ComplianceNIST 800-53 control

NIST-SC-29 Heterogeneity

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-29
ATT&CK techniques mitigated
5

Control statement

Employ a diverse set of information technologies for the following system components in the implementation of the system: [Assignment: system components].

Discussion

Increasing the diversity of information technologies within organizational systems reduces the impact of potential exploitations or compromises of specific technologies. Such diversity protects against common mode failures, including those failures induced by supply chain attacks. Diversity in information technologies also reduces the likelihood that the means adversaries use to compromise one system component will be effective against other system components, thus further increasing the adversary work factor to successfully complete planned attacks. An increase in diversity may add complexity and management overhead that could ultimately lead to mistakes and unauthorized configurations.

ATT&CK mappings (CTID)

• T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion

Related

Mitigates · MITRE ATT&CK (5)

  • T1189 Drive-by Compromise technique
  • T1190 Exploit Public-Facing Application technique
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique

Related control · Compliance (5)

  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-PL-8 Security and Privacy Architectures NIST 800-53 control
  • NIST-SC-27 Platform-independent Applications NIST 800-53 control
  • NIST-SC-30 Concealment and Misdirection NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control

Referenced by Compliance · enhancement of (1)

  • NIST-SC-29(1) Virtualization Techniques NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (7)

  • NIST-AU-9(7) Store on Component with Different Operating System NIST 800-53 enhancement
  • NIST-PL-8(1) Defense in Depth NIST 800-53 enhancement
  • NIST-PL-8(2) Supplier Diversity NIST 800-53 enhancement
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SC-27 Platform-independent Applications NIST 800-53 control
  • NIST-SC-30 Concealment and Misdirection NIST 800-53 control
  • NIST-SR-3 Supply Chain Controls and Processes NIST 800-53 control