ComplianceNIST 800-53 control

NIST-CM-11 User-installed Software

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: CM Configuration Management
Control: CM-11
ATT&CK techniques mitigated: 33

Control statement

a. Establish [Assignment: policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: methods] ; and c. Monitor policy compliance [Assignment: frequency].

Discussion

If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.

ATT&CK mappings (CTID)

• T1021.005 VNC • T1059 Command and Scripting Interpreter • T1059.006 Python • T1072 Software Deployment Tools • T1176 Browser Extensions • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1218 System Binary Proxy Execution • T1218.001 Compiled HTML File • T1218.002 Control Panel • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.004 IIS Components • T1543 Create or Modify System Process • T1543.001 Launch Agent • T1543.002 Systemd Service • T1543.003 Windows Service • T1543.004 Launch Daemon • T1547.013 XDG Autostart Entries • T1550.001 Application Access Token • T1564.009 Resource Forking • T1569 System Services • T1569.001 Launchctl

Mitigates · MITRE ATT&CK (33)

T1564.009 Resource Forking sub-technique
T1218.014 MMC sub-technique
T1218.013 Mavinject sub-technique
T1505.004 IIS Components sub-technique
T1218.012 Verclsid sub-technique
T1195.001 Compromise Software Dependencies and Development Tools sub-technique
T1195.002 Compromise Software Supply Chain sub-technique
T1569 System Services technique
T1569.001 Launchctl sub-technique
T1059.006 Python sub-technique
T1021.005 VNC sub-technique
T1550.001 Application Access Token sub-technique
T1218.008 Odbcconf sub-technique
T1218.001 Compiled HTML File sub-technique
T1218.002 Control Panel sub-technique
T1218.003 CMSTP sub-technique
T1218.004 InstallUtil sub-technique
T1218.005 Mshta sub-technique
T1218.009 Regsvcs/Regasm sub-technique
T1543.001 Launch Agent sub-technique
T1543.002 Systemd Service sub-technique
T1543.003 Windows Service sub-technique
T1543.004 Launch Daemon sub-technique
T1543 Create or Modify System Process technique
T1505.001 SQL Stored Procedures sub-technique
T1505.002 Transport Agent sub-technique
T1547.013 XDG Autostart Entries sub-technique
T1505 Server Software Component technique
T1195 Supply Chain Compromise technique
T1218 System Binary Proxy Execution technique

Show all 33 ›

Related control · Compliance (11)

NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
NIST-CM-2 Baseline Configuration NIST 800-53 control
NIST-CM-3 Configuration Change Control NIST 800-53 control
NIST-CM-5 Access Restrictions for Change NIST 800-53 control
NIST-CM-6 Configuration Settings NIST 800-53 control
NIST-CM-7 Least Functionality NIST 800-53 control
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-PL-4 Rules of Behavior NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control
NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (2)

NIST-CM-11(2) Software Installation with Privileged Status NIST 800-53 enhancement
NIST-CM-11(3) Automated Enforcement and Monitoring NIST 800-53 enhancement

Referenced by Compliance · has member (1)

NIST-CM Configuration Management NIST 800-53 family

Referenced by Compliance · related control (16)

NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-AC-5 Separation of Duties NIST 800-53 control
NIST-AC-6 Least Privilege NIST 800-53 control
NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
NIST-CA-7 Continuous Monitoring NIST 800-53 control
NIST-CM-3 Configuration Change Control NIST 800-53 control
NIST-CM-5(1) Automated Access Enforcement and Audit Records NIST 800-53 enhancement
NIST-CM-6 Configuration Settings NIST 800-53 control
NIST-CM-7 Least Functionality NIST 800-53 control
NIST-CM-7(6) Confined Environments with Limited Privileges NIST 800-53 enhancement
NIST-CM-8 System Component Inventory NIST 800-53 control
NIST-PL-4 Rules of Behavior NIST 800-53 control
NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
NIST-SC-13 Cryptographic Protection NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control
NIST-SI-7(12) Integrity Verification NIST 800-53 enhancement