Restrict Web-Based Content
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.
Techniques Addressed by Mitigation
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| ICS | T1701 | .004 | Command and Scripting Interpreter: Visual Basic |
Limit retrieval and execution of untrusted web or document-based active content on ICS workstations and jump hosts, especially where those systems can reach control assets. |
| .006 | Command and Scripting Interpreter: JavaScript |
Restrict untrusted web content and active scripting on ICS workstations, jump hosts, and other overlap assets, especially where browser access is not required for operations. |
||
| ICS | T0817 | Drive-by Compromise |
Restrict browsers to limit the capabilities of malicious ads and Javascript. |
|
| ICS | T0865 | Spearphishing Attachment |
Consider restricting access to email within critical process environments. Additionally, downloads and attachments may be disabled if email is still necessary. |
|
| ICS | T0863 | User Execution |
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files. |
|