NIST-AC-17 Remote Access

a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b. Authorize each type of remote access to the system prior to allowing such connections.

Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of [CA-3](#ca-3) . Enforcing access restrictions for remote access is addressed via [AC-3](#ac-3).

• T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.008 Direct Cloud VM Connections • T1037 Boot or Logon Initialization Scripts • T1037.001 Logon Script (Windows) • T1040 Network Sniffing • T1047 Windows Management Instrumentation • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.008 Clear Mailbox Data • T1114 Email Collection • T1114.001 Local Email Collection • T1114.002 Remote Email Collection • T1114.003 Email Forwarding Rule • T1119 Automated Collection • T1127.002 ClickOnce • T1133 External Remote Services • T1137 Office Application Startup • T1137.002 Office Test • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.005 Messaging Applications • T1219 Remote Access Software • T1505.004 IIS Components • T1505.005 Terminal Services DLL • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1543 Create or Modify System Process • T1547.003 Time Providers • T1547.004 Winlogon Helper DLL • T1547.009 Shortcut Modification • T1547.012 Print Processors • T1547.013 XDG Autostart Entries • T1550.001 Application Access Token • T1552 Unsecured Credentials • T1552.002 Credentials in Registry • T1552.004 Private Keys • T1552.005 Cloud Instance Metadata API • T1552.007 Container API • T1557 Adversary-in-the-Middle • T1557.002 ARP Cache Poisoning • T1558 Steal or Forge Kerberos Tickets • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1558.004 AS-REP Roasting • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.002 Transmitted Data Manipulation • T1567.003 Exfiltration to Text Storage Sites • T1567.004 Exfiltration Over Webhook • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1609 Container Administration Command • T1610 Deploy Container • T1612 Build Image on Host • T1613 Container and Resource Discovery • T1619 Cloud Storage Object Discovery • T1647 Plist File Modification • T1651 Cloud Administration Command • T1659 Content Injection