[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-39":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-39","SC-39","Process Isolation",30,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Systems must maintain a separate execution domain for each executing process.\n\n**In practice.** This is largely delivered by modern operating systems, hypervisors and container platforms through separate address spaces and privilege boundaries. Organisations support it by using supported platforms, keeping memory protection features enabled, running workloads in appropriately isolated containers or virtual machines and avoiding configurations that weaken isolation. Evidence may include platform documentation, hardening settings and container security policies. Container platforms should enforce policies that block privileged containers and restrict access to the host. Auditors may also check that address space layout randomisation and similar protections are left on.\n\n**Common gaps.** Containers run with privileged mode or host namespaces undermine process isolation. Legacy systems without modern memory protections are often left in place. Isolation is assumed rather than checked, so weaknesses are found only during an incident.","Maintain a separate execution domain for each executing system process.\nDiscussion: Systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each system process has a distinct address space so that communication between processes is performed in a manner controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces. Process isolation technologies, including sandboxing or virtualization, logically separate software and firmware from other software, firmware, and data. Process isolation helps limit the access of potentially untrusted software to other system resources. The capability to maintain separate execution domains is available in commercial operating systems that employ multi-state processor technologies.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"pwnescape-linux-kernel-flaw-allows-guest-vms-to-read-host-memory","PwnEscape: Linux Kernel Flaw Allows Guest VMs to Read Host Memory","2026-10-15T22:20:53.307+00:00",{"slug":25,"title":26,"published_at":27},"linux-kernel-vhost-flaw-grants-root-and-enables-vm-escape","Linux Kernel vhost Flaw Grants Root and Enables VM Escape","2026-10-14T10:21:04.498+00:00",{"slug":29,"title":30,"published_at":31},"researchers-breach-windows-smartscreen-vbs-enclave-via-memory-write-and-timing-flaw","Researchers Breach Windows SmartScreen VBS Enclave via Memory Write and Timing Flaw","2026-10-14T08:21:27.74+00:00",{"slug":33,"title":34,"published_at":35},"chatgpt-macos-app-flaw-exposed-chat-logs-and-browser-sessions","ChatGPT macOS App Flaw Exposed Chat Logs and Browser Sessions","2026-10-02T10:20:19.849+00:00",{"slug":37,"title":38,"published_at":39},"spectre-v2-btr-variant-bypasses-linux-defenses-to-leak-sensitive-memory","Spectre-v2 BTR Variant Bypasses Linux Defenses to Leak Sensitive Memory","2026-09-29T18:21:22.375+00:00",{"slug":41,"title":42,"published_at":43},"spectre-v2-btr-variant-leaks-sensitive-data-across-major-cpu-architectures","Spectre v2 BTR Variant Leaks Sensitive Data Across Major CPU Architectures","2026-09-29T18:21:03.22+00:00",{"slug":45,"title":46,"published_at":47},"cloudflare-container-flaw-exposed-cross-tenant-data-via-unzeroed-storage-blocks","Cloudflare Container Flaw Exposed Cross-Tenant Data via Unzeroed Storage Blocks","2026-09-27T20:20:39.506+00:00",{"slug":49,"title":50,"published_at":51},"file-notification-apis-silently-expose-user-behavior-across-major-oses","File Notification APIs Silently Expose User Behavior Across Major OSes","2026-09-25T12:20:35.783+00:00",{"slug":53,"title":54,"published_at":55},"critical-linux-kvm-flaw-allows-guest-vms-to-escape-and-access-host-memory-on-arm64","Critical Linux KVM Flaw Allows Guest VMs to Escape and Access Host Memory on ARM64","2026-09-22T12:21:00.549+00:00",{"slug":57,"title":58,"published_at":59},"openai-codex-sandbox-escapes-highlight-ai-tool-isolation-risks","OpenAI Codex Sandbox Escapes Highlight AI Tool Isolation Risks","2026-09-20T14:20:21.478+00:00",{"slug":61,"title":62,"published_at":63},"malicious-browser-extensions-can-hijack-ai-agents-via-bragjack-attack","Malicious Browser Extensions Can Hijack AI Agents via BragJack Attack","2026-09-19T18:20:19.36+00:00",{"slug":65,"title":66,"published_at":67},"pre-auth-rce-in-orkes-conductor-exploited-in-the-wild","Pre-Auth RCE in Orkes Conductor Exploited in the Wild","2026-09-19T10:20:18.378+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",20,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",13,{"slug":80,"name":81,"problem":82,"stories":83},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",11,{"slug":85,"name":86,"problem":87,"stories":88},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",9,{"slug":90,"name":91,"problem":92,"stories":93},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",8,{"slug":95,"name":96,"problem":97,"stories":98},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",4,[100,105,109,114,119,124,129,133],{"family":101,"item":102,"code":103,"title":104,"together":73},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":101,"item":106,"code":107,"title":108,"together":73},"7","Control 7","Continuous Vulnerability Management",{"family":5,"item":110,"code":111,"title":112,"together":113},"si-2","SI-2","Flaw Remediation",18,{"family":5,"item":115,"code":116,"title":117,"together":118},"ac-6","AC-6","Least Privilege",14,{"family":120,"item":121,"code":122,"title":123,"together":118},"gdpr","32","Article 32","Security of processing",{"family":125,"item":126,"code":127,"title":127,"together":128},"itil","overview","ITIL",10,{"family":101,"item":130,"code":131,"title":132,"together":88},"2","Control 2","Inventory and Control of Software Assets",{"family":101,"item":134,"code":135,"title":136,"together":88},"12","Control 12","Network Infrastructure Management"]