NIST SP 800-53 rev5 · System and Services Acquisition
SA-11 Developer Testing and Evaluation
Mitigates 34 ATT&CK techniques, used by 8 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-772 techniquesImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-782 techniquesImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-7982 techniquesUse of Hard-coded CredentialsA password or key is baked into the product, identical on every install and easy to find.
- CWE-11881 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-2841 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
Techniques it mitigates
The 30 most used of 34, by how many ATT&CK groups and malware use them.
- T1078Valid Accounts56 users
- T1552.001Unsecured Credentials: Credentials In Files41 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1078.003Valid Accounts: Local Accounts19 users
- T1528Steal Application Access Token13 users
- T1195.001Supply Chain Compromise: Compromise Software Dependencies and Development Tools10 users
- T1552.002Unsecured Credentials: Credentials in Registry10 users
- T1213.003Data from Information Repositories: Code Repositories9 users
- T1542.003Pre-OS Boot: Bootkit9 users
- T1078.001Valid Accounts: Default Accounts6 users
- T1552Unsecured Credentials6 users
- T1552.006Unsecured Credentials: Group Policy Preferences5 users
- T1553.006Subvert Trust Controls: Code Signing Policy Modification5 users
- T1505.004Server Software Component: IIS Components3 users
- T1542.001Pre-OS Boot: System Firmware3 users
- T1134.005Access Token Manipulation: SID-History Injection2 users
- T1495Firmware Corruption2 users
- T1553Subvert Trust Controls2 users
- T1647Plist File Modification2 users
- T1505.001Server Software Component: SQL Stored Procedures1 users
- T1505.002Server Software Component: Transport Agent1 users
- T1558.004Steal or Forge Kerberos Tickets: AS-REP Roasting1 users
- T1601Modify System Image1 users
- T1601.001Modify System Image: Patch System Image1 users
- T1195.003Supply Chain Compromise: Compromise Hardware Supply Chain0 users
- T1505Server Software Component0 users
- T1542Pre-OS Boot0 users
- T1542.004Pre-OS Boot: ROMMONkit0 users
- T1542.005Pre-OS Boot: TFTP Boot0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.