NIST 800-53 AC-23 Mappings

Data mining is an analytical process that attempts to find correlations or patterns in large data sets for the purpose of data or knowledge discovery. Data storage objects include database records and database fields. Sensitive information can be extracted from data mining operations. When information is personally identifiable information, it may lead to unanticipated revelations about individuals and give rise to privacy risks. Prior to performing data mining activities, organizations determine whether such activities are authorized. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that address data mining requirements. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Data mining prevention and detection techniques include limiting the number and frequency of database queries to increase the work factor needed to determine the contents of databases, limiting types of responses provided to database queries, applying differential privacy techniques or homomorphic encryption, and notifying personnel when atypical database queries or accesses occur. Data mining protection focuses on protecting information from data mining while such information resides in organizational data stores. In contrast, AU-13 focuses on monitoring for organizational information that may have been mined or otherwise obtained from data stores and is available as open-source information residing on external sites, such as social networking or social media websites.

EO 13587 requires the establishment of an insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of sensitive information from exploitation, compromise, or other unauthorized disclosure. Data mining protection requires organizations to identify appropriate techniques to prevent and detect unnecessary or unauthorized data mining. Data mining can be used by an insider to collect organizational information for the purpose of exfiltration.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-23 Data Mining Protection Protects T1025 Data from Removable Media
AC-23 Data Mining Protection Protects T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
AC-23 Data Mining Protection Protects T1052 Exfiltration Over Physical Medium
AC-23 Data Mining Protection Protects T1052.001 Exfiltration over USB
AC-23 Data Mining Protection Protects T1213 Data from Information Repositories
AC-23 Data Mining Protection Protects T1213.001 Confluence
AC-23 Data Mining Protection Protects T1213.002 Sharepoint
AC-23 Data Mining Protection Protects T1552.007 Container API
AC-23 Data Mining Protection Protects T1041 Exfiltration Over C2 Channel
AC-23 Data Mining Protection Protects T1567 Exfiltration Over Web Service
AC-23 Data Mining Protection Protects T1048 Exfiltration Over Alternative Protocol
AC-23 Data Mining Protection Protects T1005 Data from Local System
AC-23 Data Mining Protection Protects T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol