NIST Special Publication 800-171 Revision 2

Date Published: January 28th, 2021

Withdrawn on May 14, 2024. Superseded by SP 800-171 Rev. 3

Author(s): Ron Ross (NIST), Victoria Pillitteri (NIST), Kelley Dempsey (NIST), Mark Riddle (NARA), Gary Guissanie (IDA)

Note: A Class Deviation is in effect as of May 2, 2024 (DEVIATION 2024O0013). The deviation clause requires contractors, who are subject to 252.204-7012, to comply with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2, instead of the version of NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the contracting officer. Click Here

3.4.8 Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Control Family: Configuration Management

Control Type: Derived

SPRS Value: 5

SPRS Supplemental Guidance: N/A

CMMC Level(s): CM.L2-3.4.8

Top Ten Failed Requirement: No

DIBCAC HIGH Failure Rate (OTS):

21st of 110

Referenced in:

DFARS 252.204-7012

Derived From: NIST SP 800-53r4

  • CM-7(4)

  • CM-7(5)

NIST Supplemental Guidance:

[SP 800-167]

CSF v1.1:

  • PR.IP-1

  • PR.PT-3

NIST SP 800-171r2 Control 3.4.8 → MITRE ATT&CK 14.1

NIST SP 800-171r2 Control 3.4.8 → MITRE ATT&CK 14.1

Mapping note: MITRE ATT&CK 14.1 techniques are derived through the NIST SP 800-53 Rev. 4 controls mapped to each NIST SP 800-171 Rev. 2 requirement.

Summary

  • Total mappings: 207
  • Families: 1
  • Outer ring: Technique ID + name
  • MITRE ATT&CK version: 14.1

Family counts

  • Least Functionality: 207 techniques

Usage notes

  • Click a family or technique to zoom in.
  • Click the center to zoom back out.
  • Hover to view technique details.

Discussion:

The process used to identify software programs that are not authorized to execute on systems is commonly referred to as blacklisting. The process used to identify software programs that are authorized to execute on systems is commonly referred to as whitelisting. Whitelisting is the stronger of the two policies for restricting software program execution. In addition to whitelisting, organizations consider verifying the integrity of whitelisted software programs using, for example, cryptographic checksums, digital signatures, or hash functions. Verification of whitelisted software can occur either prior to execution or at system startup.

[SP 800-167] provides guidance on application whitelisting.

Determining Statements (NIST SP 800-171Ar2)

3.4.8[a] a policy specifying whether whitelisting or blacklisting is to be implemented is
specified.
3.4.8[b] the software allowed to execute under whitelisting or denied use under
blacklisting is specified.
3.4.8[c] whitelisting to allow the execution of authorized software or blacklisting to
prevent the use of unauthorized software is implemented as specified.
defined.
3.4.7[m] essential services are defined.
3.4.7[n] the use of nonessential services is defined.
3.4.7[o] the use of nonessential services is restricted, disabled, or prevented as defined.

Assessors are instructed to-

Examine: [SELECT FROM: Configuration management policy; procedures addressing least functionality in the system; system security plan; configuration management plan; system design documentation; system configuration settings and associated documentation; list of software programs not authorized to execute on the system; list of software programs authorized to execute on the system; security configuration checklists; review and update records associated with list of authorized or unauthorized software programs; change control records; system audit logs and records; other relevant documents or records].

Interview: [SELECT FROM: Personnel with responsibilities for identifying software authorized or not authorized to execute on the system; personnel with information security responsibilities; system or network administrators].

Test: [SELECT FROM: Organizational process for identifying, reviewing, and updating programs authorized or not authorized to execute on the system; process for implementing blacklisting or whitelisting; mechanisms supporting or implementing blacklisting or whitelisting].

FURTHER DISCUSSION

Organizations should determine their blacklisting or whitelisting policy and configure the system to manage software that is allowed to run. Blacklisting or deny-by-exception allows all software to run except if on an unauthorized software list such as what is maintained in antivirus solutions. Whitelisting or permit-by-exception does not allow any software to run except if on an authorized software list. The stronger policy of the two is whitelisting. This requirement, CM.L2-3.4.8, requires the implementation of allow-lists and deny-lists for application software. It leverages CM.L2-3.4.1, which requires the organization to establish and maintain software inventories. This requirement, CM.L2-3.4.8, also extends CM.L2-3.4.9, which only requires control and monitoring of any user installed software.

Example

To improve your company’s protection from malware, you have decided to allow only designated programs to run. With additional research you identify a capability within the latest operating system that can control executables, scripts, libraries, or application installers run in your environment [c]. To ensure success you begin by authorizing digitally signed executables. Once they are deployed, you then plan to evaluate and deploy whitelisting for software libraries and scripts [c].

Potential Assessment Considerations

  • Is the information system configured to only allow authorized software to run [a,b,c]?

  • Is the system configured to disallow running unauthorized software [a,b,c]?

  • Is there a defined list of software programs authorized to execute on the system [b]?

  • Is the authorization policy a deny-all, permit by exception for software allowed to execute on the system [a,b,c]?

  • Are automated mechanisms used to prevent program execution in accordance with defined lists (e.g., whitelisting) [a,b,c]?

ISO/IEC 27001:2013

No direct mapping

NIST SP 800-171r2 Control 3.4.8 → MITRE ATT&CK
MITRE ATT&CK v14.1

NIST SP 800-171r2 Control 3.4.8 → MITRE ATT&CK

Total Mappings

207
technique references

Families

1
Least Functionality

Control

3.4.8
CM.L2-3.4.8

Least Functionality 207 techniques

  • T1003OS Credential Dumping
  • T1003.001LSASS Memory
  • T1003.002Security Account Manager
  • T1003.005Cached Domain Credentials
  • T1008Fallback Channels
  • T1011Exfiltration Over Other Network Medium
  • T1011.001Exfiltration Over Bluetooth
  • T1021.001Remote Desktop Protocol
  • T1021.002SMB/Windows Admin Shares
  • T1021.003Distributed Component Object Model
  • T1021.005VNC
  • T1021.006Windows Remote Management
  • T1036Masquerading
  • T1036.005Match Legitimate Name or Location
  • T1036.007Double File Extension
  • T1037Boot or Logon Initialization Scripts
  • T1037.001Logon Script (Windows)
  • T1046Network Service Scanning
  • T1047Windows Management Instrumentation
  • T1048Exfiltration Over Alternative Protocol
  • T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol
  • T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1048.003Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol
  • T1052Exfiltration Over Physical Medium
  • T1052.001Exfiltration over USB
  • T1053Scheduled Task/Job
  • T1053.002At (Windows)
  • T1053.005Scheduled Task
  • T1059Command and Scripting Interpreter
  • T1059.001PowerShell
  • T1059.002AppleScript
  • T1059.003Windows Command Shell
  • T1059.004Unix Shell
  • T1059.005Visual Basic
  • T1059.006Python
  • T1059.007JavaScript
  • T1059.008Network Device CLI
  • T1068Exploitation for Privilege Escalation
  • T1071Application Layer Protocol
  • T1071.001Web Protocols
  • T1071.002File Transfer Protocols
  • T1071.003Mail Protocols
  • T1071.004DNS
  • T1072Software Deployment Tools
  • T1080Taint Shared Content
  • T1087Account Discovery
  • T1087.001Local Account
  • T1087.002Domain Account
  • T1090Proxy
  • T1090.001Internal Proxy
  • T1090.002External Proxy
  • T1090.003Multi-hop Proxy
  • T1092Communication Through Removable Media
  • T1095Non-Application Layer Protocol
  • T1098Account Manipulation
  • T1098.001Additional Cloud Credentials
  • T1098.004SSH Authorized Keys
  • T1102Web Service
  • T1102.001Dead Drop Resolver
  • T1102.002Bidirectional Communication
  • T1102.003One-Way Communication
  • T1104Multi-Stage Channels
  • T1105Ingress Tool Transfer
  • T1106Native API
  • T1112Modify Registry
  • T1127Trusted Developer Utilities Proxy Execution
  • T1129Shared Modules
  • T1133External Remote Services
  • T1135Network Share Discovery
  • T1136Create Account
  • T1136.002Domain Account
  • T1136.003Cloud Account
  • T1176Browser Extensions
  • T1187Forced Authentication
  • T1190Exploit Public-Facing Application
  • T1195Supply Chain Compromise
  • T1195.001Compromise Software Dependencies and Development Tools
  • T1195.002Compromise Software Supply Chain
  • T1197BITS Jobs
  • T1199Trusted Relationship
  • T1204User Execution
  • T1204.001Malicious Link
  • T1204.002Malicious File
  • T1204.003Malicious Image
  • T1205Traffic Signaling
  • T1205.001Port Knocking
  • T1210Exploitation of Remote Services
  • T1213Data from Information Repositories
  • T1213.001Confluence
  • T1213.002Sharepoint
  • T1216Signed Script Proxy Execution
  • T1216.001PubPrn
  • T1218Signed Binary Proxy Execution
  • T1218.001Compiled HTML File
  • T1218.002Control Panel
  • T1218.003CMSTP
  • T1218.004InstallUtil
  • T1218.005Mshta
  • T1218.007Msiexec
  • T1218.008Odbcconf
  • T1218.009Regsvcs/Regasm
  • T1218.012Verclsid
  • T1218.013Mavinject
  • T1218.014MMC
  • T1219Remote Access Software
  • T1220XSL Script Processing
  • T1221Template Injection
  • T1482Domain Trust Discovery
  • T1484Domain Policy Modification
  • T1489Service Stop
  • T1490Inhibit System Recovery
  • T1498Network Denial of Service
  • T1498.001Direct Network Flood
  • T1498.002Reflection Amplification
  • T1499Endpoint Denial of Service
  • T1499.001OS Exhaustion Flood
  • T1499.002Service Exhaustion Flood
  • T1499.003Application Exhaustion Flood
  • T1499.004Application or System Exploitation
  • T1505.004IIS Components
  • T1525Implant Internal Image
  • T1530Data from Cloud Storage Object
  • T1537Transfer Data to Cloud Account
  • T1542.004ROMMONkit
  • T1542.005TFTP Boot
  • T1543Create or Modify System Process
  • T1543.003Windows Service
  • T1543.004Launch Daemon
  • T1546.002Screensaver
  • T1546.006LC_LOAD_DYLIB Addition
  • T1546.008Accessibility Features
  • T1546.009AppCert DLLs
  • T1547.004Winlogon Helper DLL
  • T1547.006Kernel Modules and Extensions
  • T1547.007Re-opened Applications
  • T1548Abuse Elevation Control Mechanism
  • T1548.001Setuid and Setgid
  • T1548.003Sudo and Sudo Caching
  • T1548.004Elevated Execution with Prompt
  • T1552Unsecured Credentials
  • T1552.003Bash History
  • T1552.005Cloud Instance Metadata API
  • T1552.007Container API
  • T1553Subvert Trust Controls
  • T1553.001Gatekeeper Bypass
  • T1553.003SIP and Trust Provider Hijacking
  • T1553.004Install Root Certificate
  • T1553.005Mark-of-the-Web Bypass
  • T1553.006Code Signing Policy Modification
  • T1555.004Windows Credential Manager
  • T1556Modify Authentication Process
  • T1556.002Password Filter DLL
  • T1557Adversary-in-the-Middle
  • T1557.001LLMNR/NBT-NS Poisoning and SMB Relay
  • T1557.002ARP Cache Poisoning
  • T1557.003DHCP Spoofing
  • T1559Inter-Process Communication
  • T1559.002Dynamic Data Exchange
  • T1559.003XPC Services
  • T1562Impair Defenses
  • T1562.001Disable or Modify Tools
  • T1562.002Disable Windows Event Logging
  • T1562.003Impair Command History Logging
  • T1562.004Disable or Modify System Firewall
  • T1562.006Indicator Blocking
  • T1562.009Safe Mode Boot
  • T1563Remote Service Session Hijacking
  • T1563.001SSH Hijacking
  • T1563.002RDP Hijacking
  • T1564.002Hidden Users
  • T1564.003Hidden Window
  • T1564.006Run Virtual Instance
  • T1564.008Email Hiding Rules
  • T1564.009Resource Forking
  • T1565Data Manipulation
  • T1565.003Runtime Data Manipulation
  • T1569System Services
  • T1569.002Service Execution
  • T1570Lateral Tool Transfer
  • T1571Non-Standard Port
  • T1572Protocol Tunneling
  • T1573Encrypted Channel
  • T1573.001Symmetric Cryptography
  • T1573.002Asymmetric Cryptography
  • T1574Hijack Execution Flow
  • T1574.001DLL Search Order Hijacking
  • T1574.006Dynamic Linker Hijacking
  • T1574.007Path Interception by PATH Environment Variable
  • T1574.008Path Interception by Search Order Hijacking
  • T1574.009Path Interception by Unquoted Path
  • T1574.012COR_PROFILER
  • T1599Network Boundary Bridging
  • T1599.001Network Address Translation Traversal
  • T1601Modify System Image
  • T1601.001Patch System Image
  • T1601.002Downgrade System Image
  • T1602Data from Configuration Repository
  • T1602.001SNMP (MIB Dump)
  • T1602.002Network Device Configuration Dump
  • T1609Container Administration Command
  • T1610Deploy Container
  • T1611Escape to Host
  • T1612Build Image on Host
  • T1613Container and Resource Discovery
  • T1622Debugger Evasion
  • T1647Plist File Modification
  • T1648Serverless Execution

Frameworks & Controls