THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · SC-30

Concealment and Misdirection

US National Institute of Standards and Technology (NIST) · cited in 8 of our lessons

Explanation

What it asks for. The organisation must employ defined concealment and misdirection techniques for defined systems and periods to confuse and mislead adversaries.

In practice. This is an advanced control most often adopted by mature security programmes. Techniques include randomising configurations, hiding system details from public view, minimising information disclosed in banners and error messages, and using deception technologies. Evidence would include a description of the techniques chosen, where they apply and how their effect is monitored. Any techniques used should be documented so that defenders are not misled themselves.

Common gaps. Organisations sometimes treat obscurity as a substitute for real protection rather than a supplement. Basic information leakage through banners, error messages and public metadata is often overlooked. Concealment can also complicate operations if it is not coordinated with IT teams.

Open SP 800-53 at NIST
The official text
Employ the following concealment and misdirection techniques for [Assignment: organization-defined systems] at [Assignment: organization-defined time periods] to confuse and mislead adversaries: [Assignment: organization-defined concealment and misdirection techniques]. Discussion: Concealment and misdirection techniques can significantly reduce the targeting capabilities of adversaries (i.e., window of opportunity and available attack surface) to initiate and complete attacks. For example, virtualization techniques provide organizations with the ability to disguise systems, potentially reducing the likelihood of successful attacks without the cost of having multiple platforms. The increased use of concealment and misdirection techniques and methods—including randomness, uncertainty, and virtualization—may sufficiently confuse and mislead adversaries and subsequently increase the risk of discovery and/or exposing tradecraft. Concealment and misdirection techniques may provide additional time to perform core mission and business functions. The implementation of concealment and misdirection techniques may add to the complexity and management overhead required for the system.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered.