ComplianceNIST 800-53 control

NIST-SC-23 Session Authenticity

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-23
ATT&CK techniques mitigated
20

Control statement

Protect the authenticity of communications sessions.

Discussion

Protecting session authenticity addresses communications protection at the session level, not at the packet level. Such protection establishes grounds for confidence at both ends of communications sessions in the ongoing identities of other parties and the validity of transmitted information. Authenticity protection includes protecting against "man-in-the-middle" attacks, session hijacking, and the insertion of false information into sessions.

ATT&CK mappings (CTID)

• T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1185 Browser Session Hijacking • T1535 Unused/Unsupported Cloud Regions • T1550.004 Web Session Cookie • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1557.004 Evil Twin • T1562.006 Indicator Blocking • T1562.009 Safe Mode Boot • T1563.001 SSH Hijacking • T1573 Encrypted Channel • T1573.001 Symmetric Cryptography • T1573.002 Asymmetric Cryptography • T1622 Debugger Evasion

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (18)

  • T1557.004 Evil Twin sub-technique
  • T1622 Debugger Evasion technique
  • T1557.003 DHCP Spoofing sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1071.004 DNS sub-technique
  • T1563.001 SSH Hijacking sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1557.001 Name Resolution Poisoning and SMB Relay sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1535 Unused/Unsupported Cloud Regions technique
  • T1185 Browser Session Hijacking technique
  • T1071 Application Layer Protocol technique

Related control · Compliance (4)

  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-11 Trusted Path NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (3)

  • NIST-SC-23(1) Invalidate Session Identifiers at Logout NIST 800-53 enhancement
  • NIST-SC-23(3) Unique System-generated Session Identifiers NIST 800-53 enhancement
  • NIST-SC-23(5) Allowed Certificate Authorities NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (10)

  • NIST-AC-10 Concurrent Session Control NIST 800-53 control
  • NIST-AC-12 Session Termination NIST 800-53 control
  • NIST-AC-17(10) Authenticate Remote Commands NIST 800-53 enhancement
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-CP-2 Contingency Plan NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-11 Trusted Path NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control