AC-4Information Flow Enforcement

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 3 mapping(s) from 1 framework(s): CSF 2.0 3 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (5)

• aws-config-incoming-ssh-disabled Security groups disallow unrestricted SSH ingress AWS::EC2::SecurityGroup partial protect enforce
• azure-mcsb-network-restrict-public-storage Storage accounts deny public-blob access Microsoft.Storage/storageAccounts partial protect enforce
• azure-mcsb-network-flow-logs NSG flow logs are enabled Microsoft.Network/networkSecurityGroups partial protect enforce
• gcp-cis-storage-bucket-public-access-prohibited Cloud Storage buckets disallow allUsers / allAuthenticatedUsers storage.googleapis.com/Bucket partial protect enforce
• gcp-cis-vpc-flow-logs-enabled VPC subnetworks have flow logs enabled compute.googleapis.com/Subnetwork partial protect enforce

ATT&CK techniques this control mitigates (158)

• T1001 Data Obfuscation Command And Control
• T1001.001 Junk Data Command And Control
• T1001.002 Steganography Command And Control
• T1001.003 Protocol or Service Impersonation Command And Control
• T1003 OS Credential Dumping Credential Access
• T1003.001 LSASS Memory Credential Access
• T1003.005 Cached Domain Credentials Credential Access
• T1003.006 DCSync Credential Access
• T1008 Fallback Channels Command And Control
• T1020.001 Traffic Duplication Exfiltration
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1029 Scheduled Transfer Exfiltration
• T1030 Data Transfer Size Limits Exfiltration
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1046 Network Service Discovery Discovery
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1070.008 Clear Mailbox Data Stealth
• T1071 Application Layer Protocol Command And Control
• T1071.001 Web Protocols Command And Control
• T1071.002 File Transfer Protocols Command And Control
• T1071.003 Mail Protocols Command And Control
• T1071.004 DNS Command And Control
• T1071.005 Publish/Subscribe Protocols Command And Control
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1090 Proxy Command And Control
• T1090.001 Internal Proxy Command And Control
• T1090.002 External Proxy Command And Control
• T1090.003 Multi-hop Proxy Command And Control
• T1095 Non-Application Layer Protocol Command And Control
• T1098 Account Manipulation Persistence, Privilege Escalation
• T1098.001 Additional Cloud Credentials Persistence, Privilege Escalation
• T1098.007 Additional Local or Domain Groups Persistence, Privilege Escalation
• T1102 Web Service Command And Control
• T1102.001 Dead Drop Resolver Command And Control
• T1102.002 Bidirectional Communication Command And Control
• T1102.003 One-Way Communication Command And Control
• T1104 Multi-Stage Channels Command And Control
• T1105 Ingress Tool Transfer Command And Control
• T1114 Email Collection Collection
• T1114.001 Local Email Collection Collection
• T1114.002 Remote Email Collection Collection
• T1114.003 Email Forwarding Rule Collection

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family AC