ComplianceNIST 800-53 control

NIST-SI-8 Spam Protection

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: SI System and Information Integrity
Control: SI-8
ATT&CK techniques mitigated: 20

Control statement

a. Employ spam protection mechanisms at system entry and exit points to detect and act on unsolicited messages; and b. Update spam protection mechanisms when new releases are available in accordance with organizational configuration management policy and procedures.

Discussion

System entry and exit points include firewalls, remote-access servers, electronic mail servers, web servers, proxy servers, workstations, notebook computers, and mobile devices. Spam can be transported by different means, including email, email attachments, and web accesses. Spam protection mechanisms include signature definitions.

ATT&CK mappings (CTID)

• T1137 Office Application Startup • T1137.001 Office Template Macros • T1137.002 Office Test • T1137.003 Outlook Forms • T1137.004 Outlook Home Page • T1137.005 Outlook Rules • T1137.006 Add-ins • T1204 User Execution • T1204.001 Malicious Link • T1204.002 Malicious File • T1204.003 Malicious Image • T1221 Template Injection • T1566 Phishing • T1566.001 Spearphishing Attachment • T1566.002 Spearphishing Link • T1566.003 Spearphishing via Service • T1598 Phishing for Information • T1598.001 Spearphishing Service • T1598.002 Spearphishing Attachment • T1598.003 Spearphishing Link

Mitigates · MITRE ATT&CK (20)

T1204.003 Malicious Image sub-technique
T1598 Phishing for Information technique
T1598.001 Spearphishing Service sub-technique
T1598.002 Spearphishing Attachment sub-technique
T1598.003 Spearphishing Link sub-technique
T1204.001 Malicious Link sub-technique
T1204.002 Malicious File sub-technique
T1566 Phishing technique
T1566.001 Spearphishing Attachment sub-technique
T1566.002 Spearphishing Link sub-technique
T1566.003 Spearphishing via Service sub-technique
T1137.001 Office Template Macros sub-technique
T1137.002 Office Test sub-technique
T1137.003 Outlook Forms sub-technique
T1137.004 Outlook Home Page sub-technique
T1137.005 Outlook Rules sub-technique
T1137.006 Add-ins sub-technique
T1221 Template Injection technique
T1204 User Execution technique
T1137 Office Application Startup technique

Related control · Compliance (6)

NIST-PL-9 Central Management NIST 800-53 control
NIST-SC-38 Operations Security NIST 800-53 control
NIST-SC-5 Denial-of-service Protection NIST 800-53 control
NIST-SC-7 Boundary Protection NIST 800-53 control
NIST-SI-3 Malicious Code Protection NIST 800-53 control
NIST-SI-4 System Monitoring NIST 800-53 control

Referenced by Compliance · enhancement of (2)

NIST-SI-8(2) Automatic Updates NIST 800-53 enhancement
NIST-SI-8(3) Continuous Learning Capability NIST 800-53 enhancement

Referenced by Compliance · has member (1)

NIST-SI System and Information Integrity NIST 800-53 family

Referenced by Compliance · related control (3)

NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-SI-3 Malicious Code Protection NIST 800-53 control
NIST-SI-7(3) Centrally Managed Integrity Tools NIST 800-53 enhancement