ComplianceNIST 800-53 control

NIST-SC-34 Non-modifiable Executable Programs

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-34
ATT&CK techniques mitigated
15

Control statement

For [Assignment: system components] , load and execute: a. The operating environment from hardware-enforced, read-only media; and b. The following applications from hardware-enforced, read-only media: [Assignment: applications].

Discussion

The operating environment for a system contains the code that hosts applications, including operating systems, executives, or virtual machine monitors (i.e., hypervisors). It can also include certain applications that run directly on hardware platforms. Hardware-enforced, read-only media include Compact Disc-Recordable (CD-R) and Digital Versatile Disc-Recordable (DVD-R) disk drives as well as one-time, programmable, read-only memory. The use of non-modifiable storage ensures the integrity of software from the point of creation of the read-only image. The use of reprogrammable, read-only memory can be accepted as read-only media provided that integrity can be adequately protected from the point of initial writing to the insertion of the memory into the system, and there are reliable hardware protections against reprogramming the memory while installed in organizational systems.

ATT&CK mappings (CTID)

• T1195.003 Compromise Hardware Supply Chain • T1218.015 Electron Applications • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1548 Abuse Elevation Control Mechanism • T1548.004 Elevated Execution with Prompt • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1611 Escape to Host

Related

Mitigates · MITRE ATT&CK (15)

  • T1218.015 Electron Applications sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1611 Escape to Host technique
  • T1542.004 ROMMONkit sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1553 Subvert Trust Controls technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1548.004 Elevated Execution with Prompt sub-technique
  • T1542.001 System Firmware sub-technique
  • T1542.003 Bootkit sub-technique
  • T1542 Pre-OS Boot technique

Related control · Compliance (3)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-SI-14 Non-persistence NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (2)

  • NIST-SC-34(1) No Writable Storage NIST 800-53 enhancement
  • NIST-SC-34(2) Integrity Protection on Read-only Media NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (12)

  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-7(5) Authorized Software — Allow-by-exception NIST 800-53 enhancement
  • NIST-MP-2 Media Access NIST 800-53 control
  • NIST-MP-4 Media Storage NIST 800-53 control
  • NIST-MP-5 Media Transport NIST 800-53 control
  • NIST-MP-7 Media Use NIST 800-53 control
  • NIST-SA-24 Design For Cyber Resiliency NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SI-14 Non-persistence NIST 800-53 control