Home
Mapping Frameworks
CIS Controls Home
Apply Secure Design Principles in Application Architectures

CIS Controls CIS-16.10

Apply secure design principles in application architectures. Secure design principles include the concept of least privilege and enforcing mediation to validate every operation that the user makes, promoting the concept of "never trust user input." Examples include ensuring that explicit error checking is performed and documented for all input, including for size, data type, and acceptable ranges or formats. Secure design also means minimizing the application infrastructure attack surface, such as turning off unprotected ports and services, removing unnecessary programs and files, and renaming or removing default accounts.

Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1078	Valid Accounts	Comments Apply secure design principles to ensure that applications do not store sensitive data or credentials insecurely (e.g. plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage) to help prevent adversaries from obtaining valid accounts. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1550	Use Alternate Authentication Material	Comments Apply secure design principles to implement token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, to help prevent the token from being used by adversaries References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1593.003	Code Repositories	Comments Apply secure design principles to prevent exposure of sensitive information by ensuring credentials and API keys are not embedded in or published through public code repositories to help prevent adversaries from finding information online about victims that can be used during targeting. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1593	Search Open Websites/Domains	Comments Apply secure design principles to prevent exposure of sensitive information by ensuring credentials and API keys are not embedded in or published through public code repositories to help prevent adversaries from finding information online about victims that can be used during targeting. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1496.003	SMS Pumping	Comments Applying secure design principles by implementing CAPTCHA protection on forms that send SMS messages to help prevent adversaries from leveraging messaging services for SMS pumping. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1647	Plist File Modification	Comments Applying secure design principles through Apple developer guidance which enables hardened runtime protections for applications to help prevent adversaries from modifying property list files (plist files). References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1559.003	XPC Services	Comments Applying secure design principles by enabling the Hardened Runtime capability and not including the com.apple.security.get-task-allow entitlement with the value set to any value of true can help prevent adversaries from providing malicious content to an XPC service daemon. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1559	Inter-Process Communication	Comments Applying secure design principles by enabling the Hardened Runtime capability and not including the com.apple.security.get-task-allow entitlement with the value set to any value of true can help prevent adversaries from abusing inter-process communication (IPC) mechanisms. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1574.001	DLL	Comments Applying secure design principles to include hash values in manifest files, where possible, can help prevent adversaries from side-loading malicious dynamic-link library (DLL) files. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1574	Hijack Execution Flow	Comments Applying secure design principles to include hash values in manifest files, where possible, can help prevent adversaries from hijacking the way operating systems run programs and executing their own malicious payloads. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1564.012	File/Path Exclusions	Comments Applying secure design principles to limit custom or difficult-to-manage file and folder exclusions and use trusted, access-restricted installation paths can help prevent adversaries from hiding file-based artifacts in specific folders or filenames excluded from defensive capabilities. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1564.009	Resource Forking	Comments Applying secure design principles by using the application bundle structure and its designated /Resources folder can help prevent adversaries from abusing resource forks to hide malicious code or executables. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1564	Hide Artifacts	Comments Applying secure design principles to limit custom file and folder exclusions and installing applications only in trusted paths protected by restricted file and directory permissions can help prevent adversaries from hiding artifacts associated with their behaviors. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1212	Exploitation for Credential Access	Comments Applying secure design principles to validate authentication requests, including one-time passwords, timestamps or sequence numbers for messages sent, digital signatures, and random session keys, can help prevent adversaries from exploiting software vulnerabilities to attempt to collect credentials. References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures
CIS-16.10	Apply Secure Design Principles in Application Architectures	mitigates	T1550.001	Application Access Token	Comments Apply secure design principles to implement token binding strategies, such as Azure AD token protection or OAuth Proof of Possession, to help prevent the token from being used by adversaries References https://cas.docs.cisecurity.org/en/latest/source/Controls16/#1610-apply-secure-design-principles-in-application-architectures