ComplianceNIST 800-53 control

NIST-SC-41 Port and I/O Device Access

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-41
ATT&CK techniques mitigated
5

Control statement

[Selection (one of): physically; logically] disable or remove [Assignment: connection ports or input/output devices] on the following systems or system components: [Assignment: systems or system components].

Discussion

Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/output (I/O) devices include compact disc and digital versatile disc drives. Disabling or removing such connection ports and I/O devices helps prevent the exfiltration of information from systems and the introduction of malicious code from those ports or devices. Physically disabling or removing ports and/or devices is the stronger action.

ATT&CK mappings (CTID)

• T1025 Data from Removable Media • T1052 Exfiltration Over Physical Medium • T1052.001 Exfiltration over USB • T1091 Replication Through Removable Media • T1200 Hardware Additions

Related

Mitigates · MITRE ATT&CK (5)

  • T1052.001 Exfiltration over USB sub-technique
  • T1200 Hardware Additions technique
  • T1025 Data from Removable Media technique
  • T1052 Exfiltration Over Physical Medium technique
  • T1091 Replication Through Removable Media technique

Related control · Compliance (2)

  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-MP-7 Media Use NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (3)

  • NIST-AC-20(2) Portable Storage Devices — Restricted Use NIST 800-53 enhancement
  • NIST-AC-20(5) Portable Storage Devices — Prohibited Use NIST 800-53 enhancement
  • NIST-MP-7 Media Use NIST 800-53 control