safemode.space
← All techniques
EX-0003
ST0004Execution

Modify Authentication Process

Description

The adversary alters how the spacecraft validates authority so that future inputs are accepted on their terms. Modifications can target code (patching flight binaries, hot-patching functions in memory, hooking command handlers), data (changing key identifiers, policy tables, or counter initialization), or control flow (short-circuiting MAC checks, widening anti-replay windows, bypassing interlocks on specific opcodes). Common choke points include telecommand verification routines, bootloader or update verifiers, gateway processors that bridge payload and bus traffic, and maintenance dictionaries invoked in special modes. Subtle variants preserve outward behavior, producing normal-looking acknowledgments and counters, while internally accepting a broader set of origins, opcodes, or timetags. Others introduce conditional logic so the backdoor only activates under specific geometry or timing, masking during routine audit. Once resident, the modified process becomes the new trust oracle, enabling recurring execution for the attacker and, in some cases, denying legitimate control by causing authentic inputs to fail verification or to be deprioritized.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(d)
    addresses
    moderate
    derived

    Authentication architecture itself is an obligation; manufacturers must design auth processes that resist self-modification through hardware-rooted identity and signed/enforced code paths.

  • craAnnex I, Part I, (2)(f)
    addresses
    high
    derived

    Integrity protection on programs (including authentication-validating code) is the manufacturer-side obligation that resists modifications to authentication logic; signed code, runtime integrity verification and secure-boot make hot-patching the auth layer fail integrity checks.

  • eu-space-actArt. 81(1)
    addresses
    high
    direct

    Modifying the spacecraft's authentication process — patching command verification routines, hooking handlers, widening anti-replay windows — directly attacks the IAM machinery 81(1) places under operator governance.

  • eu-space-actArt. 81(4)
    addresses
    moderate
    direct

    Authentication-process modification (primary: Art. 81(1)) cascades to 81(4) — credential lifecycle audit surfaces anomalous changes to authentication.

  • eu-space-actArt. 84(2)
    addresses
    moderate
    inferred

    Art. 84(2)'s comply-with-Annex-VII-5.1 reference is domain-relevant to authentication-process modification but names no specific interdicting mechanism in the cited text.

  • eu-space-actArt. 85(3)
    addresses
    high
    direct

    85(3)(a)'s end-to-end authentication and 85(3)(b)'s telecommand encryption are the cryptographic disciplines this technique attacks; tamper-resistance of the verifier is part of the broader cryptographic concept under 85(1).

  • nis2Art. 21(2)(e)
    addresses
    high
    direct

    Patches to flight binaries, hot-patches in memory, and command-handler hooks are the integrity failures Art. 21(2)(e)'s secure development/maintenance and vulnerability-handling/disclosure obligation is meant to prevent and detect.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    inferred

    This technique modifies the running command-validation logic to become the trust oracle; Art. 21(2)(h) crypto is the subject being subverted, and the operative control is flight-code and memory integrity. Addresses (domain relevance).

  • nis2Art. 21(2)(i)
    addresses
    moderate
    inferred

    EX-0003 subverts command authentication and authorization (short-circuited MAC checks, widened anti-replay windows, altered policy tables); NIS2 21(2)(i) access control policies govern the integrity of the authority-validation this technique attacks.

  • nis2-implAnnex 6.2.1
    addresses
    moderate
    derived

    Modifications to authentication code (binary patches, hot-patches, service replacement) sit inside the secure-development envelope; the rules for code review, integrity verification and signed-build provenance are the controls that detect such modifications.

  • nis2-implAnnex 6.4.1
    addresses
    high
    derived

    Change-management procedures govern modifications to flight or ground authentication services; they are the procedural envelope that detects and blocks unauthorized auth-process alteration.

  • nis2-implAnnex 6.6.1
    addresses
    moderate
    derived

    Patch-management procedures ensure that authentication-related fixes are applied through controlled channels; out-of-band modifications to auth logic should fail patch-integrity checks.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i01
    mitigates
    moderate

    Configuration management with monitoring of security configurations identifies modifications to policy tables, key identifiers, and counter initialization.

  • ENISA-STL-2025-03-sD.21-i03
    addresses
    moderate

    A documented secure development lifecycle is relevant to code quality, but the generic secure-engineering-principles excerpt does not actively prevent the runtime authentication-process modification EX-0003 uses (hot-patching, handler hooking, MAC short-circuiting).

  • ENISA-STL-2025-03-sD.21-i08
    addresses
    moderate

    Documented change-management with configuration change control covers the modifications to flight binaries and verifier paths EX-0003 attempts.

  • ENISA-STL-2025-03-sD.25-i10
    addresses
    high

    Integrity-checking mechanisms on mission software and firmware detect modification of authentication code paths and gateway processors.

Cross-reference controls

  • csf-2-0DE.CM-01Networks and network services are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0003 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-01. Through SPARTA: SPARTA's catalog maps EX-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15.

  • csf-2-0DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0003 against CM-3 Configuration Change Control, and CSF 2.0's own crosswalk names that control as an informative reference for DE.CM-09. Through SPARTA: SPARTA's catalog maps EX-0003 to countermeasure CM0032 On-board Intrusion Detection & Prevention, and that countermeasure's own CSF references include DE.CM-09. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. DE.CM-09 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • csf-2-0PR.PS-01Configuration management practices are established and applied
    addresses
    moderate

    Supported by two independent derivations that agree, neither of them SafeMode's invention. Through NIST 800-53: SafeMode's curated mapping records EX-0003 against CM-3 Configuration Change Control; CM-5 Access Restrictions for Change, and CSF 2.0's own crosswalk names that control as an informative reference for PR.PS-01. Through SPARTA: SPARTA's catalog maps EX-0003 to countermeasure CM0030 Crypto Key Management, and that countermeasure's own CSF references include PR.PS-01. Recorded as `addresses` rather than `mitigates` because a CSF subcategory states an outcome to be achieved while the underlying control states the mechanism that achieves it, which is the mechanism-versus-mandate ceiling in decisions entry 15. PR.PS-01 is one of CSF's broader outcomes, so this edge locates the technique within CSF's structure rather than naming a specific defence.

  • d3fendD3-ABPIApplication-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Application-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Intra-process memory partitioning is implemented in flight software itself, so the control applies wherever that software runs. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HBPIHardware-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Hardware-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Hardware memory protection is standard on flight processors (MMU or MPU partitioning), so the control applies on-board. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HRHost Reboot
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that Host Reboot counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. A commanded reset is a normal spacecraft recovery action, so terminating running state by reboot applies on-board. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-HSHost Shutdown
    addresses
    low

    Derived by composition, not from a source that names this pair. D3FEND publishes that Host Shutdown counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Powering a component down is a normal spacecraft safing action, so the control applies to flight subsystems as well as ground hosts. Recorded at low confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-KBPIKernel-based Process Isolation
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Kernel-based Process Isolation counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Kernel-level task isolation is what a partitioned real-time operating system provides on-board, so the control applies to flight software. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PSProcess Suspension
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Suspension counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Suspending a task is available to flight executives as well as to ground operating systems. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-PTProcess Termination
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that Process Termination counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Terminating a task is available to flight executives as well as to ground operating systems. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • d3fendD3-SCFSystem Call Filtering
    addresses
    moderate

    Derived by composition, not from a source that names this pair. D3FEND publishes that System Call Filtering counters T1556 Modify Authentication Process; SafeMode's curated mapping records EX-0003 as addressing that same adversary behaviour in the space domain. Restricting which system services a task may invoke applies to a partitioned flight executive as well as a ground kernel. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.

  • mitre-attack-enterpriseT1078Valid Accounts
    relates to
    moderate

    Mapped by SPARTA, not curated by SafeMode Space.

  • mitre-attack-enterpriseT1556Modify Authentication Process
    addresses
    moderate

    T1556 'Modify Authentication Process' is the exact-title-and-scope MITRE technique for tampering with authentication logic; SPARTA EX-0003 is the same activity. Cross-tactic moderate because T1556 sits in credential-access/persistence (used to compromise creds or persist) while SPARTA EX-0003 is execution (modifying auth as part of an exploit chain).

  • mitre-attack-icsT0892Change Credential
    addresses
    moderate

    T0892 'Change Credential' addresses adversary modification of credentials and credential-related software/configuration; SPARTA EX-0003 'Modify Authentication Process' is the broader auth-mechanism modification at cross-tactic level. Cross-tactic moderate (T0892 sits in inhibit-response-function while SPARTA EX-0003 is execution); concept-adjacent but not perfectly aligned (T0892 is credential-change-specific while SPARTA EX-0003 includes broader auth-process modifications).

  • nasa-bpgMI-AUTH-02Comprehensive Authentication and Authorization Function
    addresses
    moderate

    The technique attacks the authentication mechanism itself, by patching flight binaries, hooking command handlers, or changing key identifiers. A requirement that authentication be comprehensive raises the bar the adversary must subvert but does not prevent its subversion; software integrity, not this practice, is what interdicts.

  • nist-80053-rev5AC-14Permitted Actions Without Identification or Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17Remote Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(1)Monitoring and Control
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(10)Authenticate Remote Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(2)Protection of Confidentiality and Integrity Using Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-17(6)Protection of Mechanism Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18Wireless Access
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-18(1)Authentication and Encryption
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-2(11)Usage Conditions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3Access Enforcement
    mitigates
    moderate

    AC-3 mitigates EX-0003 by enforcing authorization on access to authentication-handler code and config.

  • nist-80053-rev5AC-3(10)Audited Override of Access Control Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AC-3(11)Restrict Access to Specific Information Types
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-12Audit Record Generation
    addresses
    moderate

    AU-12 addresses logging governance whose enforcement makes auth-handler changes visible.

  • nist-80053-rev5AU-14Session Audit
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-2Event Logging
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3Content of Audit Records
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-3(1)Additional Audit Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4Audit Log Storage Capacity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-4(1)Transfer to Alternate Storage
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5Response to Audit Logging Process Failures
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(2)Real-time Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-5(5)Alternate Audit Logging Capability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(1)Automated Process Integration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-6(4)Central Review and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-8Time Stamps
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9Protection of Audit Information
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(2)Store on Separate Physical Systems or Components
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5AU-9(3)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-3Information Exchange
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CA-7(6)Automation Support for Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11User-installed Software
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-11(3)Automated Enforcement and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-14Signed Components
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-3Configuration Change Control
    addresses
    moderate

    CM-3 addresses change-control governance for any modification to authentication mechanisms.

  • nist-80053-rev5CM-3(6)Cryptography Management
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CM-5Access Restrictions for Change
    addresses
    moderate

    CM-5 (Access Restrictions for Change) mitigates EX-0003 by gating authentication-handler modifications behind change controls.

  • nist-80053-rev5CM-5(6)Limit Library Privileges
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10System Recovery and Reconstitution
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5CP-10(4)Restore Within Time Period
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-2Identification and Authentication (Organizational Users)
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-4(9)Attribute Maintenance and Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5Authenticator Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(6)Protection of Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-5(7)No Embedded Unencrypted Static Authenticators
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IA-7Cryptographic Module Authentication
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4Incident Handling
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(11)Integrated Incident Response Team
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(12)Malicious Code and Forensic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(14)Security Operations Center
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-4(5)Automatic Disabling of System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5Incident Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5IR-5(1)Automated Tracking, Data Collection, and Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8Security and Privacy Architectures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5PL-8(1)Defense in Depth
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-10Threat Hunting
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5RA-3(4)Predictive Cyber Analytics
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-10(1)Software and Firmware Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-11Developer Testing and Evaluation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-3System Development Life Cycle
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-4(5)System, Component, and Service Configurations
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8Security and Privacy Engineering Principles
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(13)Minimized Security Elements
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(18)Trusted Communications Channels
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(19)Continuous Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(21)Self-analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(22)Accountability and Traceability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(23)Secure Defaults
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(29)Repeatable and Documented Procedures
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-8(31)Secure System Modification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9External System Services
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-10Network Disconnect
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12Cryptographic Key Establishment and Management
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(1)Availability
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(2)Symmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(3)Asymmetric Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-12(6)Physical Control of Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-13Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16Transmission of Security and Privacy Attributes
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, csf-2-0, nist-ir-8441, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(1)Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-16(3)Cryptographic Binding
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-28(3)Cryptographic Keys
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-32(1)Separate Physical Domains for Privileged Functions
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5Denial-of-service Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-5(3)Detection and Monitoring
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7Boundary Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(10)Prevent Exfiltration
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(11)Restrict Incoming Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(18)Fail Secure
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(5)Deny by Default — Allow by Exception
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-7(9)Restrict Threatening Outgoing Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(1)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10Information Input Validation
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(3)Predictable Behavior
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(5)Restrict Inputs to Trusted Sources and Approved Formats
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-10(6)Injection Prevention
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-16Memory Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, csf-2-0, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-17Fail-safe Procedures
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8323r1, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3Malicious Code Protection
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(10)Malicious Code Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-3(8)Detect Unauthorized Commands
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4System Monitoring
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, nasa-bpg, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(1)System-wide Intrusion Detection System
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(11)Analyze Communications Traffic Anomalies
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(13)Analyze Traffic and Event Patterns
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(16)Correlate Monitoring Information
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(17)Integrated Situational Awareness
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(2)Automated Tools and Mechanisms for Real-time Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(23)Host-based Devices
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(24)Indicators of Compromise
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(4)Inbound and Outbound Communications Traffic
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(5)System-generated Alerts
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-4(7)Automated Response to Suspicious Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-6Security and Privacy Function Verification
    relates to
    moderate

    Referenced in: sparta-data, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7Software, Firmware, and Information Integrity
    relates to
    moderate

    Referenced in: sparta-data, nist-ir-8401, nist-ir-8323r1, nist-ir-8441, nist-ir-8270, aerospace-tor-2023-02161

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(1)Integrity Checks
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(12)Integrity Verification
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(15)Code Authentication
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(17)Runtime Application Self-protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(6)Cryptographic Protection
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • nist-80053-rev5SI-7(8)Auditing Capability for Significant Events
    relates to
    moderate

    Referenced in: sparta-data

    Mapped by SPARTA, not curated by SafeMode Space.

  • space-shieldT2009.002Forge Digital Certificates
    addresses
    moderate

    T2009.002 'Forge Digital Certificates' captures EX-0003's credential-management process compromise scope (gaining control of the credential-management system to issue forged credentials).

  • space-shieldT2014.003OBSW modification
    addresses
    moderate

    T2014.003 'OBSW modification' covers software backdoors that 'permit a future access on the resource' — directly aligned with EX-0003's hot-patching of command handlers, MAC checks, and authentication routines to widen acceptance.

SPARTA countermeasures

Cite as SafeMode Space, EX-0003 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.