[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-3":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-3","SC-3","Security Function Isolation",5,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Security functions must be isolated from non-security functions.\n\n**In practice.** This means running security tooling, such as identity services, logging platforms and security agents, in protected environments with separate administrative access, and using hardware and operating system features that keep security-critical code apart from general workloads. Tiered administration models that separate identity infrastructure from ordinary servers also support this. Evidence includes architecture diagrams and administrative access separation. Security agents should have tamper protection so ordinary administrators cannot disable them.\n\n**Common gaps.** Security tools are often managed with the same accounts as ordinary infrastructure, so one compromise exposes both. Identity infrastructure is frequently administered from ordinary workstations. Cloud security tooling is often hosted in the same accounts as the workloads it protects.","Isolate security functions from nonsecurity functions.\nDiscussion: Security functions are isolated from nonsecurity functions by means of an isolation boundary implemented within a system via partitions and domains. The isolation boundary controls access to and protects the integrity of the hardware, software, and firmware that perform system security functions. Systems implement code separation in many ways, such as through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that protect the code on disk and address space protections that protect executing code. Systems can restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. While the ideal is for all code within the defined security function isolation boundary to only contain security-relevant code, it is sometimes necessary to include nonsecurity functions as an exception. The isolation of security functions from nonsecurity functions can be achieved by applying the systems security engineering design principles in [SA-8](#sa-8) , including [SA-8(1)](#sa-8.1), [SA-8(3)](#sa-8.3), [SA-8(4)](#sa-8.4), [SA-8(10)](#sa-8.10), [SA-8(12)](#sa-8.12), [SA-8(13)](#sa-8.13), [SA-8(14)](#sa-8.14) , and [SA-8(18)](#sa-8.18).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"spectre-v2-btr-variant-extracts-linux-root-hashes-via-cpu-speculation","Spectre v2 BTR Variant Extracts Linux Root Hashes via CPU Speculation","2026-09-29T18:20:41.045+00:00",{"slug":25,"title":26,"published_at":27},"ai-agent-trust-boundary-flaws-enable-supply-chain-compromise","AI Agent Trust Boundary Flaws Enable Supply Chain Compromise","2026-08-05T20:22:28.321+00:00",{"slug":29,"title":30,"published_at":31},"adobe-acrobat-chrome-extension-uxss-flaw-exposed-whatsapp-web-session-data","Adobe Acrobat Chrome Extension UXSS Flaw Exposed WhatsApp Web Session Data","2026-07-22T20:20:35.809+00:00",{"slug":33,"title":34,"published_at":35},"ai-code-analysis-tool-vulnerability-exposes-github-tokens-through-input-injection","AI Code Analysis Tool Vulnerability Exposes GitHub Tokens Through Input Injection","2026-03-31T08:07:50.624+00:00",{"slug":37,"title":38,"published_at":39},"malicious-ai-library-steals-developer-credentials","Malicious AI Library Steals Developer Credentials","2026-03-26T14:07:07.067+00:00",[41,46,51,55,59,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":47,"name":48,"problem":49,"stories":50},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":52,"name":53,"problem":54,"stories":50},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":56,"name":57,"problem":58,"stories":50},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"slug":60,"name":61,"problem":62,"stories":63},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":65,"name":66,"problem":67,"stories":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[69,75,79,83,87,91,95,99],{"family":70,"item":71,"code":72,"title":73,"together":74},"cis","7","Control 7","Continuous Vulnerability Management",4,{"family":70,"item":76,"code":77,"title":78,"together":45},"6","Control 6","Access Control Management",{"family":5,"item":80,"code":81,"title":82,"together":45},"ac-6","AC-6","Least Privilege",{"family":70,"item":84,"code":85,"title":86,"together":50},"16","Control 16","Application Software Security",{"family":70,"item":88,"code":89,"title":90,"together":50},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":92,"item":93,"code":94,"title":94,"together":50},"itil","overview","ITIL",{"family":70,"item":96,"code":97,"title":98,"together":50},"2","Control 2","Inventory and Control of Software Assets",{"family":5,"item":100,"code":101,"title":102,"together":50},"si-2","SI-2","Flaw Remediation"]