NIST SP 800-53 rev5 · System and Communications Protection
SC-28 Protection of Information at Rest
Mitigates 42 ATT&CK techniques, used by 11 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-7982 techniquesUse of Hard-coded CredentialsA password or key is baked into the product, identical on every install and easy to find.
- CWE-11881 techniquesInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-1191 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1201 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1211 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1221 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1251 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-2841 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-2871 techniquesImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
Techniques it mitigates
The 30 most used of 42, by how many ATT&CK groups and malware use them.
- T1005Data from Local System221 users
- T1041Exfiltration Over C2 Channel201 users
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1078Valid Accounts56 users
- T1552.001Unsecured Credentials: Credentials In Files41 users
- T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol33 users
- T1003.002OS Credential Dumping: Security Account Manager29 users
- T1025Data from Removable Media24 users
- T1003.003OS Credential Dumping: NTDS22 users
- T1552.004Unsecured Credentials: Private Keys22 users
- T1003OS Credential Dumping20 users
- T1078.004Valid Accounts: Cloud Accounts20 users
- T1003.004OS Credential Dumping: LSA Secrets19 users
- T1078.003Valid Accounts: Local Accounts19 users
- T1567Exfiltration Over Web Service14 users
- T1213.002Data from Information Repositories: Sharepoint10 users
- T1530Data from Cloud Storage10 users
- T1550.001Use Alternate Authentication Material: Application Access Token10 users
- T1552.002Unsecured Credentials: Credentials in Registry10 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1003.005OS Credential Dumping: Cached Domain Credentials8 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1003.006OS Credential Dumping: DCSync7 users
- T1052.001Exfiltration Over Physical Medium: Exfiltration over USB7 users
- T1078.001Valid Accounts: Default Accounts6 users
- T1213.005Data from Information Repositories: Messaging Applications6 users
- T1552Unsecured Credentials6 users
- T1003.007OS Credential Dumping: Proc Filesystem5 users
- T1213Data from Information Repositories4 users
- T1552.003Unsecured Credentials: Shell History4 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.