auren-research/cyber-sec huggingface dataset:
type: course-of-action
spec_version: 2.1
id: course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17
created: 2019-06-11T16:33:55.337Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0937
external_id: M0937
source_name: Centre for the Protection of National Infrastructure February 2005
description: Centre for the Protection of National Infrastructure 2005, February FIREWALL DEPLOYMENT FOR SCADA AND PROCESS CONTROL NETWORKS Retrieved. 2020/09/17 
url: https://www.energy.gov/sites/prod/files/Good%20Practices%20Guide%20for%20Firewall%20Deployment.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:26.074Z
name: Filter Network Traffic
description: Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. Perform inline allow/denylisting of network messages based on the application layer (OSI Layer 7) protocol, especially for automation protocols. Application allowlists are beneficial when there are well-defined communication sequences, types, rates, or patterns needed during expected system operations. Application denylists may be needed if all acceptable communication sequences cannot be defined, but instead a set of known malicious uses can be denied (e.g., excessive communication attempts, shutdown messages, invalid commands). Devices performing these functions are often referred to as deep-packet inspection (DPI) firewalls, context-aware firewalls, or firewalls blocking specific automation/SCADA protocol aware firewalls. (Citation: Centre for the Protection of National Infrastructure February 2005)
labels: IEC 62443-3-3:2013 - SR 5.1
IEC 62443-4-2:2019 - CR 5.1
NIST SP 800-53 Rev. 5 - AC-3; SC-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--143b4398-3222-480a-b6a4-e131bc2d3144
created: 2019-06-06T20:52:59.206Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0921
external_id: M0921
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:26.226Z
name: Restrict Web-Based Content
description: Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
labels: IEC 62443-3-3:2013 - SR 2.4
IEC 62443-4-2:2019 - HDR 2.4
NIST SP 800-53 Rev. 5 - SC-18
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517
created: 2023-03-22T15:49:55.439Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0818
external_id: M0818
source_name: PLCTop20 Mar 2023
description: PLC Security, Top 20 Community. (2021, June 15). Secure PLC Coding Practices: Top 20 version 1.0. Retrieved March 22, 2023.
url: https://plc-security.com/content/Top_20_Secure_PLC_Coding_Practices_V1.0.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:26.390Z
name: Validate Program Inputs
description: Devices and programs designed to interact with control system parameters should validate the format and content of all user inputs and actions to ensure the values are within intended operational ranges. These values should be evaluated and further enforced through the program logic running on the field controller. If a problematic or invalid input is identified, the programs should either utilize a predetermined safe value or enter a known safe state, while also logging or alerting on the event.(Citation: PLCTop20 Mar 2023)
labels: IEC 62443-3-3:2013 - SR 3.5
IEC 62443-3-3:2013 - SR 3.6
IEC 62443-4-2:2019 - CR 3.5
IEC 62443-4-2:2019 - CR 3.6
NIST SP 800-53 Rev. 5 - SI-10
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291
created: 2019-06-10T20:41:03.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0930
external_id: M0930
source_name: IEC August 2013
description: IEC 2013, August Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels Retrieved. 2020/09/25 
url: https://webstore.iec.ch/publication/7033
source_name: IEC February 2019
description: IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 
url: https://webstore.iec.ch/publication/34421
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:26.551Z
name: Network Segmentation
description: Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network. (Citation: IEC February 2019) (Citation: IEC August 2013)
labels: IEC 62443-3-3:2013 - SR 5.1
IEC 62443-4-2:2019 - CR 5.1
NIST SP 800-53 Rev. 5 - AC-3
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--2ab9fc6d-3cf6-4d7b-85f1-3ad6949233b3
created: 2019-06-11T17:00:01.740Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0944
external_id: M0944
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:26.729Z
name: Restrict Library Loading
description: Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.
labels: IEC 62443-3-3:2013 - SR 7.7
IEC 62443-4-2:2019 - CR 7.7
NIST SP 800-53 Rev. 5 - CM-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--2f0160b7-e982-49d7-9612-f19b810f1722
created: 2019-06-06T16:39:58.291Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0915
external_id: M0915
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:39:12.577Z
name: Active Directory Configuration
description: Configure Active Directory to prevent use of certain techniques; use security identifier (SID) Filtering, etc.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--3172222b-4983-43f7-8983-753ded4f13bc
created: 2019-06-10T20:46:02.263Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0931
external_id: M0931
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:27.092Z
name: Network Intrusion Prevention
description: Use intrusion detection signatures to block traffic at network boundaries. In industrial control environments, network intrusion prevention should be configured so it will not disrupt protocols and communications responsible for real-time functions related to control or safety.
labels: IEC 62443-3-3:2013 - SR 6.2
IEC 62443-4-2:2019 - CR 6.2
NIST SP 800-53 Rev. 5 - SI-4
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--3222a807-521b-4a1a-aa13-f1cda45734b3
created: 2019-06-06T20:58:59.577Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0924
external_id: M0924
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:27.274Z
name: Restrict Registry Permissions
description: Restrict the ability to modify certain hives or keys in the Windows Registry.
labels: IEC 62443-3-3:2013 - SR 2.1
IEC 62443-4-2:2019 - CR 2.1
NIST SP 800-53 Rev. 5 - AC-6
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--337c4e2a-21a7-4d9a-bfee-9efd6cebf0e5
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0803
external_id: M0803
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:39:13.297Z
name: Data Loss Prevention
description: Data Loss Prevention (DLP) technologies can be used to help identify adversarial attempts to exfiltrate operational information, such as engineering plans, trade secrets, recipes, intellectual property, or process telemetry. DLP functionality may be built into other security products such as firewalls or standalone suites running on the network and host-based agents. DLP may be configured to prevent the transfer of information through corporate resources such as email, web, and physical media such as USB for host-based solutions.
labels: IEC 62443-3-3:2013 - SR 4.1
IEC 62443-4-2:2019 - CR 4.1
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2025-03-12T16:11:54.933Z
name: Access Management
description: Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provide sufficient capabilities to support user identification and authentication. (Citation: McCarthy, J et al. July 2018) These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials. (Citation: Centre for the Protection of National Infrastructure November 2010)
labels: IEC 62443-3-3:2013 - SR 2.1
IEC 62443-4-2:2019 - CR 2.1
NIST SP 800-53 Rev. 5 - AC-3
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
type: course-of-action
spec_version: 2.1
id: course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0801
external_id: M0801
source_name: Centre for the Protection of National Infrastructure November 2010
description: Centre for the Protection of National Infrastructure 2010, November Configuring and Managing Remote Access for Industrial Control Systems Retrieved. 2020/09/25 
url: https://us-cert.cisa.gov/sites/default/files/recommended_practices/RP_Managing_Remote_Access_S508NC.pdf
source_name: McCarthy, J et al. July 2018
description: McCarthy, J et al. 2018, July NIST SP 1800-2 Identity and Access Management for Electric Utilities Retrieved. 2020/09/17 
url: https://doi.org/10.6028/NIST.SP.1800-2
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: course-of-action
spec_version: 2.1
id: course-of-action--469b78dd-a54d-4f7c-8c3b-4a1dd916b433
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0816
external_id: M0816
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:39:13.833Z
name: Mitigation Limited or Not Effective
description: This type of attack technique cannot be easily mitigated with preventative controls since it is based on the abuse of system features.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--49363b74-d506-4342-bd63-320586ebadb9
created: 2019-06-11T17:10:57.070Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0950
external_id: M0950
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:27.827Z
name: Exploit Protection
description: Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.
labels: IEC 62443-3-3:2013 - SR 3.2
IEC 62443-4-2:2019 - CR 3.2
NIST SP 800-53 Rev. 5 - SI-16
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--49b306c1-a046-42c5-a4d2-30f264ada110
created: 2019-06-11T16:30:16.672Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0935
external_id: M0935
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:27.991Z
name: Limit Access to Resource Over Network
description: Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.
labels: IEC 62443-3-3:2013 - SR 5.1
IEC 62443-4-2:2019 - CR 5.1
NIST SP 800-53 Rev. 5 - AC-3; SC-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30
created: 2019-06-11T16:35:25.488Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0938
external_id: M0938
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:28.155Z
name: Execution Prevention
description: Block execution of code on a system through application control, and/or script blocking.
labels: IEC 62443-3-3:2013 - SR 3.2
IEC 62443-4-2:2019 - CR 3.2
NIST SP 800-53 Rev. 5 - SI-3
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--52c7a1a9-3a78-4528-a44f-cd7b0fa3541a
created: 2019-06-06T21:16:18.709Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0814
external_id: M0814
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:28.312Z
name: Static Network Configuration
description: Configure hosts and devices to use static network configurations when possible, protocols that require dynamic discovery/addressing (e.g., ARP, DHCP, DNS) can be used to manipulate network message forwarding and enable various AiTM attacks. This mitigation may not always be usable due to limited device features or challenges introduced with different network configurations.
labels: IEC 62443-3-3:2013 - SR 7.7
IEC 62443-4-2:2019 - CR 7.7
NIST SP 800-53 Rev. 5 - CM-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--5d97c693-e054-48ba-a3a3-eaf6942dfb65
created: 2019-06-06T21:10:35.792Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0927
external_id: M0927
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:28.470Z
name: Password Policies
description: Set and enforce secure password policies for accounts.
labels: IEC 62443-3-3:2013 - SR 1.5
IEC 62443-4-2:2019 - CR 1.5
NIST SP 800-53 Rev. 5 - IA-5
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--622fe4d4-0e8e-4d17-9c25-6c9cef1f15d5
created: 2019-06-06T21:09:47.115Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0926
external_id: M0926
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:28.652Z
name: Privileged Account Management
description: Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
labels: IEC 62443-3-3:2013 - SR 1.3
IEC 62443-4-2:2019 - CR 1.3
NIST SP 800-53 Rev. 5 - AC-2
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2023-10-20T17:02:00.299Z
name: Human User Authentication
description: Require user authentication before allowing access to data or accepting commands to a device. While strong multi-factor authentication is preferable, it is not always feasible within ICS environments. Performing strong user authentication also requires additional security controls and processes which are often the target of related adversarial techniques (e.g., Valid Accounts, Default Credentials). Therefore, associated ATT&CK mitigations should be considered in addition to this, including [Multi-factor Authentication](https://attack.mitre.org/mitigations/M0932), [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), [User Account Management](https://attack.mitre.org/mitigations/M0918), [Privileged Account Management](https://attack.mitre.org/mitigations/M0926), and [User Account Control](https://attack.mitre.org/mitigations/M1052).
labels: IEC 62443-3-3:2013 - SR 1.1
IEC 62443-4-2:2019 - CR 1.1
NIST SP 800-53 Rev. 5 - IA-2
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.1
type: course-of-action
spec_version: 2.1
id: course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0
created: 2020-09-11T16:32:21.854Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0804
external_id: M0804
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: course-of-action
spec_version: 2.1
id: course-of-action--6a02e38a-9629-40c0-8c7d-e98e3470315c
created: 2019-06-06T20:15:34.146Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0920
external_id: M0920
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:39:15.463Z
name: SSL/TLS Inspection
description: Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: course-of-action
spec_version: 2.1
id: course-of-action--71eb7dad-07eb-4bbc-9df0-ac57bf2fba4a
created: 2019-06-11T17:01:25.405Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0945
external_id: M0945
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T21:26:28.975Z
name: Code Signing
description: Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.
labels: IEC 62443-3-3:2013 - SR 3.4
IEC 62443-4-2:2019 - CR 3.4
NIST SP 800-53 Rev. 5 - SI-7
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-10-14T20:31:04.927Z
name: Software Process and Device Authentication
description: Require the authentication of devices and software processes where appropriate. Devices that connect remotely to other systems should require strong authentication to prevent spoofing of communications. Furthermore, software processes should also require authentication when accessing APIs.
labels: IEC 62443-3-3:2013 - SR 1.2
IEC 62443-4-2:2019 - CR 1.2
NIST SP 800-53 Rev. 5 - IA-3
x_mitre_deprecated: no
x_mitre_domains: ics-attack
x_mitre_version: 1.1
type: course-of-action
spec_version: 2.1
id: course-of-action--72e46e53-e12d-4106-9c70-33241b6ed549
created: 2019-06-06T21:16:18.709Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/mitigations/M0813
external_id: M0813
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5