NIST-AC-4 Information Flow Enforcement

Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies].

Information flow control regulates where information can travel within a system and between systems (in contrast to who is allowed to access the information) and without regard to subsequent accesses to that information. Flow control restrictions include blocking external traffic that claims to be from within the organization, keeping export-controlled information from being transmitted in the clear to the Internet, restricting web requests that are not from the internal web proxy server, and limiting information transfers between organizations based on data structures and content. Transferring information between organizations may require an agreement specifying how the information flow is enforced (see [CA-3](#ca-3) ). Transferring information between systems in different security or privacy domains with different security or privacy policies introduces the risk that such transfers violate one or more domain security or privacy policies. In such situations, information owners/stewards provide guidance at designated policy enforcement points between connected systems. Organizations consider mandating specific architectural solutions to enforce specific security and privacy policies. Enforcement includes prohibiting information transfers between connected systems (i.e., allowing access only), verifying write permissions before accepting information from another security or privacy domain or connected system, employing hardware mechanisms to enforce one-way information flows, and implementing trustworthy regrading mechanisms to reassign security or privacy attributes and labels. Organizations commonly employ information flow control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within systems and between connected systems. Flow control is based on the characteristics of the information and/or the information path. Enforcement occurs, for example, in boundary protection devices that employ rule sets or establish configuration settings that restrict system services, provide a packet-filtering capability based on header information, or provide a message-filtering capability based on message content. Organizations also consider the trustworthiness of filtering and/or inspection mechanisms (i.e., hardware, firmware, and software components) that are critical to information flow enforcement. Control enhancements 3 through 32 primarily address cross-domain solution needs that focus on more advanced filtering techniques, in-depth analysis, and stronger flow enforcement mechanisms implemented in cross-domain products, such as high-assurance guards. Such capabilities are generally not available in commercial off-the-shelf products. Information flow enforcement also applies to control plane traffic (e.g., routing and DNS).

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1008 Fallback Channels • T1020.001 Traffic Duplication • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.005 VNC • T1021.006 Windows Remote Management • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1041 Exfiltration Over C2 Channel • T1046 Network Service Discovery • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1068 Exploitation for Privilege Escalation • T1070.008 Clear Mailbox Data • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1071.005 Publish/Subscribe Protocols • T1072 Software Deployment Tools • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1090.003 Multi-hop Proxy • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.007 Additional Local or Domain Groups • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1114 Email Collection • T1114.001 Local Email Collection • T1114.002 Remote Email Collection • T1114.003 Email Forwarding Rule • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1133 External Remote Services • T1134.005 SID-History Injection • T1136 Create Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1187 Forced Authentication • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1197 BITS Jobs • T1199 Trusted Relationship • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1205 Traffic Signaling • T1205.001 Port Knocking • T1205.002 Socket Filters • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.004 Customer Relationship Management Software • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.012 Verclsid • T1219 Remote Access Software • T1482 Domain Trust Discovery • T1484 Domain or Tenant Policy Modification • T1489 Service Stop • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1505.004 IIS Components • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1547.003 Time Providers • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.005 Cloud Instance Metadata API • T1552.007 Container API • T1552.008 Chat Messages • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1557.004 Evil Twin • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1559.002 Dynamic Data Exchange • T1563 Remote Service Session Hijacking • T1563.002 RDP Hijacking • T1564.008 Email Hiding Rules • T1565 Data Manipulation • T1565.003 Runtime Data Manipulation • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.002 Spearphishing Link • T1566.003 Spearphishing via Service • T1567 Exfiltration Over Web Service • T1567.001 Exfiltration to Code Repository • T1567.002 Exfiltration to Cloud Storage • T1567.003 Exfiltration to Text Storage Sites • T1567.004 Exfiltration Over Webhook • T1568 Dynamic Resolution • T1568.002 Domain Generation Algorithms • T1570 Lateral Tool Transfer • T1571 Non-Standard Port • T1572 Protocol Tunneling • T1573 Encrypted Channel • T1573.001 Symmetric Cryptography • T1573.002 Asymmetric Cryptography • T1574 Hijack Execution Flow • T1574.004 Dylib Hijacking • T1574.005 Executable Installer File Permissions Weakness • T1574.007 Path Interception by PATH Environment Variable • T1574.008 Path Interception by Search Order Hijacking • T1574.009 Path Interception by Unquoted Path • T1574.010 Services File Permissions Weakness • T1590.002 DNS • T1598 Phishing for Information • T1598.001 Spearphishing Service • T1598.002 Spearphishing Attachment • T1598.003 Spearphishing Link • T1599 Network Boundary Bridging • T1599.001 Network Address Translation Traversal • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image … and 8 more