ComplianceNIST 800-53 control

NIST-SC-8 Transmission Confidentiality and Integrity

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SC System and Communications Protection
Control
SC-8
ATT&CK techniques mitigated
21

Control statement

Protect the [Selection (one or more of): confidentiality; integrity] of transmitted information.

Discussion

Protecting the confidentiality and integrity of transmitted information applies to internal and external networks as well as any system components that can transmit information, including servers, notebook computers, desktop computers, mobile devices, printers, copiers, scanners, facsimile machines, and radios. Unprotected communication paths are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of information can be accomplished by physical or logical means. Physical protection can be achieved by using protected distribution systems. A protected distribution system is a wireline or fiber-optics telecommunications system that includes terminals and adequate electromagnetic, acoustical, electrical, and physical controls to permit its use for the unencrypted transmission of classified information. Logical protection can be achieved by employing encryption techniques. Organizations that rely on commercial providers who offer transmission services as commodity services rather than as fully dedicated services may find it difficult to obtain the necessary assurances regarding the implementation of needed controls for transmission confidentiality and integrity. In such situations, organizations determine what types of confidentiality or integrity services are available in standard, commercial telecommunications service packages. If it is not feasible to obtain the necessary controls and assurances of control effectiveness through appropriate contracting vehicles, organizations can implement appropriate compensating controls.

ATT&CK mappings (CTID)

• T1020.001 Traffic Duplication • T1040 Network Sniffing • T1090 Proxy • T1090.004 Domain Fronting • T1550.001 Application Access Token • T1550.004 Web Session Cookie • T1552.007 Container API • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1557.004 Evil Twin • T1562 Impair Defenses • T1562 Impair Defenses • T1562.006 Indicator Blocking • T1562.009 Safe Mode Boot • T1562.010 Downgrade Attack • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1622 Debugger Evasion

Related

Mitigates · not in database (4)

Mitigates · MITRE ATT&CK (16)

  • T1557.004 Evil Twin sub-technique
  • T1622 Debugger Evasion technique
  • T1557.003 DHCP Spoofing sub-technique
  • T1552.007 Container API sub-technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1020.001 Traffic Duplication sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1090.004 Domain Fronting sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1557.001 Name Resolution Poisoning and SMB Relay sub-technique
  • T1550.001 Application Access Token sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1040 Network Sniffing technique
  • T1090 Proxy technique

Related control · Compliance (15)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-MA-4 Nonlocal Maintenance NIST 800-53 control
  • NIST-PE-4 Access Control for Transmission NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control

Referenced by Compliance · enhancement of (5)

  • NIST-SC-8(1) Cryptographic Protection NIST 800-53 enhancement
  • NIST-SC-8(2) Pre- and Post-transmission Handling NIST 800-53 enhancement
  • NIST-SC-8(3) Cryptographic Protection for Message Externals NIST 800-53 enhancement
  • NIST-SC-8(4) Conceal or Randomize Communications NIST 800-53 enhancement
  • NIST-SC-8(5) Protected Distribution System NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-SC System and Communications Protection NIST 800-53 family

Referenced by Compliance · related control (21)

  • NIST-AC-17(2) Protection of Confidentiality and Integrity Using Encryption NIST 800-53 enhancement
  • NIST-AC-18(1) Authentication and Encryption NIST 800-53 enhancement
  • NIST-AU-10 Non-repudiation NIST 800-53 control
  • NIST-AU-9 Protection of Audit Information NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-IA-3(1) Cryptographic Bidirectional Authentication NIST 800-53 enhancement
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control
  • NIST-IA-9 Service Identification and Authentication NIST 800-53 control
  • NIST-MA-4(6) Cryptographic Protection NIST 800-53 enhancement
  • NIST-PE-4 Access Control for Transmission NIST 800-53 control
  • NIST-SA-4(6) Use of Information Assurance Products NIST 800-53 enhancement
  • NIST-SA-8(18) Trusted Communications Channels NIST 800-53 enhancement
  • NIST-SA-8(24) Secure Failure and Recovery NIST 800-53 enhancement
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-13 Cryptographic Protection NIST 800-53 control
  • NIST-SC-16(1) Integrity Verification NIST 800-53 enhancement
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-7(4) External Telecommunications Services NIST 800-53 enhancement
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control