ComplianceNIST 800-53 control

NIST-SC-2 Separation of System and User Functionality

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-2
ATT&CK techniques mitigated
8

Control statement

Separate user functionality, including user interface services, from system management functionality.

Discussion

System management functionality includes functions that are necessary to administer databases, network components, workstations, or servers. These functions typically require privileged user access. The separation of user functions from system management functions is physical or logical. Organizations may separate system management functions from user functions by using different computers, instances of operating systems, central processing units, or network addresses; by employing virtualization techniques; or some combination of these or other methods. Separation of system management functions from user functions includes web administrative interfaces that employ separate authentication methods for users of any other system resources. Separation of system and user functions may include isolating administrative interfaces on different domains and with additional access controls. The separation of system and user functionality can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).

ATT&CK mappings (CTID)

• T1068 Exploitation for Privilege Escalation • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1611 Escape to Host

Related

Mitigates · MITRE ATT&CK (8)

  • T1611 Escape to Host technique
  • T1189 Drive-by Compromise technique
  • T1190 Exploit Public-Facing Application technique
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique
  • T1212 Exploitation for Credential Access technique
  • T1068 Exploitation for Privilege Escalation technique

Related control · Compliance (8)

  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-32 System Partitioning NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control

Referenced by Compliance · enhancement of (2)

  • NIST-SC-2(1) Interfaces for Non-privileged Users NIST 800-53 enhancement
  • NIST-SC-2(2) Disassociability NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (13)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-3(15) Discretionary and Mandatory Access Control NIST 800-53 enhancement
  • NIST-AC-6(4) Separate Processing Domains NIST 800-53 enhancement
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-PL-8(1) Defense in Depth NIST 800-53 enhancement
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-8(3) Modularity and Layering NIST 800-53 enhancement
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SC-32 System Partitioning NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SC-50 Software-enforced Separation and Policy Enforcement NIST 800-53 control
  • NIST-SC-7(13) Isolation of Security Tools, Mechanisms, and Support Components NIST 800-53 enhancement