ComplianceNIST 800-53 control

NIST-SC-3 Security Function Isolation

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-3
ATT&CK techniques mitigated
18

Control statement

Isolate security functions from nonsecurity functions.

Discussion

Security functions are isolated from nonsecurity functions by means of an isolation boundary implemented within a system via partitions and domains. The isolation boundary controls access to and protects the integrity of the hardware, software, and firmware that perform system security functions. Systems implement code separation in many ways, such as through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that protect the code on disk and address space protections that protect executing code. Systems can restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. While the ideal is for all code within the defined security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions as an exception. The isolation of security functions from nonsecurity functions can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).

ATT&CK mappings (CTID)

• T1003.001 LSASS Memory • T1021.003 Distributed Component Object Model • T1047 Windows Management Instrumentation • T1068 Exploitation for Privilege Escalation • T1134.005 SID-History Injection • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1203 Exploitation for Client Execution • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1559.002 Dynamic Data Exchange • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1611 Escape to Host

Related

Mitigates · MITRE ATT&CK (18)

  • T1611 Escape to Host technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1134.005 SID-History Injection sub-technique
  • T1559 Inter-Process Communication technique
  • T1559.001 Component Object Model sub-technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.003 Distributed Component Object Model sub-technique
  • T1189 Drive-by Compromise technique
  • T1190 Exploit Public-Facing Application technique
  • T1203 Exploitation for Client Execution technique
  • T1210 Exploitation of Remote Services technique
  • T1211 Exploitation for Stealth technique
  • T1212 Exploitation for Credential Access technique
  • T1047 Windows Management Instrumentation technique
  • T1068 Exploitation for Privilege Escalation technique

Related control · Compliance (15)

  • NIST-AC-25 Reference Monitor NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-SA-15 Development Process, Standards, and Tools NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-5 System Documentation NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-2 Separation of System and User Functionality NIST 800-53 control
  • NIST-SC-32 System Partitioning NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control

Referenced by Compliance · enhancement of (5)

  • NIST-SC-3(1) Hardware Separation NIST 800-53 enhancement
  • NIST-SC-3(2) Access and Flow Control Functions NIST 800-53 enhancement
  • NIST-SC-3(3) Minimize Nonsecurity Functionality NIST 800-53 enhancement
  • NIST-SC-3(4) Module Coupling and Cohesiveness NIST 800-53 enhancement
  • NIST-SC-3(5) Layered Structures NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (19)

  • NIST-AC-25 Reference Monitor NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-3(15) Discretionary and Mandatory Access Control NIST 800-53 enhancement
  • NIST-AC-6(4) Separate Processing Domains NIST 800-53 enhancement
  • NIST-CM-2(6) Development and Test Environments NIST 800-53 enhancement
  • NIST-CM-4(2) Verification of Controls NIST 800-53 enhancement
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8(3) Automated Unauthorized Component Detection NIST 800-53 enhancement
  • NIST-PL-8(1) Defense in Depth NIST 800-53 enhancement
  • NIST-SA-17(5) Conceptually Simple Design NIST 800-53 enhancement
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SA-8(3) Modularity and Layering NIST 800-53 enhancement
  • NIST-SC-2 Separation of System and User Functionality NIST 800-53 control
  • NIST-SC-32 System Partitioning NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SC-50 Software-enforced Separation and Policy Enforcement NIST 800-53 control
  • NIST-SC-7(13) Isolation of Security Tools, Mechanisms, and Support Components NIST 800-53 enhancement
  • NIST-SI-16 Memory Protection NIST 800-53 control