NIST-SC-46 Cross Domain Policy Enforcement

Implement a policy enforcement mechanism [Selection (one of): physically; logically] between the physical and/or network interfaces for the connecting security domains.

For logical policy enforcement mechanisms, organizations avoid creating a logical path between interfaces to prevent the ability to bypass the policy enforcement mechanism. For physical policy enforcement mechanisms, the robustness of physical isolation afforded by the physical implementation of policy enforcement to preclude the presence of logical covert channels penetrating the security domain may be needed. Contact [[email protected]](mailto:[email protected]) for more information.

• T1021.001 Remote Desktop Protocol • T1021.003 Distributed Component Object Model • T1021.006 Windows Remote Management • T1046 Network Service Discovery • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1072 Software Deployment Tools • T1098.001 Additional Cloud Credentials • T1133 External Remote Services • T1136 Create Account • T1136.002 Domain Account • T1190 Exploit Public-Facing Application • T1199 Trusted Relationship • T1210 Exploitation of Remote Services • T1482 Domain Trust Discovery • T1489 Service Stop • T1552.007 Container API • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.003 DHCP Spoofing • T1557.004 Evil Twin • T1563 Remote Service Session Hijacking • T1563.002 RDP Hijacking • T1565 Data Manipulation • T1565.003 Runtime Data Manipulation • T1622 Debugger Evasion