NIST SP 800-53 rev5 · System and Communications Protection
SC-39 Process Isolation
Mitigates 22 ATT&CK techniques, used by 9 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-1194 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1204 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1214 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1224 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-1254 techniquesOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
- CWE-204 techniquesImproper Input ValidationInput isn't checked against what the program expects; the umbrella cause behind many specific flaws.
- CWE-2844 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2854 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-2874 techniquesImproper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-2884 techniquesAuthentication Bypass Using an Alternate Path or ChannelA second route (a debug port, an API) reaches the protected function without the login check.
Techniques it mitigates
- T1003.001OS Credential Dumping: LSASS Memory70 users
- T1203Exploitation for Client Execution56 users
- T1190Exploit Public-Facing Application55 users
- T1068Exploitation for Privilege Escalation42 users
- T1189Drive-by Compromise42 users
- T1003.002OS Credential Dumping: Security Account Manager29 users
- T1210Exploitation of Remote Services25 users
- T1003.003OS Credential Dumping: NTDS22 users
- T1003OS Credential Dumping20 users
- T1003.004OS Credential Dumping: LSA Secrets19 users
- T1003.005OS Credential Dumping: Cached Domain Credentials8 users
- T1003.006OS Credential Dumping: DCSync7 users
- T1556Modify Authentication Process6 users
- T1003.007OS Credential Dumping: Proc Filesystem5 users
- T1611Escape to Host5 users
- T1547.005Boot or Logon Autostart Execution: Security Support Provider3 users
- T1211Exploitation for Stealth2 users
- T1547.008Boot or Logon Autostart Execution: LSASS Driver2 users
- T1556.001Modify Authentication Process: Domain Controller Authentication2 users
- T1003.008OS Credential Dumping: /etc/passwd and /etc/shadow1 users
- T1212Exploitation for Credential Access1 users
- T1547.002Boot or Logon Autostart Execution: Authentication Package1 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.