CIS-16.11 Leverage Vetted Modules or Services for Application Security Components

• T1195 Supply Chain Compromise — Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build. • T1195.001 Compromise Software Dependencies and Development Tools — Application developers should be cautious when selecting third-party libraries to integrate into their application. Additionally, where possible, developers should lock software dependencies to specific versions rather than pulling the latest version on build. • T1212 Exploitation for Credential Access — Validating authentication requests using vetted platform authentication and identity management services, rather than relying on custom authentication code, can help prevent adversaries from targeting credentialing and authentication mechanisms for exploitation. • T1496.003 SMS Pumping — Using a vetted SMS/messaging service that provides and is configured with anti-abuse controls such as CAPTCHA or equivalent bot protection can help prevent adversaries from leveraging messaging services for SMS pumping. • T1550 Use Alternate Authentication Material — Using vetted authentication modules or services that support token-binding protections that cryptographically bind a token to a secret can help prevent the token from being used without knowledge of the secret or possession of the device the token is tied to. • T1550.001 Application Access Token — Using vetted authentication modules or services that support token-binding protections that cryptographically bind a token to a secret can help prevent the token from being used without knowledge of the secret or possession of the device the token is tied to. • T1574 Hijack Execution Flow — Use vetted platform services and trusted application security modules that validate component integrity; where applicable, include hash values in manifest files to help prevent malicious library side-loading. • T1574.001 DLL — Use vetted platform and application security modules to validate component integrity; where applicable, include hash values in manifest files to help prevent malicious DLL side-loading.