THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · CM-7

Least Functionality

US National Institute of Standards and Technology (NIST) · cited in 279 of our lessons

Explanation

What it asks for. Systems must be configured to provide only essential capabilities, and unnecessary functions, ports, protocols, software and services must be prohibited or restricted.

In practice. Doing this well means removing or disabling unused services and software at build time, closing unneeded ports, and using application allowlisting where feasible. Periodic reviews identify functions that have become unnecessary. Auditors look for hardened build standards, port and service scans, allowlisting policies and records of review. The idea also appears in CIS Controls 2 and 4.

Common gaps. Default installations often bring unneeded services that are never removed. Legacy protocols such as SMBv1 or unencrypted management interfaces tend to linger long after they stop being required. Nobody may own the job of reviewing whether enabled functions are still needed.

Open SP 800-53 at NIST
The official text
a. Configure the system to provide only [Assignment: organization-defined mission-essential capabilities] ; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services]. Discussion: Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 279.