ComplianceNIST 800-53 control

NIST-SA-10 Developer Configuration Management

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-10
ATT&CK techniques mitigated
27

Control statement

Require the developer of the system, system component, or system service to: a. Perform configuration management during system, component, or service [Selection (one or more of): design; development; implementation; operation; disposal]; b. Document, manage, and control the integrity of changes to [Assignment: configuration items]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: personnel].

Discussion

Organizations consider the quality and completeness of configuration management activities conducted by developers as direct evidence of applying effective security controls. Controls include protecting the master copies of material used to generate security-relevant portions of the system hardware, software, and firmware from unauthorized modification or destruction. Maintaining the integrity of changes to the system, system component, or system service requires strict configuration control throughout the system development life cycle to track authorized changes and prevent unauthorized changes. The configuration items that are placed under configuration management include the formal model; the functional, high-level, and low-level design specifications; other design data; implementation documentation; source code and hardware schematics; the current running version of the object code; tools for comparing new versions of security-relevant hardware descriptions and source code with previous versions; and test fixtures and documentation. Depending on the mission and business needs of organizations and the nature of the contractual relationships in place, developers may provide configuration management support during the operations and maintenance stage of the system development life cycle.

ATT&CK mappings (CTID)

• T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1195.001 Compromise Software Dependencies and Development Tools • T1195.003 Compromise Hardware Supply Chain • T1213.003 Code Repositories • T1495 Firmware Corruption • T1505 Server Software Component • T1505.001 SQL Stored Procedures • T1505.002 Transport Agent • T1505.004 IIS Components • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1559.003 XPC Services • T1564.009 Resource Forking • T1574.002 DLL Side-Loading • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1647 Plist File Modification

Related

Mitigates · not in database (1)

Mitigates · MITRE ATT&CK (26)

  • T1647 Plist File Modification technique
  • T1559.003 XPC Services sub-technique
  • T1564.009 Resource Forking sub-technique
  • T1505.004 IIS Components sub-technique
  • T1213.003 Code Repositories sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1542.004 ROMMONkit sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1078.001 Default Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1553 Subvert Trust Controls technique
  • T1542.001 System Firmware sub-technique
  • T1542.003 Bootkit sub-technique
  • T1505.001 SQL Stored Procedures sub-technique
  • T1505.002 Transport Agent sub-technique
  • T1542 Pre-OS Boot technique
  • T1505 Server Software Component technique
  • T1495 Firmware Corruption technique
  • T1072 Software Deployment Tools technique
  • T1078 Valid Accounts technique

Related control · Compliance (14)

  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control
  • NIST-SR-6 Supplier Assessments and Reviews NIST 800-53 control

Referenced by Compliance · enhancement of (7)

  • NIST-SA-10(1) Software and Firmware Integrity Verification NIST 800-53 enhancement
  • NIST-SA-10(2) Alternative Configuration Management Processes NIST 800-53 enhancement
  • NIST-SA-10(3) Hardware Integrity Verification NIST 800-53 enhancement
  • NIST-SA-10(4) Trusted Generation NIST 800-53 enhancement
  • NIST-SA-10(5) Mapping Integrity for Version Control NIST 800-53 enhancement
  • NIST-SA-10(6) Trusted Distribution NIST 800-53 enhancement
  • NIST-SA-10(7) Security and Privacy Representatives NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family

Referenced by Compliance · related control (14)

  • NIST-CA-6 Authorization NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-7(5) Authorized Software — Allow-by-exception NIST 800-53 enhancement
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8(29) Repeatable and Documented Procedures NIST 800-53 enhancement
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11(2) Configuration Control for Component Service and Repair NIST 800-53 enhancement
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control