NIST-CM-6 Configuration Settings

a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: common secure configurations]; b. Implement the configuration settings; c. Identify, document, and approve any deviations from established configuration settings for [Assignment: system components] based on [Assignment: operational requirements] ; and d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1008 Fallback Channels • T1011 Exfiltration Over Other Network Medium • T1011.001 Exfiltration Over Bluetooth • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.008 Direct Cloud VM Connections • T1027 Obfuscated Files or Information • T1027.010 Command Obfuscation • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036 Masquerading • T1036.001 Invalid Code Signature • T1036.003 Rename System Utilities • T1036.005 Match Legitimate Name or Location • T1036.007 Double File Extension • T1036.010 Masquerade Account Name • T1037 Boot or Logon Initialization Scripts • T1037.002 Login Hook • T1037.003 Network Logon Script • T1037.004 RC Scripts • T1037.005 Startup Items • T1046 Network Service Discovery • T1047 Windows Management Instrumentation • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1053 Scheduled Task/Job • T1053.002 At • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1055 Process Injection • T1055.008 Ptrace System Calls • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.010 AutoHotKey & AutoIT • T1059.011 Lua • T1068 Exploitation for Privilege Escalation • T1070 Indicator Removal • T1070.001 Clear Windows Event Logs • T1070.002 Clear Linux or Mac System Logs • T1070.003 Clear Command History • T1070.007 Clear Network Connection History and Configurations • T1070.008 Clear Mailbox Data • T1070.009 Clear Persistence • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1087 Account Discovery • T1087.001 Local Account • T1087.002 Domain Account • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1090.003 Multi-hop Proxy • T1091 Replication Through Removable Media • T1092 Communication Through Removable Media • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.005 Device Registration • T1098.007 Additional Local or Domain Groups • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1106 Native API • T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1111 Multi-Factor Authentication Interception • T1114 Email Collection • T1114.002 Remote Email Collection • T1114.003 Email Forwarding Rule • T1119 Automated Collection • T1127 Trusted Developer Utilities Proxy Execution • T1127.001 MSBuild • T1127.002 ClickOnce • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1133 External Remote Services • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1134.005 SID-History Injection • T1135 Network Share Discovery • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1176 Browser Extensions • T1187 Forced Authentication • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1197 BITS Jobs • T1199 Trusted Relationship … and 194 more