{"data":{"id":"AC-17","name":"Remote Access","family":"AC","family_name":"Access Control","withdrawn":false,"description":"a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and\nb. Authorize each type of remote access to the system prior to allowing such connections.","supplemental_guidance":"Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of CA-03. Enforcing access restrictions for remote access is addressed via AC-03.","enhancements":[{"id":"AC-17(01)","name":"Monitoring and Control","statement":"Employ automated mechanisms to monitor and control remote access methods.","baselines":["moderate","high"]},{"id":"AC-17(02)","name":"Protection of Confidentiality and Integrity Using Encryption","statement":"Implement cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.","baselines":["moderate","high"]},{"id":"AC-17(03)","name":"Managed Access Control Points","statement":"Route remote accesses through authorized and managed network access control points.","baselines":["moderate","high"]},{"id":"AC-17(04)","name":"Privileged Commands and Access","statement":"a. Authorize the execution of privileged commands and access to security-relevant information via remote access only in a format that provides assessable evidence and for the following needs: [Assignment: organization-defined needs]; and\nb. Document the rationale for remote access in the security plan for the system.","baselines":["moderate","high"]},{"id":"AC-17(05)","name":"Monitoring for Unauthorized Connections","withdrawn":true,"incorporated_into":["SI-04"]},{"id":"AC-17(06)","name":"Protection of Mechanism Information","statement":"Protect information about remote access mechanisms from unauthorized use and disclosure.","baselines":[]},{"id":"AC-17(07)","name":"Additional Protection for Security Function Access","withdrawn":true,"incorporated_into":["AC-03(10)"]},{"id":"AC-17(08)","name":"Disable Nonsecure Network Protocols","withdrawn":true,"incorporated_into":["CM-07"]},{"id":"AC-17(09)","name":"Disconnect or Disable Access","statement":"Provide the capability to disconnect or disable remote access to the system within [Assignment: organization-defined time period].","baselines":[]},{"id":"AC-17(10)","name":"Authenticate Remote Commands","statement":"Implement [Assignment: organization-defined mechanisms] to authenticate [Assignment: organization-defined remote commands].","baselines":[]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AC-17","name":"Remote Access","description":"a. Establish and document usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and\nb. Authorize each type of remote access to the system prior to allowing such connections.","discussion":"Remote access is access to organizational systems (or processes acting on behalf of users) that communicate through external networks such as the Internet. Types of remote access include dial-up, broadband, and wireless. Organizations use encrypted virtual private networks (VPNs) to enhance confidentiality and integrity for remote connections. The use of encrypted VPNs provides sufficient assurance to the organization that it can effectively treat such connections as internal networks if the cryptographic mechanisms used are implemented in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Still, VPN connections traverse external networks, and the encrypted VPN does not enhance the availability of remote connections. VPNs with encrypted tunnels can also affect the ability to adequately monitor network communications traffic for malicious code. Remote access controls apply to systems other than public web servers or systems designed for public access. Authorization of each remote access type addresses authorization prior to allowing remote access without specifying the specific formats for such authorization. While organizations may use information exchange and system connection security agreements to manage remote access connections to other systems, such agreements are addressed as part of CA-03. Enforcing access restrictions for remote access is addressed via AC-03.","related_controls":["AC-02","AC-03","AC-04","AC-18","AC-19","AC-20","CA-03","CM-10","IA-02","IA-03","IA-08","MA-04","PE-17","PL-02","PL-04","SC-10","SC-12","SC-13","SI-04"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":"Changes control text from 'remote access' to 'each type of remote access' Adds 'information exchange' and other minor wording in discussion"}},"compliance_mappings":{"iso_27001_2022":["A.5.14","A.5.15","A.6.7","A.7.9"],"iso_27002_2022":["5.14","5.15","6.7","7.9"],"cobit_2019":["DSS05"],"pci_dss_v4":["2.2.7"],"nist_csf_2":["PR.AA-05","PR.DS-02","PR.IR-01"],"cis_controls_v8":["CIS 4.6","CIS 6","CIS 6.4","CIS 12.3","CIS 12.6","CIS 12.7","CIS 13.5","CIS 14.8"],"soc2_tsc":["CC6.6","CC6.6-POF3"],"finos_ccc":["CCC-C05"],"iso_42001_2023":[],"iec_62443":["3-3 SR 1.13","3-3 SR 2.6","3-3 SR 4.1"],"asd_e8":["E8-7 ML2"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 22-23"],"mas_trm":["9","14"],"pra_op_resilience":[],"bsi_grundschutz":["CON.7","OPS.1.2.4","ORP.4"],"anssi":["Hygiene.24","Hygiene.28","SecNumCloud.10.7","SecNumCloud.14.2"],"osfi_b13":["B-13.3.2"],"finma_circular":["IV.B.d(59)","IV.C(62)","IV.C(63)"],"gdpr":["Art.32(1)(a)","Art.32(1)(b)","Art.44"],"dora":["Art.9(4)(a)","Art.9(4)(c)"],"bio2":["5.14","5.15","6.7","7.9"],"rbi_csf":["Annex1.8","ITGRCA.20"],"fisc":["FISC.T3","FISC.T8","FISC.T10"],"lgpd_bcb":["BCB.PIX","LGPD.Art.33-36"],"hkma_tme1":["TME1.8.5","TME1.10.1"],"mlps_2":["8.1.3.1"],"dnb_good_practice":["DNB.18.4"],"cra":["CRA.I.2d"],"swift_cscf":["SWIFT.2.6"],"cbb_tm":["TM-6","TM-8"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC","CS"],"sama_csf":["3.1","3.3","3.8"],"uae_ia":["T8","T9"],"bog_cisd":["CISD-IX","CISD-VIII","CISD-XI"],"bom_ctrm":["3.2","3.13"],"cbe_csf":["CTO-1","CTO-5","CTO-6"],"cbn_csf":["Part3.2"],"sa_js2":["JS2-7.1","JS2-8.1"],"bot_cyber":["Ch2.2","Ch2.4","Ch9.1"],"cpmi_pfmi":["CG.PR","PFMI.P22"],"eba_ict":["3.4.2"],"ecb_croe":["CROE.2.3.5"],"ffiec_is":["II.C.9","II.C.13(b)","II.C.15(c)","II.C.16"],"hipaa_sr":["§164.310(b)","§164.312(a)(1)","§164.312(e)(1)"],"iosco_cyber":["PROT-1"],"nydfs_500":["500.6","500.7","500.12"],"sebi_cscrf":["PR.AA"],"cmmc_2":["AC"],"nerc_cip":["CIP-005-7"],"nrc_73_54":["RG5.71-A-AC"],"tsa_psd":["SD-2 Sec B"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["ACCESS"],"api_1164":["Sec 6"],"awia":["AWWA Sec 3"],"iaea_nss":["Sec 5.3"],"pci_pts":["E","I"],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":["3"],"common_criteria":["CC Part 2 — FRU/FTA/FTP"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.3"],"fda_21_cfr_11":["§11.30","§11.300(d)"],"fda_cyber":[],"hitrust_csf":["01.b","01.d","05.c"],"iso_27799":["6.3","9.5","H.5"],"lloyds_ms":["MS8.3","MS8.9"],"naic_ds":["4-access","4-audit"],"nhs_dspt":["NDG-9.7"],"pra_ss1_23":["P-IT.1"],"solvency_ii":["EIOPA-ICT-4.4","EIOPA-ICT-4.6"],"owasp_masvs_v2":["MASVS-NETWORK-1"],"csa_ccm_v4":["HRS-04"],"csa_aicm":["HRS-04"],"ccss_v9":["1.03.5"],"mica":[],"basel_sco60":["SCO60.62"],"bssc":["NOS-05"],"sec_custody_digital":["SEC-CD-05"],"dpdpa":["Rules.6(1)(b)"]},"attack_techniques":[{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Authorizing, monitoring, and controlling remote access methods limits the remote services available for adversary lateral movement by ensuring only approved protocols and authenticated sessions are permitted."},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that require authenticated VPN connections and restrict logon script execution to managed sessions prevent adversaries from planting initialization scripts through unauthorized remote channels."},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"mapping_type":"mitigates","mapping_rationale":"Encrypting all authorized remote access channels through VPN tunnels and TLS prevents adversaries from sniffing network traffic on unprotected remote access paths to capture credentials and sensitive data."},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict WMI remote management to approved administrative connections prevent adversaries from executing WMI commands through unauthorized remote sessions."},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict which command interpreters can be invoked through remote sessions and require authenticated, encrypted channels limit adversary ability to execute commands via remote access."},{"id":"T1070","name":"Indicator Removal","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and controlling remote access ensures all remote administrative actions generate audit records, making it more difficult for adversaries to remove indicators without detection through centralized remote session logging."},{"id":"T1114","name":"Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict email access to approved clients and authenticated sessions, with MFA enforcement for remote webmail, prevent adversaries from remotely collecting email through unauthorized access."},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization requirements ensure that automated data collection tools cannot operate through unauthorized remote connections, limiting adversary ability to script large-scale data harvesting remotely."},{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"mapping_type":"mitigates","mapping_rationale":"Directly controlling and monitoring external remote services—VPNs, RDP gateways, SSH jump boxes—through authorization policies and MFA reduces the attack surface for initial access through exposed remote service endpoints."},{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict Office application management to authorized administrative sessions prevent adversaries from remotely installing Office startup persistence mechanisms through unauthorized connections."},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict access to information repositories through authorized, authenticated channels prevent adversaries from remotely harvesting data from wikis, SharePoint, and document management systems."},{"id":"T1219","name":"Remote Access Software","tactics":["command-and-control"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and controlling all remote access methods enables detection and blocking of unauthorized remote access software (TeamViewer, AnyDesk) that adversaries use to establish C2 channels outside approved remote access infrastructure."},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization controls that govern cloud storage access through approved channels and require MFA prevent adversaries from accessing sensitive cloud-stored data through unauthorized remote connections."},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks all data transfer operations across remote sessions detects adversary attempts to exfiltrate data by transferring it to attacker-controlled cloud accounts through remote access channels."},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict service management operations to authorized administrative sessions prevent adversaries from remotely creating or modifying system processes for persistence through unauthorized remote connections."},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access encryption requirements (VPN, TLS) protect credential material in transit, while access monitoring detects adversary attempts to access credential stores through unauthorized remote sessions."},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Encrypting and authenticating all authorized remote access connections through VPN tunnels with mutual authentication prevents adversaries from positioning themselves as intermediaries on remote access paths."},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that enforce Kerberos authentication through approved channels and monitor for abnormal ticket usage across remote sessions limit adversary ability to exploit stolen or forged Kerberos tickets."},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Monitoring and controlling remote service sessions with timeout enforcement and re-authentication requirements prevent adversaries from hijacking existing remote sessions for unauthorized lateral movement."},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring with integrity controls on data modification operations detects adversary attempts to manipulate data through unauthorized or compromised remote sessions."},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict network device management to authorized administrative channels (out-of-band management) prevent adversaries from accessing device configurations through unauthorized remote connections."},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict container administration to approved management interfaces and authenticated sessions prevent adversaries from executing container commands through unauthorized remote access."},{"id":"T1610","name":"Deploy Container","tactics":["defense-evasion","execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict container deployment operations to authorized CI/CD pipelines and management consoles prevent adversaries from deploying malicious containers through unauthorized remote sessions."},{"id":"T1612","name":"Build Image on Host","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization requirements that restrict image build operations to approved build systems prevent adversaries from remotely building malicious container images on compromised hosts."},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict container and resource discovery APIs to authorized administrative sessions limit the information adversaries can gather about container infrastructure through unauthorized remote access."},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict cloud storage enumeration to authorized management sessions prevent adversaries from discovering cloud storage objects through unauthorized remote connections."},{"id":"T1647","name":"Plist File Modification","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict system configuration changes—including plist modifications—to authorized administrative sessions prevent adversaries from remotely altering macOS settings through unauthorized connections."},{"id":"T1651","name":"Cloud Administration Command","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict cloud administration commands to approved management interfaces with MFA prevent adversaries from executing cloud management operations through unauthorized remote access."},{"id":"T1659","name":"Content Injection","tactics":["command-and-control","initial-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring and encryption controls detect and prevent content injection attacks by ensuring all remote communications traverse authenticated, integrity-protected channels resistant to inline manipulation."},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks network traffic patterns across authorized sessions detects adversary attempts to configure traffic duplication on network devices through unauthorized remote management connections."},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that authorize and monitor RDP connections—enforcing NLA, MFA, and session recording—restrict adversary ability to use Remote Desktop Protocol for lateral movement through uncontrolled remote access."},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict SMB connections to authorized administrative channels and monitor admin share access prevent adversaries from leveraging Windows administrative shares for lateral movement."},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that control DCOM connectivity and monitor remote COM activations prevent adversaries from using Distributed Component Object Model for lateral code execution via remote access."},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that authorize and monitor SSH connections—enforcing key-based authentication, jump host requirements, and session logging—limit adversary use of SSH for lateral movement."},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict VNC usage to authorized connections with strong authentication and session monitoring prevent adversaries from using VNC for unauthorized graphical remote access."},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that authorize and monitor WinRM connections—enforcing HTTPS transport, IP restrictions, and Kerberos authentication—prevent adversary use of Windows Remote Management for lateral movement."},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict direct cloud VM connections to approved bastion architectures and require IAM role-based access prevent adversaries from establishing unauthorized direct VM access."},{"id":"T1037.001","name":"Logon Script (Windows)","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict logon script deployment to authorized administrative channels prevent adversaries from planting malicious Windows logon scripts through unauthorized remote sessions."},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict PowerShell remoting to authorized connections with session logging and constrained endpoints prevent adversaries from executing malicious PowerShell commands through unauthorized remote access."},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict Apple Remote Desktop and osascript execution to authorized management sessions prevent adversaries from using AppleScript through unauthorized remote connections."},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that restricts command shell access through remote sessions to approved administrative connections prevents adversaries from executing Windows command shell operations via unauthorized remote access."},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict Unix shell access through SSH to authorized connections with session recording prevent adversaries from executing malicious shell commands through unauthorized remote sessions."},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict VBScript execution through remote sessions to authorized administrative channels prevent adversaries from running Visual Basic scripts via unauthorized remote connections."},{"id":"T1059.006","name":"Python","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict Python execution through remote sessions to authorized development and administrative connections prevent adversaries from leveraging Python interpreters via unauthorized remote access."},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict JavaScript execution environments through remote sessions prevent adversaries from using Node.js or browser-based JavaScript engines via unauthorized remote connections."},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict network device CLI access to authorized out-of-band management connections prevent adversaries from executing unauthorized commands on infrastructure devices through remote access."},{"id":"T1070.001","name":"Clear Windows Event Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring with centralized session logging ensures that adversary attempts to clear Windows event logs through remote administrative sessions are detected and the audit trail is preserved off-host."},{"id":"T1070.002","name":"Clear Linux or Mac System Logs","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access session recording and centralized log forwarding ensure that adversary attempts to clear Linux/Mac system logs through remote connections are captured in tamper-resistant remote audit stores."},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that monitor mailbox management operations across remote sessions detect adversary attempts to clear mailbox data through unauthorized or compromised remote email access."},{"id":"T1114.001","name":"Local Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict local email client access to authorized devices and sessions prevent adversaries from accessing local email stores through unauthorized remote connections to endpoint systems."},{"id":"T1114.002","name":"Remote Email Collection","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict remote email collection through approved clients with MFA enforcement prevent adversaries from harvesting email content through unauthorized remote webmail or API access."},{"id":"T1114.003","name":"Email Forwarding Rule","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks email rule creation across remote sessions detects adversary attempts to establish persistent email forwarding rules through unauthorized or compromised remote mail access."},{"id":"T1127.002","name":"ClickOnce","tactics":["defense-evasion"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict ClickOnce application deployment through remote sessions prevent adversaries from leveraging ClickOnce for proxy execution via unauthorized remote connections."},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict Office configuration modifications to authorized administrative channels prevent adversaries from remotely installing Office Test persistence mechanisms through unauthorized remote access."},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that restricts Confluence access to approved VPN connections and authenticated sessions prevents adversaries from remotely harvesting knowledge base content through unauthorized access."},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict SharePoint access to authorized connections with MFA prevent adversaries from remotely collecting documents and data from SharePoint through unauthorized remote sessions."},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict messaging platform access to approved clients and authenticated sessions prevent adversaries from remotely collecting sensitive conversations through unauthorized messaging access."},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict IIS management to authorized administrative sessions prevent adversaries from remotely deploying malicious IIS components for persistent web traffic interception."},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that restricts Terminal Services configuration to approved management channels prevents adversaries from remotely installing malicious Terminal Services DLLs for persistence."},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict Windows Time service configuration to authorized administrative sessions prevent adversaries from remotely modifying time provider DLL registrations for persistence."},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that restrict Winlogon registry modifications to authorized administrative connections prevent adversaries from remotely configuring Winlogon Helper DLLs for persistent execution."},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict startup folder modifications through remote sessions prevent adversaries from remotely planting malicious shortcuts that execute upon user login."},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that restricts print spooler management to approved administrative sessions prevents adversaries from remotely installing malicious print processors for persistence."},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict XDG autostart entry creation through remote sessions prevent adversaries from remotely establishing Linux desktop autostart persistence mechanisms."},{"id":"T1550.001","name":"Application Access Token","tactics":["defense-evasion","lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks application token usage across sessions detects adversary attempts to use stolen application access tokens for unauthorized remote resource access."},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict registry access through remote sessions prevent adversaries from remotely querying credential-storing registry keys to extract stored credentials."},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict SSH key file access to approved administrative channels prevent adversaries from remotely stealing private keys used for authentication."},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict cloud instance metadata access to authorized processes prevent adversaries from remotely harvesting credentials from cloud instance metadata APIs."},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization policies that restrict container API access to authenticated management channels prevent adversaries from remotely extracting credentials through container orchestration APIs."},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["collection","credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access encryption through VPN tunnels with mutual authentication prevents ARP cache poisoning attacks on remote access paths by ensuring all traffic traverses authenticated encrypted channels."},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks Kerberos ticket usage across remote sessions detects adversary attempts to authenticate to remote services using forged silver tickets through remote access channels."},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that enforce strong Kerberos encryption for remote sessions reduce the exposure of service tickets to offline cracking through Kerberoasting attacks targeting remote service authentication."},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that enforces pre-authentication for all remote Kerberos requests prevents adversaries from exploiting AS-REP roasting vulnerabilities through unauthorized remote authentication attempts."},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that enforce per-session SSH authentication, disable agent forwarding, and implement session timeout prevent adversaries from hijacking existing SSH sessions for lateral movement."},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"mapping_type":"mitigates","mapping_rationale":"Remote access policies that enforce RDP session timeout, require NLA for reconnection, and implement session recording prevent adversaries from hijacking disconnected or active RDP sessions."},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring with integrity controls on data modification operations across remote sessions detects adversary attempts to manipulate stored data through compromised remote access channels."},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["impact"],"mapping_type":"mitigates","mapping_rationale":"Encrypting and authenticating all remote access channels prevents adversaries from intercepting and modifying data in transit between remote users and organizational systems."},{"id":"T1567.003","name":"Exfiltration to Text Storage Sites","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that monitor and restrict outbound data transfers to text storage sites detect and prevent adversaries from exfiltrating data to paste sites through compromised remote sessions."},{"id":"T1567.004","name":"Exfiltration Over Webhook","tactics":["exfiltration"],"mapping_type":"mitigates","mapping_rationale":"Remote access monitoring that tracks webhook-based data transfers across remote sessions detects adversary attempts to exfiltrate data through webhook endpoints from compromised remote access connections."},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access controls that restrict SNMP management access to authorized out-of-band connections prevent adversaries from remotely extracting device configuration data through unauthorized SNMP queries."},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Remote access authorization that restricts network device management to approved channels prevents adversaries from remotely dumping device configurations through unauthorized management protocol access."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-02: iec_62443 clauses derived through CSF 1.1 from ISA's 62443-3-3 mapping (OLIR entry 195) and NIST's SP 800-53 Rev 5 mapping (OLIR entry 81), which both place them and this control under PR.AC-3, \"Remote access is managed\". OSA had none. 2026-10-03: iso_27001_2022 A.5.14 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.AA-05 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-015","SP-017","SP-021","SP-023","SP-025","SP-029","SP-030","SP-032","SP-037","SP-044","SP-046","SP-050","SP-054"]}}