NIST SP 800-53 rev5 · System and Services Acquisition
SA-8 Security and Privacy Engineering Principles
Mitigates 20 ATT&CK techniques, used by 11 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1252 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-2842 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2852 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-2872 techniquesImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2882 techniquesAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
- CWE-2902 techniquesAuthentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
Techniques it mitigates
- T1005Data from Local System221 users
- T1041Exfiltration Over C2 Channel201 users
- T1078Valid Accounts56 users
- T1190Exploit Public-Facing Application55 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1482Domain Trust Discovery31 users
- T1025Data from Removable Media24 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1078.003Valid Accounts: Local Accounts19 users
- T1567Exfiltration Over Web Service14 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1213.003Data from Information Repositories: Code Repositories9 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB7 users
- T1078.001Valid Accounts: Default Accounts6 users
- T1134.005Access Token Manipulation: SID-History Injection2 users
- T1647Plist File Modification2 users
- T1052Exfiltration Over Physical Medium0 users
- T1559.003Inter-Process Communication: XPC Services0 users
- T1574.002T1574.0020 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.