NIST-SC-7 Boundary Protection

a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b. Implement subnetworks for publicly accessible system components that are [Selection (one of): physically; logically] separated from internal organizational networks; and c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).

• T1001 Data Obfuscation • T1001.001 Junk Data • T1001.002 Steganography • T1001.003 Protocol or Service Impersonation • T1008 Fallback Channels • T1020.001 Traffic Duplication • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.005 VNC • T1021.006 Windows Remote Management • T1029 Scheduled Transfer • T1030 Data Transfer Size Limits • T1036.008 Masquerade File Type • T1041 Exfiltration Over C2 Channel • T1046 Network Service Discovery • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1068 Exploitation for Privilege Escalation • T1071 Application Layer Protocol • T1071.001 Web Protocols • T1071.002 File Transfer Protocols • T1071.003 Mail Protocols • T1071.004 DNS • T1071.005 Publish/Subscribe Protocols • T1072 Software Deployment Tools • T1078 Valid Accounts • T1080 Taint Shared Content • T1090 Proxy • T1090.001 Internal Proxy • T1090.002 External Proxy • T1090.003 Multi-hop Proxy • T1095 Non-Application Layer Protocol • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1102 Web Service • T1102.001 Dead Drop Resolver • T1102.002 Bidirectional Communication • T1102.003 One-Way Communication • T1104 Multi-Stage Channels • T1105 Ingress Tool Transfer • T1114 Email Collection • T1114.003 Email Forwarding Rule • T1132 Data Encoding • T1132.001 Standard Encoding • T1132.002 Non-Standard Encoding • T1133 External Remote Services • T1136 Create Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1176 Browser Extensions • T1187 Forced Authentication • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1197 BITS Jobs • T1199 Trusted Relationship • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1205 Traffic Signaling • T1205.001 Port Knocking • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1218 System Binary Proxy Execution • T1218.012 Verclsid • T1218.015 Electron Applications • T1219 Remote Access Software • T1221 Template Injection • T1482 Domain Trust Discovery • T1489 Service Stop • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1505.004 IIS Components • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1542 Pre-OS Boot • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1552 Unsecured Credentials • T1552.001 Credentials In Files • T1552.004 Private Keys • T1552.005 Cloud Instance Metadata API • T1552.007 Container API • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1557.004 Evil Twin • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1559.002 Dynamic Data Exchange • T1560 Archive Collected Data • T1560.001 Archive via Utility • T1563 Remote Service Session Hijacking • T1563.002 RDP Hijacking • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.003 Runtime Data Manipulation • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.002 Spearphishing Link • T1566.003 Spearphishing via Service • T1567 Exfiltration Over Web Service • T1567.001 Exfiltration to Code Repository • T1567.002 Exfiltration to Cloud Storage • T1567.003 Exfiltration to Text Storage Sites • T1567.004 Exfiltration Over Webhook • T1568 Dynamic Resolution • T1568.002 Domain Generation Algorithms • T1570 Lateral Tool Transfer • T1571 Non-Standard Port • T1572 Protocol Tunneling • T1573 Encrypted Channel • T1573.001 Symmetric Cryptography • T1573.002 Asymmetric Cryptography • T1590.002 DNS • T1598 Phishing for Information • T1598.001 Spearphishing Service • T1598.002 Spearphishing Attachment • T1598.003 Spearphishing Link • T1599 Network Boundary Bridging • T1599.001 Network Address Translation Traversal • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1609 Container Administration Command • T1610 Deploy Container … and 6 more