Common Mitigation Enumeration
A taxonomy of defensive security controls mapped to CWE weaknesses and CVSS vector attenuation. Each CME entry describes a verifiable control that modifies CVSS environmental scoring, either deterministically (guaranteed) or probabilistically (evidence-based).
Harden
Harden
93 entries
Application Controls
- CME-904 WAF (Web Application Firewall) Application
- CME-905 Content Security Policy (CSP) Headers Application
- CME-906 Rate Limiting / Connection Throttling Application
- CME-907 Application-Layer RBAC Enforcement Application
- CME-908 Object-Level Authorization Checks (IDOR Prevention) Application
- CME-909 Default-Deny API Authorization Policy Application
- CME-912 HTTP Header Normalization and Request Smuggling Prevention Application
- CME-913 CSRF Protection (Anti-CSRF Token & SameSite Cookie Enforcement) Application
- CME-914 Strict CORS Origin Allowlist Enforcement Application
- CME-915 Cross-Origin Request Restriction (Reverse Proxy Origin Enforcement) Application
- CME-916 SameSite Cookie Attribute Enforcement Application
- CME-917 Worker Process Recycling (MaxConnectionsPerChild / max_requests) Application
- CME-918 URL Path Authorization Enforcement (Forced Browsing Prevention) Application
- CME-919 JIT Compiler Hardening (JIT Restriction / V8 Sandbox) Application
- CME-920 Database Least-Privilege Access Control Application
- CME-921 URL Request Path Canonicalization Before Authorization Application
- CME-923 Mass-Assignment Prevention Through Explicit Request Schemas Application
- CME-924 Arbitrary Code Guard (ACG)
- CME-925 Windows Defender Application Control (WDAC)
Application Input Validation
- CME-1301 Path Traversal Prevention (Canonicalization) Application
- CME-1302 Deserialization Allowlist (Safe Loading) Application
- CME-1304 SSRF Prevention (Outbound Request Allowlist) Application
- CME-1305 SQL Injection Prevention (Parameterized Queries) Application
- CME-1306 XSS Prevention (Context-Aware Output Encoding) Application
- CME-1307 Command Injection Prevention (No Shell Invocation) Application
- CME-1308 Origin and CORS Validation Enforcement Application
- CME-1309 Script Engine Restriction (Sandbox / Disable) Application
- CME-1310 File Upload Validation (Content Inspection and Extension Allowlist) Application
- CME-1311 Input Size and Quantity Bounds Enforcement Application
- CME-1312 Argument Injection Prevention (Downstream Input Delimiter Sanitization) Application
- CME-1313 CRLF / Line Injection Prevention (Newline Sanitization for Structured Formats) Application
- CME-1314 Input Canonicalization Before Security Decision Application
- CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) Application
- CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) Application
- CME-1317 XML External Entity Prevention (Secure XML Parser Configuration) Application
- CME-1318 LDAP Injection Prevention
- CME-1319 Deserialization Type Allowlisting
Container Isolation
Credential Hardening
- CME-801 Multi-Factor Authentication (MFA) Identity
- CME-802 Password Quality Enforcement (pwquality) Identity
- CME-803 Account Lockout Policy (pam_faillock) Identity
- CME-804 SSH Key-Only Authentication Identity
- CME-805 Credential Rotation Policy Identity
- CME-806 Kerberos Authentication (GSSAPI) Identity
- CME-807 Session Lifetime and Idle Timeout Enforcement Identity
- CME-808 Local Administrator Password Solution (LAPS)
Cryptographic Controls
- CME-401 System-wide Crypto Policy (FUTURE) Application
- CME-402 FIPS 140-3 Mode OS/Kernel
- CME-403 TLS 1.3 Enforcement Network
- CME-404 Certificate Pinning Application
- CME-405 DNSSEC Validation Network
- CME-406 Signed Package Enforcement (GPG) OS/Kernel
- CME-407 Data-at-Rest Encryption (LUKS/dm-crypt / BitLocker) Data
- CME-408 System-wide TLS/Crypto Policy Enforcement OS/Kernel
Filesystem Hardening
- CME-502 noexec on /tmp and /dev/shm OS/Kernel
- CME-503 nosuid on Non-Root Partitions OS/Kernel
- CME-504 dm-verity (Verified Boot) OS/Kernel
- CME-505 IMA/EVM (Integrity Measurement Architecture) OS/Kernel
- CME-507 Secure Dynamic Linker Configuration (LD_PRELOAD/PATH Hardening) OS/Kernel
- CME-508 Quoted Service Path Enforcement (Windows) OS/Kernel
Kernel Hardening
- CME-101 ASLR (Address Space Layout Randomization) OS/Kernel
- CME-102 NX/XD Bit (Non-Executable Memory) OS/Kernel
- CME-103 Stack Canaries (Stack Protector) OS/Kernel
- CME-104 KASLR (Kernel Address Space Layout Randomization) OS/Kernel
- CME-105 SMEP (Supervisor Mode Execution Prevention) OS/Kernel
- CME-106 SMAP (Supervisor Mode Access Prevention) OS/Kernel
- CME-107 Kernel Module Loading Restriction OS/Kernel
- CME-108 kptr_restrict (Kernel Pointer Restriction) OS/Kernel
- CME-109 Kernel Lockdown Mode OS/Kernel
- CME-110 KEXEC Restriction OS/Kernel
- CME-111 Secure Boot (UEFI) OS/Kernel
- CME-112 RELRO and PIE (Full) OS/Kernel
- CME-113 Control Flow Integrity (CFI / Shadow Call Stack) OS/Kernel
- CME-114 Process Resource Limits (ulimit/prlimit) OS/Kernel
- CME-116 FORTIFY_SOURCE (Buffer Overflow Detection) OS/Kernel
- CME-117 Heap Allocator Hardening (glibc Safe-Linking and Metadata Protection) OS/Kernel
- CME-118 Protected File Links (Kernel Symlink/Hardlink Protection) OS/Kernel
- CME-119 Compiler Integer Overflow and Conversion Safety (-ftrapv / UBSan Integer) OS/Kernel
Mandatory Access Control
- CME-301 SELinux (Enforcing Mode) OS/Kernel
- CME-302 SELinux Confined User Mapping OS/Kernel
- CME-303 SELinux Booleans (Restrictive) OS/Kernel
- CME-304 AppArmor (Enforcing Profile) OS/Kernel
- CME-305 macOS System Integrity Protection (SIP)
Network Isolation
- CME-207 DNS Rebinding Protection Network
Protocol Hardening
- CME-901 SSH Hardening (Comprehensive) Network
- CME-902 Disable Unused Network Services Network
- CME-903 Kernel Network Hardening (sysctl) Network
Syscall & BPF Controls
- CME-601 Kernel-Level Syscall Filtering (seccomp) OS/Kernel
- CME-602 seccomp-bpf Profile (Container Default) OS/Kernel
- CME-603 Unprivileged BPF Disabled OS/Kernel
- CME-604 Unprivileged User Namespaces Disabled OS/Kernel
Isolate
Isolate
23 entries
Application Controls
- CME-910 Role Separation / Duty Segregation Application
- CME-911 Fine-Grained Administrative Permission Scoping Application
Application Input Validation
Container Isolation
- CME-701 Sandboxing / gVisor Runtime Application
- CME-702 Linux Namespaces (User, PID, Network, Mount) OS/Kernel
- CME-703 Rootless Containers OS/Kernel
- CME-704 cgroups v2 Resource Limits OS/Kernel
- CME-705 Dropped Linux Capabilities OS/Kernel
- CME-706 Pod Security Standards (Restricted) Application
Filesystem Hardening
- CME-501 Read-Only Root Filesystem OS/Kernel
- CME-506 Landlock LSM (Filesystem Sandboxing) OS/Kernel
Network Isolation
- CME-201 Zero Trust Gateway / Identity-Aware Proxy Network
- CME-202 Host-Based Firewall (firewalld/nftables) Network
- CME-203 Network Segmentation (VLANs/Subnets) Network
- CME-204 IPsec / WireGuard (Encrypted Transport) Network
- CME-205 Service Binding to Localhost Network
- CME-206 Network Policy (Kubernetes) Network
- CME-208 Outbound Network Egress Restriction (SSRF Blast Radius Containment) Network
- CME-209 Kubernetes NetworkPolicy Enforcement
Privilege Isolation
- CME-707 NoNewPrivileges OS/Kernel
- CME-708 Least Privilege sudo Configuration OS/Kernel
- CME-709 systemd Service Sandboxing (PrivateDevices, PrivateTmp, ProtectSystem) OS/Kernel
- CME-710 DynamicUser (systemd) OS/Kernel
Detect
Detect
13 entries
Integrity Detection
Runtime Detection
- CME-1001 EDR Agent (Endpoint Detection & Response) Application
- CME-1002 Audit Subsystem (auditd) OS/Kernel
- CME-1003 Falco / eBPF Runtime Security OS/Kernel
- CME-1005 Runtime Memory Error Detection (KASAN/HWASan) OS/Kernel
- CME-1006 Privilege Change Audit Logging Application
- CME-1008 Application Admin Event Logging (SIEM Integration) Application
- CME-1009 Privilege Assignment Monitoring (Role Grant Alerting) Application
- CME-1011 Kubernetes API Server Audit Policy Application
- CME-1012 USBGuard — USB Device Access Control
Evict
Evict
3 entries
Patch Management
- CME-1101 Automated Patch Management (dnf-automatic) OS/Kernel
- CME-1102 Live Kernel Patching (kpatch/livepatch) OS/Kernel
- CME-1103 Automated Container Image Rebuilds Application
Restore
Restore
4 entries
Recovery Controls