NIST SP 800-53 rev5 · Identification and Authentication
IA-8 Identification and Authentication (Non-Organizational Users)
Mitigates 22 ATT&CK techniques, used by 11 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1252 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-202 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-222 techniquesImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Sequences like ../ in a file path escape the intended folder, exposing or overwriting other files.
- CWE-232 techniquesRelative Path TraversalRelative ../ segments in input climb out of the allowed directory.
- CWE-362 techniquesAbsolute Path TraversalAn absolute path in input points straight at a file outside the allowed directory.
- CWE-4162 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
Techniques it mitigates
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1190Exploit Public-Facing Application55 users
- T1059Command and Scripting Interpreter40 users
- T1210Exploitation of Remote Services25 users
- T1528Steal Application Access Token13 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1530Data from Cloud Storage10 users
- T1542.003Pre-OS Boot: Bootkit9 users
- T1087.004Account Discovery: Cloud Account6 users
- T1213.005Data from Information Repositories: Messaging Applications6 users
- T1059.008Command and Scripting Interpreter: Network Device CLI4 users
- T1213Data from Information Repositories4 users
- T1537Transfer Data to Cloud Account3 users
- T1542.001Pre-OS Boot: System Firmware3 users
- T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions3 users
- T1213.001Data from Information Repositories: Confluence2 users
- T1053Scheduled Task/Job1 users
- T1538Cloud Service Dashboard1 users
- T1053.007Scheduled Task/Job: Container Orchestration Job0 users
- T1213.004Data from Information Repositories: Customer Relationship Management Software0 users
- T1542Pre-OS Boot0 users
- T1542.005Pre-OS Boot: TFTP Boot0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.