[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fsc-7":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","sc-7","SC-7","Boundary Protection",821,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Communications must be monitored and controlled at the external boundary and at key internal boundaries, publicly accessible components must sit in separated subnetworks, and external connections must only go through managed interfaces that follow the security architecture.\n\n**In practice.** Doing this well means firewalls or cloud security groups with default-deny rules, a segmented zone for internet-facing services, controlled egress, and internal segmentation between user, server and management networks. Auditors expect network diagrams, rule sets with documented business justification, rule review records and evidence of monitoring at boundaries. CIS Control 12 and ISO\u002FIEC 27001 network segregation cover similar ground.\n\n**Common gaps.** Flat internal networks, permissive outbound rules and firewall rule bases that are never reviewed are typical findings. Cloud environments with many separate entry points often lack a single, managed view of the boundary.","a. Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system;\n  b. Implement subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and\n  c. Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.\nDiscussion: Managed interfaces include gateways, routers, firewalls, guards, network-based malicious code analysis, virtualization systems, or encrypted tunnels implemented within a security architecture. Subnetworks that are physically or logically separated from internal networks are referred to as demilitarized zones or DMZs. Restricting or prohibiting interfaces within organizational systems includes restricting external web traffic to designated web servers within managed interfaces, prohibiting external traffic that appears to be spoofing internal addresses, and prohibiting internal traffic that appears to be spoofing external addresses. [SP 800-189](#f5edfe51-d1f2-422e-9b27-5d0e90b49c72) provides additional information on source address validation techniques to prevent ingress and egress of traffic with spoofed addresses. Commercial telecommunications services are provided by network components and consolidated management systems shared by customers. These services may also include third party-provided access lines and other service elements. Such services may represent sources of increased risk despite contract security provisions. Boundary protection may be implemented as a common control for all or part of an organizational network such that the boundary to be protected is greater than a system-specific boundary (i.e., an authorization boundary).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"beyondtrust-zero-day-highlights-critical-risk-of-unpatched-edge-devices","BeyondTrust Zero-Day Highlights Critical Risk of Unpatched Edge Devices","2026-10-16T22:20:18.59+00:00",{"slug":25,"title":26,"published_at":27},"peerstitch-malware-exploits-unpatched-fortios-to-evade-detection-via-legitimate-processes","PEERSTITCH Malware Exploits Unpatched FortiOS to Evade Detection via Legitimate Processes","2026-10-16T08:21:33.492+00:00",{"slug":29,"title":30,"published_at":31},"ai-agents-accessed-live-sensitive-data-during-testing-due-to-exposed-credentials-and-excessive-permi","AI Agents Accessed Live Sensitive Data During Testing Due to Exposed Credentials and Excessive Permissions","2026-10-16T08:20:59.754+00:00",{"slug":33,"title":34,"published_at":35},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","2026-10-16T08:20:44.884+00:00",{"slug":37,"title":38,"published_at":39},"unpatched-routers-hijacked-to-silently-sell-your-bandwidth","Unpatched Routers Hijacked to Silently Sell Your Bandwidth","2026-10-15T20:21:08.002+00:00",{"slug":41,"title":42,"published_at":43},"eclipse-milo-vulnerabilities-enable-data-loss-impersonation-and-dos","Eclipse Milo Vulnerabilities Enable Data Loss, Impersonation, and DoS","2026-10-15T18:21:51.861+00:00",{"slug":45,"title":46,"published_at":47},"path-traversal-flaw-in-thermo-fisher-torrent-suite-exposes-sensitive-files","Path Traversal Flaw in Thermo Fisher Torrent Suite Exposes Sensitive Files","2026-10-15T18:21:22.798+00:00",{"slug":49,"title":50,"published_at":51},"silent-lynx-exploits-unpatched-winrar-flaw-to-backdoor-cis-governments","Silent Lynx Exploits Unpatched WinRAR Flaw to Backdoor CIS Governments","2026-10-15T18:20:53.262+00:00",{"slug":53,"title":54,"published_at":55},"small-ai-models-could-enable-self-propagating-ai-worms-by-2026","Small AI Models Could Enable Self-Propagating AI Worms by 2026","2026-10-15T14:20:39.044+00:00",{"slug":57,"title":58,"published_at":59},"mercenary-spyware-hijacks-ad-networks-to-silently-infect-devices","Mercenary Spyware Hijacks Ad Networks to Silently Infect Devices","2026-10-15T12:21:42.608+00:00",{"slug":61,"title":62,"published_at":63},"cikabika-rat-abuses-discord-and-ngrok-to-evade-detection","CikaBika RAT Abuses Discord and Ngrok to Evade Detection","2026-10-15T12:20:40.147+00:00",{"slug":65,"title":66,"published_at":67},"incomplete-patches-leave-backup-software-open-to-active-exploitation","Incomplete Patches Leave Backup Software Open to Active Exploitation","2026-10-15T10:21:36.587+00:00",[69,74,79,83,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",362,{"slug":75,"name":76,"problem":77,"stories":78},"patch-management","Automated patch management","Known holes get closed in days, not months.",349,{"slug":80,"name":81,"problem":82,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":84,"name":85,"problem":86,"stories":87},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",137,{"slug":89,"name":90,"problem":91,"stories":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",110,{"slug":94,"name":95,"problem":96,"stories":92},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[98,104,109,114,119,124,130,136],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","12","Control 12","Network Infrastructure Management",564,{"family":99,"item":105,"code":106,"title":107,"together":108},"7","Control 7","Continuous Vulnerability Management",477,{"family":99,"item":110,"code":111,"title":112,"together":113},"13","Control 13","Network Monitoring and Defense",441,{"family":5,"item":115,"code":116,"title":117,"together":118},"si-2","SI-2","Flaw Remediation",400,{"family":120,"item":121,"code":122,"title":122,"together":123},"itil","overview","ITIL",387,{"family":125,"item":126,"code":127,"title":128,"together":129},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",228,{"family":131,"item":132,"code":133,"title":134,"together":135},"gdpr","32","Article 32","Security of processing",227,{"family":5,"item":137,"code":138,"title":139,"together":140},"ra-5","RA-5","Vulnerability Monitoring and Scanning",179]