|

controlSI-3

Malicious Code Protection (SI-3)

Implement [organization-defined] malicious code protection mechanisms at system entry and exit points to detect and eradicate malicious code; Automatically update malicious code protection mechanisms as new releases are available in accordance with organizational configuration management policy and procedures; Configure malicious code protection mechanisms to: Address the receipt of false positives during malicious code detection and eradication and the resulting potential impact on the availabi

Security Baselines

LOWMODERATEHIGH

integritymalwareflaw-remediationmonitoring

Why These Connect

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports53

These related controls work together — a change to one may affect the others.

Mitigates18

This control helps defend against or reduce the risk of the linked threat technique.

Enhances10

These enhancements add specific capabilities or refinements to the base control.

Related Controls(32)

AC-19Access Control for Mobile Devices (AC-19)

AU-2Event Logging (AU-2)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

AU-12Audit Record Generation (AU-12)

CA-2Control Assessments (CA-2)

CA-7Continuous Monitoring (CA-7)

CM-3Configuration Change Control (CM-3)

IR-4Incident Handling (IR-4)

IR-5Incident Monitoring (IR-5)

PM-31Continuous Monitoring Strategy (PM-31)RA-5Vulnerability Monitoring and Scanning (RA-5)

SA-24Design For Cyber Resiliency (SA-24)SC-12Cryptographic Key Establishment and Management (SC-12)

SC-13Cryptographic Protection (SC-13)

SC-18Mobile Code (SC-18)

SC-26Decoys (SC-26)SC-28Protection of Information at Rest (SC-28)

SC-35External Malicious Code Identification (SC-35)SC-37Out-of-band Channels (SC-37)SC-44Detonation Chambers (SC-44)SI-2Flaw Remediation (SI-2)

AC-4Information Flow Enforcement (AC-4)

CM-8System Component Inventory (CM-8)

MA-3Maintenance Tools (MA-3)

MA-4Nonlocal Maintenance (MA-4)

PL-9Central Management (PL-9)SC-7Boundary Protection (SC-7)

SC-23Session Authenticity (SC-23)

SI-4System Monitoring (SI-4)

SI-7Software, Firmware, and Information Integrity (SI-7)

SI-8Spam Protection (SI-8)

SI-15Information Output Filtering (SI-15)

Threat Coverage(18 ATT&CK techniques)

T1566Phishing T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter T1203Exploitation for Client Execution T1204User Execution T1068Exploitation for Privilege Escalation T1027Obfuscated Files or Information T1562Impair Defenses T1036Masquerading T1570Lateral Tool Transfer T1560Archive Collected Data T1071Application Layer Protocol T1105Ingress Tool Transfer T1041Exfiltration Over C2 Channel T1048Exfiltration Over Alternative Protocol T1486Data Encrypted for Impact T1485Data Destruction T1598Phishing for Information

Control Enhancements(10)

SI-3(1)Central Management (SI-3(1))W

SI-3(2)Automatic Updates (SI-3(2))W

SI-3(3)Non-privileged Users (SI-3(3))W

SI-3(4)Updates Only by Privileged Users (SI-3(4))

SI-3(5)Portable Storage Devices (SI-3(5))W

SI-3(6)Testing and Verification (SI-3(6))

SI-3(7)Nonsignature-based Detection (SI-3(7))W

SI-3(8)Detect Unauthorized Commands (SI-3(8))

SI-3(9)Authenticate Remote Commands (SI-3(9))W

SI-3(10)Malicious Code Analysis (SI-3(10))

See Also

@SP 800-53 Overview ⚖Compare Baselines