SC-7Boundary Protection

Implementations targeting this control (4)

• aws-config-rds-instance-public-access-check RDS instances are not publicly accessible AWS::RDS::DBInstance partial
• aws-config-ec2-imdsv2-check EC2 instances require IMDSv2 AWS::EC2::Instance partial
• aws-config-incoming-ssh-disabled Security groups disallow unrestricted SSH ingress AWS::EC2::SecurityGroup mostly
• aws-config-restricted-common-ports Security groups disallow unrestricted common-port ingress AWS::EC2::SecurityGroup mostly

ATT&CK techniques this control mitigates (156)

• T1001 Data Obfuscation Command And Control
• T1001.001 Junk Data Command And Control
• T1001.002 Steganography Command And Control
• T1001.003 Protocol or Service Impersonation Command And Control
• T1008 Fallback Channels Command And Control
• T1020.001 Traffic Duplication Exfiltration
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1029 Scheduled Transfer Exfiltration
• T1030 Data Transfer Size Limits Exfiltration
• T1036.008 Masquerade File Type Stealth
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1046 Network Service Discovery Discovery
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1055 Process Injection Stealth, Privilege Escalation
• T1055.001 Dynamic-link Library Injection Stealth, Privilege Escalation
• T1055.002 Portable Executable Injection Stealth, Privilege Escalation
• T1055.003 Thread Execution Hijacking Stealth, Privilege Escalation
• T1055.004 Asynchronous Procedure Call Stealth, Privilege Escalation
• T1055.005 Thread Local Storage Stealth, Privilege Escalation
• T1055.008 Ptrace System Calls Stealth, Privilege Escalation
• T1055.009 Proc Memory Stealth, Privilege Escalation
• T1055.011 Extra Window Memory Injection Stealth, Privilege Escalation
• T1055.012 Process Hollowing Stealth, Privilege Escalation
• T1055.013 Process Doppelgänging Stealth, Privilege Escalation
• T1055.014 VDSO Hijacking Stealth, Privilege Escalation
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1071 Application Layer Protocol Command And Control
• T1071.001 Web Protocols Command And Control
• T1071.002 File Transfer Protocols Command And Control
• T1071.003 Mail Protocols Command And Control
• T1071.004 DNS Command And Control
• T1071.005 Publish/Subscribe Protocols Command And Control
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
• T1080 Taint Shared Content Lateral Movement
• T1090 Proxy Command And Control
• T1090.001 Internal Proxy Command And Control
• T1090.002 External Proxy Command And Control
• T1090.003 Multi-hop Proxy Command And Control
• T1095 Non-Application Layer Protocol Command And Control
• T1098 Account Manipulation Persistence, Privilege Escalation
• T1098.001 Additional Cloud Credentials Persistence, Privilege Escalation
• T1102 Web Service Command And Control

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SC