NIST SP 800-53 rev5 · System and Communications Protection
SC-46 Cross Domain Policy Enforcement
Mitigates 27 ATT&CK techniques, used by 12 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-2843 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2853 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6393 techniquesAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-8623 techniquesMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
- CWE-8633 techniquesIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
- CWE-1192 techniquesImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 techniquesBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 techniquesStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 techniquesHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-13212 techniquesImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
Techniques it mitigates
- T1046Network Service Discovery69 users
- T1021.001Remote Services: Remote Desktop Protocol57 users
- T1489Service Stop57 users
- T1190Exploit Public-Facing Application55 users
- T1133External Remote Services33 users
- T1482Domain Trust Discovery31 users
- T1622Debugger Evasion26 users
- T1210Exploitation of Remote Services25 users
- T1199Trusted Relationship14 users
- T1072Software Deployment Tools11 users
- T1048Exfiltration Over Alternative Protocol9 users
- T1136.002Create Account: Domain Account9 users
- T1021.006Remote Services: Windows Remote Management8 users
- T1048.002Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol8 users
- T1557Adversary-in-the-Middle8 users
- T1557.001Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay7 users
- T1136Create Account4 users
- T1021.003Remote Services: Distributed Component Object Model3 users
- T1552.007Unsecured Credentials: Container API3 users
- T1563.002Remote Service Session Hijacking: RDP Hijacking3 users
- T1098.001Account Manipulation: Additional Cloud Credentials2 users
- T1565Data Manipulation2 users
- T1557.004Adversary-in-the-Middle: Evil Twin1 users
- T1565.003Data Manipulation: Runtime Data Manipulation1 users
- T1048.001Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol0 users
- T1557.003Adversary-in-the-Middle: DHCP Spoofing0 users
- T1563Remote Service Session Hijacking0 users
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.