ComplianceNIST 800-53 control

NIST-SI-15 Information Output Filtering

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
SI System and Information Integrity
Control
SI-15
ATT&CK techniques mitigated
42

Control statement

Validate information output from the following software programs and/or applications to ensure that the information is consistent with the expected content: [Assignment: software programs and/or applications].

Discussion

Certain types of attacks, including SQL injections, produce output results that are unexpected or inconsistent with the output results that would be expected from software programs or applications. Information output filtering focuses on detecting extraneous content, preventing such extraneous content from being displayed, and then alerting monitoring tools that anomalous behavior has been discovered.

ATT&CK mappings (CTID)

• T1021.002 SMB/Windows Admin Shares • T1021.005 VNC • T1048 Exfiltration Over Alternative Protocol • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol • T1071.004 DNS • T1090 Proxy • T1090.003 Multi-hop Proxy • T1095 Non-Application Layer Protocol • T1187 Forced Authentication • T1197 BITS Jobs • T1205 Traffic Signaling • T1205.001 Port Knocking • T1218.012 Verclsid • T1218.015 Electron Applications • T1219 Remote Access Software • T1498 Network Denial of Service • T1498.001 Direct Network Flood • T1498.002 Reflection Amplification • T1499 Endpoint Denial of Service • T1499.001 OS Exhaustion Flood • T1499.002 Service Exhaustion Flood • T1499.003 Application Exhaustion Flood • T1499.004 Application or System Exploitation • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1552 Unsecured Credentials • T1552.005 Cloud Instance Metadata API • T1557 Adversary-in-the-Middle • T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay • T1557.002 ARP Cache Poisoning • T1557.003 DHCP Spoofing • T1564.009 Resource Forking • T1570 Lateral Tool Transfer • T1572 Protocol Tunneling • T1599 Network Boundary Bridging • T1599.001 Network Address Translation Traversal • T1602 Data from Configuration Repository • T1602.001 SNMP (MIB Dump) • T1602.002 Network Device Configuration Dump • T1622 Debugger Evasion

Related

Mitigates · MITRE ATT&CK (42)

  • T1218.015 Electron Applications sub-technique
  • T1622 Debugger Evasion technique
  • T1557.003 DHCP Spoofing sub-technique
  • T1564.009 Resource Forking sub-technique
  • T1602.002 Network Device Configuration Dump sub-technique
  • T1599 Network Boundary Bridging technique
  • T1599.001 Network Address Translation Traversal sub-technique
  • T1602 Data from Configuration Repository technique
  • T1602.001 SNMP (MIB Dump) sub-technique
  • T1557.002 ARP Cache Poisoning sub-technique
  • T1218.012 Verclsid sub-technique
  • T1205.001 Port Knocking sub-technique
  • T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.004 DNS sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1498.001 Direct Network Flood sub-technique
  • T1498.002 Reflection Amplification sub-technique
  • T1499.001 OS Exhaustion Flood sub-technique
  • T1499.002 Service Exhaustion Flood sub-technique
  • T1499.003 Application Exhaustion Flood sub-technique
  • T1499.004 Application or System Exploitation sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1021.005 VNC sub-technique
  • T1552.005 Cloud Instance Metadata API sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1557.001 Name Resolution Poisoning and SMB Relay sub-technique
Show all 42 ›

Related control · Compliance (3)

  • NIST-SI-11 Error Handling NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · has member (1)

  • NIST-SI System and Information Integrity NIST 800-53 family

Referenced by Compliance · related control (8)