Skip to content

M1035 Limit Access to Resource Over Network

Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.

Item Value
ID M1035
Version 1.0
Created 11 June 2019
Last Modified 09 June 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain ID Name Use
enterprise T1557 Adversary-in-the-Middle Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.
enterprise T1557.002 ARP Cache Poisoning Create static ARP entries for networked devices. Implementing static ARP entries may be infeasible for large networks.
enterprise T1612 Build Image on Host Limit communications with the container service to local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API on port 2375. Instead, communicate with the Docker API over TLS on port 2376.1
enterprise T1609 Container Administration Command Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.14 In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.2 Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.3
enterprise T1613 Container and Resource Discovery Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.14 In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.2 Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.3
enterprise T1610 Deploy Container Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API, Kubernetes API Server, and container orchestration web applications.14 In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.2 Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.3
enterprise T1546 Event Triggered Execution -
enterprise T1546.008 Accessibility Features If possible, use a Remote Desktop Gateway to manage connections and security configuration of RDP within a network.5
enterprise T1133 External Remote Services Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.
enterprise T1200 Hardware Additions Establish network access control policies, such as using device certificates and the 802.1x standard. 6 Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.
enterprise T1542 Pre-OS Boot -
enterprise T1542.005 TFTP Boot Restrict use of protocols without encryption or authentication mechanisms. Limit access to administrative and management interfaces from untrusted network sources.
enterprise T1563 Remote Service Session Hijacking -
enterprise T1563.002 RDP Hijacking Use remote desktop gateways.
enterprise T1021 Remote Services -
enterprise T1021.001 Remote Desktop Protocol Use remote desktop gateways.
enterprise T1021.002 SMB/Windows Admin Shares Consider disabling Windows administrative shares.
enterprise T1552 Unsecured Credentials Limit network access to sensitive services, such as the Instance Metadata API.
enterprise T1552.005 Cloud Instance Metadata API Limit access to the Instance Metadata API using a host-based firewall such as iptables.
enterprise T1552.007 Container API Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.14 In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.2 Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.3

References

  1. Docker. (n.d.). Protect the Docker Daemon Socket. Retrieved March 29, 2021. ↩↩↩↩↩

  2. Kubernetes. (n.d.). Overview of Cloud Native Security. Retrieved March 8, 2023. ↩↩↩↩

  3. Microsoft. (2023, February 27). AKS-managed Azure Active Directory integration. Retrieved March 8, 2023. ↩↩↩↩

  4. The Kubernetes Authors. (n.d.). Controlling Access to The Kubernetes API. Retrieved March 29, 2021. ↩↩↩↩

  5. Microsoft. (n.d.). Overview of Remote Desktop Gateway. Retrieved June 6, 2016. ↩

  6. Wikipedia. (2018, March 30). IEEE 802.1X. Retrieved April 11, 2018. ↩