[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-18":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-18","SC-18","Mobile Code",45,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must define acceptable and unacceptable mobile code and mobile code technologies, and authorise, monitor and control the use of mobile code within the system.\n\n**In practice.** Mobile code here means code delivered from remote sources and run locally, such as scripts in documents, browser-delivered code and macros. Good practice includes blocking Office macros from the internet, restricting script interpreters with policy, browser hardening and application control. Auditors look for policy settings, macro and script control configurations and evidence of monitoring for script abuse. Macro settings can allow signed macros from trusted publishers so that business needs are still met.\n\n**Common gaps.** Macros and script hosts remain common initial access routes because restrictions were never applied or were relaxed for business convenience. Exceptions are rarely reviewed. Script activity is also seldom logged in enough detail to spot abuse.","a. Define acceptable and unacceptable mobile code and mobile code technologies; and\n  b. Authorize, monitor, and control the use of mobile code within the system.\nDiscussion: Mobile code includes any program, application, or content that can be transmitted across a network (e.g., embedded in an email, document, or website) and executed on a remote system. Decisions regarding the use of mobile code within organizational systems are based on the potential for the code to cause damage to the systems if used maliciously. Mobile code technologies include Java applets, JavaScript, HTML5, WebGL, and VBScript. Usage restrictions and implementation guidelines apply to both the selection and use of mobile code installed on servers and mobile code downloaded and executed on individual workstations and devices, including notebook computers and smart phones. Mobile code policy and procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":25,"title":26,"published_at":27},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":29,"title":30,"published_at":31},"malicious-ad-networks-weaponized-to-silently-deploy-candiru-spyware","Malicious Ad Networks Weaponized to Silently Deploy Candiru Spyware","2026-10-15T22:20:22.695+00:00",{"slug":33,"title":34,"published_at":35},"zero-click-candiru-spyware-delivered-via-malicious-ads-hits-al-jazeera","Zero-Click Candiru Spyware Delivered via Malicious Ads Hits Al Jazeera","2026-10-15T18:20:37.304+00:00",{"slug":37,"title":38,"published_at":39},"ai-accelerates-full-chain-chrome-exploit-development-to-just-six-days","AI Accelerates Full-Chain Chrome Exploit Development to Just Six Days","2026-10-14T12:20:21.412+00:00",{"slug":41,"title":42,"published_at":43},"fake-cloudflare-pages-trick-users-into-installing-lunexstealer-via-compromised-sites","Fake Cloudflare Pages Trick Users Into Installing LunexStealer via Compromised Sites","2026-10-07T08:20:36.6+00:00",{"slug":45,"title":46,"published_at":47},"clickfix-attack-abuses-browser-cache-to-smuggle-malicious-payloads","ClickFix Attack Abuses Browser Cache to Smuggle Malicious Payloads","2026-10-06T08:21:47.852+00:00",{"slug":49,"title":50,"published_at":51},"star-blizzards-redflick-technique-abuses-virtual-disks-and-lnk-files-to-deploy-backdoor","Star Blizzard's RedFlick Technique Abuses Virtual Disks and LNK Files to Deploy Backdoor","2026-09-30T22:20:43.565+00:00",{"slug":53,"title":54,"published_at":55},"microsoft-enforces-csp-to-block-entra-id-script-injection-attacks","Microsoft Enforces CSP to Block Entra ID Script Injection Attacks","2026-09-30T14:20:21.826+00:00",{"slug":57,"title":58,"published_at":59},"fake-chatgpt-ads-use-clickfix-to-deploy-remote-access-trojans","Fake ChatGPT Ads Use ClickFix to Deploy Remote Access Trojans","2026-09-29T22:21:13.221+00:00",{"slug":61,"title":62,"published_at":63},"fake-chatgpt-custom-gpt-delivers-rat-via-eight-stage-clickfix-attack","Fake ChatGPT Custom GPT Delivers RAT via Eight-Stage ClickFix Attack","2026-09-29T12:21:55.079+00:00",{"slug":65,"title":66,"published_at":67},"fake-cloudflare-pages-on-hacked-ukrainian-sites-spread-psychedelic-stealer","Fake Cloudflare Pages on Hacked Ukrainian Sites Spread Psychedelic Stealer","2026-09-24T21:20:56.441+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",41,{"slug":75,"name":76,"problem":77,"stories":78},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",19,{"slug":80,"name":81,"problem":82,"stories":83},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",15,{"slug":85,"name":86,"problem":87,"stories":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",12,{"slug":90,"name":91,"problem":92,"stories":93},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",11,{"slug":95,"name":96,"problem":97,"stories":98},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",6,[100,105,111,117,122,126,131,135],{"family":5,"item":101,"code":102,"title":103,"together":104},"si-3","SI-3","Malicious Code Protection",33,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","2","Control 2","Inventory and Control of Software Assets",29,{"family":112,"item":113,"code":114,"title":115,"together":116},"gdpr","32","Article 32","Security of processing",27,{"family":106,"item":118,"code":119,"title":120,"together":121},"9","Control 9","Email and Web Browser Protections",25,{"family":5,"item":123,"code":124,"title":125,"together":78},"at-2","AT-2","Literacy Training and Awareness",{"family":106,"item":127,"code":128,"title":129,"together":130},"13","Control 13","Network Monitoring and Defense",17,{"family":106,"item":132,"code":133,"title":134,"together":130},"14","Control 14","Security Awareness and Skills Training",{"family":136,"item":137,"code":138,"title":139,"together":83},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]