SC-7Boundary Protection

Implementations targeting this control (27)

• aws-config-s3-bucket-public-read-prohibited S3 buckets prohibit public read access AWS::S3::Bucket partial protect enforce
• aws-config-s3-bucket-public-write-prohibited S3 buckets prohibit public write access AWS::S3::Bucket partial protect enforce CIS §2.1.4Hub S3.8
• aws-config-rds-instance-public-access-check RDS instances are not publicly accessible AWS::RDS::DBInstance partial protect enforce CIS v5 §2.2.3CIS v3 §2.3.3Hub RDS.2
• aws-config-rds-snapshots-public-prohibited RDS snapshots are not publicly restorable AWS::RDS::DBSnapshot partial recover enforce
• aws-config-incoming-ssh-disabled Security groups disallow unrestricted SSH ingress AWS::EC2::SecurityGroup encompass protect enforce
• aws-config-restricted-common-ports Restricted Common Ports AWS::EC2::SecurityGroup partial protect enforce CIS v5 §5.4CIS v3 §5.3Hub EC2.54
• aws-config-lambda-function-public-access-prohibited Lambda function policies prohibit public invocation AWS::Lambda::Function partial protect enforce
• aws-config-autoscaling-launch-config-public-ip-disabled Autoscaling Launch Config Public Ip Disabled AWS::AutoScaling::AutoScalingGroup partial protect enforce
• aws-config-dms-replication-not-public Dms Replication Not Public AWS::DMS::ReplicationInstance partial recover enforce
• aws-config-ebs-snapshot-public-restorable-check Ebs Snapshot Public Restorable Check AWS::EC2::Volume partial recover enforce
• aws-config-ec2-instance-no-public-ip Ec2 Instance No Public Ip AWS::EC2::Instance partial protect enforce
• aws-config-ec2-instances-in-vpc Ec2 Instances In Vpc AWS::EC2::Instance partial protect enforce
• aws-config-elasticsearch-in-vpc-only Elasticsearch In Vpc Only AWS::OpenSearchService::Domain partial protect enforce
• aws-config-emr-master-no-public-ip Emr Master No Public Ip AWS::EMR::Cluster partial protect enforce
• aws-config-lambda-inside-vpc Lambda Inside Vpc AWS::Lambda::Function partial protect enforce
• aws-config-no-unrestricted-route-to-igw No Unrestricted Route To Igw AWS::EC2::RouteTable partial protect enforce
• aws-config-opensearch-in-vpc-only Opensearch In Vpc Only AWS::OpenSearchService::Domain partial protect enforce
• aws-config-redshift-cluster-public-access-check Redshift Cluster Public Access Check AWS::Redshift::Cluster partial protect enforce
• aws-config-redshift-enhanced-vpc-routing-enabled Redshift Enhanced Vpc Routing Enabled AWS::Redshift::Cluster partial protect enforce
• aws-config-restricted-ssh Restricted Ssh AWS::EC2::SecurityGroup partial protect enforce CIS v5 §5.3CIS v3 §5.2Hub EC2.53
• aws-config-s3-account-level-public-access-blocks-periodic S3 Account Level Public Access Blocks Periodic AWS::S3::Bucket partial protect enforce CIS §2.1.4Hub S3.1
• aws-config-s3-bucket-level-public-access-prohibited S3 Bucket Level Public Access Prohibited AWS::S3::Bucket partial protect enforce
• aws-config-sagemaker-notebook-no-direct-internet-access Sagemaker Notebook No Direct Internet Access AWS::SageMaker::NotebookInstance partial protect enforce
• aws-config-ssm-document-not-public Ssm Document Not Public AWS::SSM::Document partial protect enforce
• aws-config-subnet-auto-assign-public-ip-disabled Subnet Auto Assign Public Ip Disabled AWS::EC2::Subnet partial protect enforce
• aws-config-vpc-default-security-group-closed Vpc Default Security Group Closed AWS::EC2::VPC partial protect enforce CIS v5 §5.5CIS v3 §5.4Hub EC2.2
• aws-config-vpc-sg-open-only-to-authorized-ports Vpc Sg Open Only To Authorized Ports AWS::EC2::VPC partial protect enforce

ATT&CK techniques this control mitigates (156)

• T1001 Data Obfuscation Command And Control
• T1001.001 Junk Data Command And Control
• T1001.002 Steganography Command And Control
• T1001.003 Protocol or Service Impersonation Command And Control
• T1008 Fallback Channels Command And Control
• T1020.001 Traffic Duplication Exfiltration
• T1021.001 Remote Desktop Protocol Lateral Movement
• T1021.002 SMB/Windows Admin Shares Lateral Movement
• T1021.003 Distributed Component Object Model Lateral Movement
• T1021.005 VNC Lateral Movement
• T1021.006 Windows Remote Management Lateral Movement
• T1029 Scheduled Transfer Exfiltration
• T1030 Data Transfer Size Limits Exfiltration
• T1036.008 Masquerade File Type Stealth
• T1041 Exfiltration Over C2 Channel Exfiltration
• T1046 Network Service Discovery Discovery
• T1048 Exfiltration Over Alternative Protocol Exfiltration
• T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration
• T1055 Process Injection Stealth, Privilege Escalation
• T1055.001 Dynamic-link Library Injection Stealth, Privilege Escalation
• T1055.002 Portable Executable Injection Stealth, Privilege Escalation
• T1055.003 Thread Execution Hijacking Stealth, Privilege Escalation
• T1055.004 Asynchronous Procedure Call Stealth, Privilege Escalation
• T1055.005 Thread Local Storage Stealth, Privilege Escalation
• T1055.008 Ptrace System Calls Stealth, Privilege Escalation
• T1055.009 Proc Memory Stealth, Privilege Escalation
• T1055.011 Extra Window Memory Injection Stealth, Privilege Escalation
• T1055.012 Process Hollowing Stealth, Privilege Escalation
• T1055.013 Process Doppelgänging Stealth, Privilege Escalation
• T1055.014 VDSO Hijacking Stealth, Privilege Escalation
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1071 Application Layer Protocol Command And Control
• T1071.001 Web Protocols Command And Control
• T1071.002 File Transfer Protocols Command And Control
• T1071.003 Mail Protocols Command And Control
• T1071.004 DNS Command And Control
• T1071.005 Publish/Subscribe Protocols Command And Control
• T1072 Software Deployment Tools Execution, Lateral Movement
• T1078 Valid Accounts Stealth, Persistence, Privilege Escalation, Initial Access
• T1080 Taint Shared Content Lateral Movement
• T1090 Proxy Command And Control
• T1090.001 Internal Proxy Command And Control
• T1090.002 External Proxy Command And Control
• T1090.003 Multi-hop Proxy Command And Control
• T1095 Non-Application Layer Protocol Command And Control
• T1098 Account Manipulation Persistence, Privilege Escalation
• T1098.001 Additional Cloud Credentials Persistence, Privilege Escalation
• T1102 Web Service Command And Control

Weaknesses this control addresses (8)AI

CWEs ranked by how often they appear in real CVEs. The rationale describes how this control reduces exploitability of each weakness class.

Top CVEs where this control is the strongest mitigation

Other controls in family SC