NIST SP 800-53 rev5 · Identification and Authentication
IA-9 Service Identification and Authentication
Mitigates 22 ATT&CK techniques, used by 10 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-202 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-4162 techniquesUse After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-6932 techniquesProtection Mechanism FailureA security feature exists but can be bypassed or doesn't engage when it should.
- CWE-792 techniquesImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.
- CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-3461 techniquesOrigin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
Techniques it mitigates
- T1059.001Command and Scripting Interpreter: PowerShell219 users
- T1036.005Masquerading: Match Legitimate Resource Name or Location211 users
- T1566.001Phishing: Spearphishing Attachment141 users
- T1566.002Phishing: Spearphishing Link80 users
- T1036Masquerading54 users
- T1059Command and Scripting Interpreter40 users
- T1554Compromise Host Software Binary21 users
- T1598.003Phishing for Information: Spearphishing Link19 users
- T1036.001Masquerading: Invalid Code Signature11 users
- T1566Phishing11 users
- T1213.003Data from Information Repositories: Code Repositories9 users
- T1059.002Command and Scripting Interpreter: AppleScript7 users
- T1598Phishing for Information6 users
- T1553.004Subvert Trust Controls: Install Root Certificate5 users
- T1546Event Triggered Execution4 users
- T1598.002Phishing for Information: Spearphishing Attachment4 users
- T1553Subvert Trust Controls2 users
- T1546.013Event Triggered Execution: PowerShell Profile1 users
- T1525Implant Internal Image0 users
- T1546.006Event Triggered Execution: LC_LOAD_DYLIB Addition0 users
- T1562.006T1562.0060 users
- T1562.009T1562.0090 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.