Centralize network AAA.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1601.002 | Downgrade System Image |
Comments
Adversaries may install an older network-device image to restore vulnerable functionality or bypass newer protections. AAA authorization restricts downgrade and image-installation commands to approved roles, directly preventing unauthorized rollback operations.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1601.001 | Patch System Image |
Comments
Adversaries may install malicious or unauthorized network-device images to modify device operation. AAA command authorization restricts image upload and installation functions to approved administrative roles, directly preventing unauthorized system-image replacement.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1602.002 | Network Device Configuration Dump |
Comments
Adversaries may retrieve network-device configurations to collect topology, credentials, routes, and security policy. AAA command authorization denies configuration-display and export operations to identities without explicit permission, directly restricting configuration collection.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1686.002 | Network Device Firewall |
Comments
Adversaries may change firewall rules, ACLs, or security zones to weaken network restrictions. Centralized AAA authorization limits those configuration commands to approved roles, directly preventing unauthorized identities from modifying firewall policy.
References
|
| CIS-12.5 | Centralize Network Authentication, Authorization, and Auditing network AAA | mitigates | T1059.008 | Network Device CLI |
Comments
Adversaries may use network-device CLIs to execute privileged administrative commands. Centralized AAA with command-level authorization restricts which commands each identity may execute, directly preventing unauthorized CLI operations.
References
|