BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SA-15(05) Attack Surface Reduction

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged SA part of SA-15

Title

Attack Surface Reduction

Control

Require the developer of the system, system component, or system service to reduce attack surfaces to [Assignment: thresholds].

Discussion

Attack surface reduction is closely aligned with threat and vulnerability analyses and system architecture and design. Attack surface reduction is a means of reducing risk to organizations by giving attackers less opportunity to exploit weaknesses or deficiencies (i.e., potential vulnerabilities) within systems, system components, and system services. Attack surface reduction includes implementing the concept of layered defenses, applying the principles of least privilege and least functionality, applying secure software development practices, deprecating unsafe functions, reducing entry points available to unauthorized users, reducing the amount of code that executes, and eliminating application programming interfaces (APIs) that are vulnerable to attacks.

Parameters

sa-15.05_odp: thresholds

Related controls

ac-6, cm-7, ra-3, sa-11

Assessment objective

SA-15(05) the developer of the system, system component, or system service is required to reduce attack surfaces to [Assignment: thresholds].

STIG rules that implement this control 1

Application Security and Development V6R5