CVE-2020-28871

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

Hardened configuration baselines can enforce allowed file types and processing rules.

Secure development practices include input validation and file-type restrictions that prevent this weakness.

Secure-coding guidelines and security testing explicitly address restrictions on allowed file types and upload handling, reducing the risk that dangerous file uploads are accepted without validation.

Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.

Application allow-listing and pre-use scanning of received files directly blocks the introduction of executable content that has not been vetted, eliminating the primary vector for unrestricted dangerous file uploads.