NIST-SI-2 Flaw Remediation

a. Identify, report, and correct system flaws; b. Test software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c. Install security-relevant software and firmware updates within [Assignment: time period] of the release of the updates; and d. Incorporate flaw remediation into the organizational configuration management process.

The need to remediate system flaws applies to all types of software and firmware. Organizations identify systems affected by software flaws, including potential vulnerabilities resulting from those flaws, and report this information to designated organizational personnel with information security and privacy responsibilities. Organizations consider establishing a controlled patching environment for mission-critical systems. Security-relevant updates include patches, service packs, and malicious code signatures. Organizations also address flaws discovered during assessments, continuous monitoring, incident response activities, and system error handling. By incorporating flaw remediation into configuration management processes, required remediation actions can be tracked and verified. Organization-defined time periods for updating security-relevant software and firmware may vary based on a variety of risk factors, including the security category of the system, the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw), the organizational risk tolerance, the mission supported by the system, or the threat environment. Some types of flaw remediation may require more testing than other types. Organizations determine the type of testing needed for the specific type of flaw remediation activity under consideration and the types of changes that are to be configuration-managed. Flaw remediation testing addresses both effectiveness of addressing security issues and for potential side effects on functionality, system and system component performance and operations. When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). In some situations, organizations may determine that the testing of software or firmware updates is not necessary or practical, such as when implementing simple malicious code signature updates. In testing decisions, organizations consider whether security-relevant software or firmware updates are obtained from authorized sources with appropriate digital signatures. When implementing remediation activities, organizations consider the order and timing of updates to validate correct execution within the system environment, and to support system and component availability needs (i.e., implementing a staggered deployment strategy). Organizations verify that software and firmware updates come from authorized sources prior to downloading.

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1027 Obfuscated Files or Information • T1027.002 Software Packing • T1027.007 Dynamic API Resolution • T1027.008 Stripped Payloads • T1027.009 Embedded Payloads • T1047 Windows Management Instrumentation • T1055 Process Injection • T1055.001 Dynamic-link Library Injection • T1055.002 Portable Executable Injection • T1055.003 Thread Execution Hijacking • T1055.004 Asynchronous Procedure Call • T1055.005 Thread Local Storage • T1055.008 Ptrace System Calls • T1055.009 Proc Memory • T1055.011 Extra Window Memory Injection • T1055.012 Process Hollowing • T1055.013 Process Doppelgänging • T1055.014 VDSO Hijacking • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.005 Visual Basic • T1059.006 Python • T1068 Exploitation for Privilege Escalation • T1072 Software Deployment Tools • T1106 Native API • T1137 Office Application Startup • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1189 Drive-by Compromise • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.002 Compromise Software Supply Chain • T1195.003 Compromise Hardware Supply Chain • T1203 Exploitation for Client Execution • T1204 User Execution • T1204.001 Malicious Link • T1204.003 Malicious Image • T1210 Exploitation of Remote Services • T1211 Exploitation for Defense Evasion • T1212 Exploitation for Credential Access • T1213.003 Code Repositories • T1213.005 Messaging Applications • T1221 Template Injection • T1495 Firmware Corruption • T1525 Implant Internal Image • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1546 Event Triggered Execution • T1546.006 LC_LOAD_DYLIB Addition • T1546.010 AppInit DLLs • T1546.011 Application Shimming • T1546.016 Installer Packages • T1547.006 Kernel Modules and Extensions • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.006 TCC Manipulation • T1550.002 Pass the Hash • T1552 Unsecured Credentials • T1552.006 Group Policy Preferences • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1555 Credentials from Password Stores • T1555.005 Password Managers • T1559 Inter-Process Communication • T1559.002 Dynamic Data Exchange • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.003 Spearphishing via Service • T1574 Hijack Execution Flow • T1574.002 DLL Side-Loading • T1574.013 KernelCallbackTable • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1606 Forge Web Credentials • T1606.001 Web Cookies • T1611 Escape to Host