ComplianceNIST 800-53 control

NIST-SC-26 Decoys

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-26
ATT&CK techniques mitigated
3

Control statement

Include components within organizational systems specifically designed to be the target of malicious attacks for detecting, deflecting, and analyzing such attacks.

Discussion

Decoys (i.e., honeypots, honeynets, or deception nets) are established to attract adversaries and deflect attacks away from the operational systems that support organizational mission and business functions. Use of decoys requires some supporting isolation measures to ensure that any deflected malicious code does not infect organizational systems. Depending on the specific usage of the decoy, consultation with the Office of the General Counsel before deployment may be needed.

ATT&CK mappings (CTID)

• T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access

Related

Mitigates · MITRE ATT&CK (3)

  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique
  • T1212 Exploitation for Credential Access technique

Related control · Compliance (7)

  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-30 Concealment and Misdirection NIST 800-53 control
  • NIST-SC-35 External Malicious Code Identification NIST 800-53 control
  • NIST-SC-44 Detonation Chambers NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (7)

  • NIST-RA-5(4) Discoverable Information NIST 800-53 enhancement
  • NIST-SC-30 Concealment and Misdirection NIST 800-53 control
  • NIST-SC-35 External Malicious Code Identification NIST 800-53 control
  • NIST-SC-44 Detonation Chambers NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control