a web shell) and then requests it.
Techniques it mitigates
- T1078Valid Accounts56 users
- T1078.002Valid Accounts: Domain Accounts26 users
- T1134Access Token Manipulation22 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1134.001Access Token Manipulation: Token Impersonation/Theft20 users
- T1528Steal Application Access Token13 users
- T1111Multi-Factor Authentication Interception7 users
- T1556Modify Authentication Process6 users
- T1134.003Access Token Manipulation: Make and Impersonate Token5 users
- T1649Steal or Forge Authentication Certificates5 users
- T1556.006Modify Authentication Process: Multi-Factor Authentication3 users
- T1621Multi-Factor Authentication Request Generation3 users
- T1134.005Access Token Manipulation: SID-History Injection2 users
- T1556.007Modify Authentication Process: Hybrid Identity2 users
- T1556.009Modify Authentication Process: Conditional Access Policies2 users
- T1606.002Forge Web Credentials: SAML Tokens1 users
- T1606Forge Web Credentials0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.