SC-39Process Isolation

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 1 mapping(s) from 1 framework(s): CSF 2.0 1 (mostly)

See the full cumulative-coverage rollup →

Implementations targeting this control (0)

• No implementations targeting this control yet.

ATT&CK techniques this control mitigates (22)

• T1003 OS Credential Dumping Credential Access
• T1003.001 LSASS Memory Credential Access
• T1003.002 Security Account Manager Credential Access
• T1003.003 NTDS Credential Access
• T1003.004 LSA Secrets Credential Access
• T1003.005 Cached Domain Credentials Credential Access
• T1003.006 DCSync Credential Access
• T1003.007 Proc Filesystem Credential Access
• T1003.008 /etc/passwd and /etc/shadow Credential Access
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1189 Drive-by Compromise Initial Access
• T1190 Exploit Public-Facing Application Initial Access
• T1203 Exploitation for Client Execution Execution
• T1210 Exploitation of Remote Services Lateral Movement
• T1211 Exploitation for Stealth Stealth
• T1212 Exploitation for Credential Access Credential Access
• T1547.002 Authentication Package Persistence, Privilege Escalation
• T1547.005 Security Support Provider Persistence, Privilege Escalation
• T1547.008 LSASS Driver Persistence, Privilege Escalation
• T1556 Modify Authentication Process Defense Impairment, Persistence, Credential Access
• T1556.001 Domain Controller Authentication Defense Impairment, Persistence, Credential Access
• T1611 Escape to Host Privilege Escalation

Weaknesses this control addresses (6)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SC