NIST SP 800-53 rev5 · Identification and Authentication
IA-5 Authenticator Management
Mitigates 72 ATT&CK techniques, used by 10 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-11882 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-2842 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2852 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-2872 techniquesImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2882 techniquesAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-2902 techniquesAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
Techniques it mitigates
The 30 most used of 72, by how many ATT&CK groups and malware use them.
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1078Valid Accounts56 users
- T1552.001Unsecured Credentials: Credentials In Files41 users
- T1555Credentials from Password Stores39 users
- T1133External Remote Services33 users
- T1136.001Create Account: Local Account31 users
- T1003.002OS Credential Dumping: Security Account Manager29 users
- T1539Steal Web Session Cookie29 users
- T1078.002Valid Accounts: Domain Accounts26 users
- T1040Network Sniffing25 users
- T1021.004Remote Services: SSH24 users
- T1110Brute Force23 users
- T1003.003OS Credential Dumping: NTDS22 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1003OS Credential Dumping20 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1003.004OS Credential Dumping: LSA Secrets19 users
- T1114.002Email Collection: Remote Email Collection17 users
- T1110.003Brute Force: Password Spraying16 users
- T1110.001Brute Force: Password Guessing13 users
- T1528Steal Application Access Token13 users
- T1555.001Credentials from Password Stores: Keychain13 users
- T1555.004Credentials from Password Stores: Windows Credential Manager13 users
- T1555.005Credentials from Password Stores: Password Managers12 users
- T1072Software Deployment Tools11 users
- T1530Data from Cloud Storage10 users
- T1552.002Unsecured Credentials: Credentials in Registry10 users
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting10 users
- T1136.002Create Account: Domain Account9 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.