ComplianceNIST 800-53 control

NIST-SA-8 Security and Privacy Engineering Principles

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SA System and Services Acquisition
Control
SA-8
ATT&CK techniques mitigated
20

Control statement

Apply the following systems security and privacy engineering principles in the specification, design, development, implementation, and modification of the system and system components: [Assignment: organization-defined systems security and privacy engineering principles].

Discussion

Systems security and privacy engineering principles are closely related to and implemented throughout the system development life cycle (see [SA-3](#sa-3) ). Organizations can apply systems security and privacy engineering principles to new systems under development or to systems undergoing upgrades. For existing systems, organizations apply systems security and privacy engineering principles to system upgrades and modifications to the extent feasible, given the current state of hardware, software, and firmware components within those systems. The application of systems security and privacy engineering principles helps organizations develop trustworthy, secure, and resilient systems and reduces the susceptibility to disruptions, hazards, threats, and the creation of privacy problems for individuals. Examples of system security engineering principles include: developing layered protections; establishing security and privacy policies, architecture, and controls as the foundation for design and development; incorporating security and privacy requirements into the system development life cycle; delineating physical and logical security boundaries; ensuring that developers are trained on how to build secure software; tailoring controls to meet organizational needs; and performing threat modeling to identify use cases, threat agents, attack vectors and patterns, design patterns, and compensating controls needed to mitigate risk. Organizations that apply systems security and privacy engineering concepts and principles can facilitate the development of trustworthy, secure systems, system components, and system services; reduce risk to acceptable levels; and make informed risk management decisions. System security engineering principles can also be used to protect against certain supply chain risks, including incorporating tamper-resistant hardware into a design.

ATT&CK mappings (CTID)

• T1005 Data from Local System • T1025 Data from Removable Media • T1041 Exfiltration Over C2 Channel • T1048 Exfiltration Over Alternative Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1078 Valid Accounts • T1078.001 Default Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1134.005 SID-History Injection • T1190 Exploit Public-Facing Application • T1213.003 Code Repositories • T1482 Domain Trust Discovery • T1559.003 XPC Services • T1567 Exfiltration Over Web Service • T1574.002 DLL Side-Loading • T1647 Plist File Modification

Related

Mitigates · not in database (1)

Mitigates · MITRE ATT&CK (19)

  • T1647 Plist File Modification technique
  • T1559.003 XPC Services sub-technique
  • T1213.003 Code Repositories sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1078.001 Default Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1052.001 Exfiltration over USB sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1134.005 SID-History Injection sub-technique
  • T1482 Domain Trust Discovery technique
  • T1190 Exploit Public-Facing Application technique
  • T1005 Data from Local System technique
  • T1025 Data from Removable Media technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1052 Exfiltration Over Physical Medium technique
  • T1078 Valid Accounts technique

Related control · Compliance (18)

  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-RA-2 Security Categorization NIST 800-53 control
  • NIST-RA-3 Risk Assessment NIST 800-53 control
  • NIST-RA-9 Criticality Analysis NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-20 Customized Development of Critical Components NIST 800-53 control
  • NIST-SA-3 System Development Life Cycle NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SC-2 Separation of System and User Functionality NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-32 System Partitioning NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SR-2 Supply Chain Risk Management Plan NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

Referenced by Compliance · enhancement of (33)

Show all 33 ›

Referenced by Compliance · has member (1)

  • NIST-SA System and Services Acquisition NIST 800-53 family

Referenced by Compliance · related control (71)

  • NIST-AC-25 Reference Monitor NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AT-2 Literacy Training and Awareness NIST 800-53 control
  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-12 Audit Record Generation NIST 800-53 control
  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-AU-3 Content of Audit Records NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-1 Policy and Procedures NIST 800-53 control
  • NIST-CM-12 Information Location NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CP-10 System Recovery and Reconstitution NIST 800-53 control
  • NIST-CP-12 Safe Mode NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IR-4 Incident Handling NIST 800-53 control
  • NIST-PE-8(3) Limit Personally Identifiable Information Elements NIST 800-53 enhancement
  • NIST-PL-10 Baseline Selection NIST 800-53 control
  • NIST-PL-11 Baseline Tailoring NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research NIST 800-53 control
  • NIST-PM-7 Enterprise Architecture NIST 800-53 control
  • NIST-PM-7(1) Offloading NIST 800-53 enhancement
Show all 71 ›