Getting onto the network should not mean getting into every share, wiki and web service on it. D3-NRAM Network Resource Access Mediation is the MITRE D3FEND countermeasure for the second decision: D3FEND defines it as "Control of access to organizational systems and services by users or processes over a network", gives it the synonym Remote Access Control, and places it in the Isolate tactic under Access Mediation (D3-AMED). Its examples are internal databases, file servers and application services. This card explains what D3-NRAM isolates, which ATT&CK techniques D3FEND relates to it and why, where it is implemented, how to verify it and where it stops helping. It is written for platform, identity and detection engineers. For the whole Access Mediation family see the MITRE D3FEND Access Mediation Implementation Guide.
Key takeaways
- D3-NRAM is the per-resource gate. Network Access Mediation (D3-NAM) decides who joins the network; D3-NRAM decides who may read, write or call a specific share, repository or service once there.
- D3FEND's direct mapping is three write techniques. T1074.002 Remote Data Staging, T1080 Taint Shared Content and T1491.002 External Defacement all modify a Network Resource, the artefact D3-NRAM isolates.
- The wider list on the D3FEND site is inherited. Its children (file share, web session and web server mediation) bring in dozens of inferred techniques through File and process artefacts; treat these as relevance, not proof of coverage.
- Write access is the high-value control. Most of the mapped techniques need write permission on a shared location; removing broad write grants does more than tightening reads.
- Machine identities hold many of the grants. Build agents, sync jobs and service accounts with write access to shares and buckets are what attackers reuse; mediate them like people.
D3-NRAM at a glance
| Field | D3-NRAM Network Resource Access Mediation |
|---|---|
| D3FEND ID | D3-NRAM |
| Tactic | Isolate |
| Parent technique | Access Mediation (D3-AMED) |
| Child techniques | Remote File Access Mediation (D3-RFAM, synonym File Share Access Mediation), Web Session Access Mediation (D3-WSAM); under D3-WSAM, Endpoint-based Web Server Access Mediation (D3-EBWSAM) and Proxy-based Web Server Access Mediation (D3-PBWSAM) |
| Digital artefact | Network Resource, also called Shared Resource (D3FEND: the technique "isolates" a Network Resource) |
| Synonym | Remote Access Control |
| D3FEND reference | NIST SP 800-53 Rev. 5 |
| Typical enforcement points | File share and NAS permissions, cloud storage policies, collaboration and wiki permissions, identity-aware proxies, API gateways, service mesh authorisation |
| Main limitation | Acts on authorised identities: a stolen token or service account with a valid grant passes |
What D3-NRAM isolates
D3FEND models a Network Resource as a computer resource made available from one host to others over a network, accessed as if it were local, usually via a local network or intranet. Its sub-artefacts include network file shares, network directories and files, web files and web resources, web API resources and media streaming resources. D3-NRAM sits in front of these and grants or denies each request through authentication and authorisation.
The two children, and the two techniques under D3-WSAM, map to familiar enforcement layers:
- Remote File Access Mediation (D3-RFAM): managing access to file systems over a network so only authorised users or processes interact with remote files, such as SMB and NFS share and file permissions and cloud object storage policies. See the Unstructured Data and File Share Security Guide.
- Web Session Access Mediation (D3-WSAM): authentication, integrity validation and adaptive checks on web application sessions.
- Endpoint-based and Proxy-based Web Server Access Mediation (D3-EBWSAM, D3-PBWSAM), children of D3-WSAM: checking web access at the client (certificates, device compliance) or at an intermediary proxy. See the Identity-Aware Proxy Guide.
ATT&CK techniques D3FEND relates to D3-NRAM
Relationship type: inferred only. D3FEND does not hand-map D3-NRAM to ATT&CK. It derives links from shared digital artefacts and labels them inferred and experimental (checked November 2026). Two layers exist:
Direct artefact: Network Resource
| ATT&CK ID | Technique | D3FEND relation | What mediation changes (NHI Mgmt Group assessment) |
|---|---|---|---|
| T1074.002 | Remote Data Staging | Modifies Network Resource | Strong where write is limited: staging needs a writable share or bucket the attacker's identity can reach |
| T1080 | Taint Shared Content | Modifies Network Resource | Strong: write access to shared content is the whole technique; owners-only write removes it for most identities |
| T1491.002 | External Defacement | Modifies Network Resource | Strong where publishing paths accept writes only from the deployment identity |
Sub-artefacts of Network Resource
| ATT&CK ID | Technique | D3FEND relation | What mediation changes (NHI Mgmt Group assessment) |
|---|---|---|---|
| T1039 | Data from Network Shared Drive | Accesses Network File Share Resource | Partial: read grants scoped to need shrink what any one identity can collect |
| T1135 | Network Share Discovery | Enumerates Network File Share Resource | Partial: access-based enumeration hides shares a user cannot open |
| T1070.005 | Network Share Connection Removal | Unmounts Network File Share Resource | Minimal: acts on the attacker's own connections; useful mainly as a log signal |
| T1213.001, T1213.002 | Confluence, Sharepoint (Data from Information Repositories) | Accesses Web File Resource | Partial: space and site permissions limit bulk collection |
The D3FEND site lists many more techniques for D3-NRAM, from process injection to credential dumping, because its children also relate to File and Service Application Process artefacts. Those links describe what happens to the artefacts on the host, not what a network permission check prevents, so this card does not repeat them. D3FEND also still lists some ATT&CK IDs that v20 has revoked; where one appears, use the v20 successor. All IDs above were checked against ATT&CK v20.
See the MITRE ATT&CK T1080 Taint Shared Content, MITRE ATT&CK T1039 Data from Network Shared Drive and T1135 Network Share Discovery Defensive Guide.
Where it is implemented
| Resource type | D3FEND child | What to configure | Decision telemetry |
|---|---|---|---|
| SMB and NFS file shares, NAS | D3-RFAM | Share and file permissions by group, no write for broad groups, access-based enumeration, SMB signing and encryption | File share access and access-denied audit events |
| Cloud object storage | D3-RFAM | Bucket or container policies naming specific principals, public access blocked at account level, no wildcard writers | Storage data-plane and policy-change logs |
| Collaboration sites and wikis | D3-WSAM | Site and space permissions, external sharing limits, conditional access on sessions | Permission change and sharing audit logs |
| Internal web applications | D3-PBWSAM, D3-EBWSAM | Identity-aware proxy in front, client certificate or device compliance for sensitive apps | Proxy allow and deny with subject and URL |
| APIs and service-to-service calls | D3-PBWSAM | API gateway or mesh authorisation per caller identity and method | Per-request authorisation decisions |
| Databases reached over the network | D3-NRAM | Network listener restricted to application tiers, per-identity database roles | Failed logins and permission denials |
Product categories are examples, not recommendations. The SMB Protocol Security and Signing Guide covers the transport side of file shares.
Where identity fits
Write grants on shared resources are frequently held by non-human identities: build systems that publish artefacts, sync jobs, backup agents and deployment pipelines. These are the identities attackers look for, because one compromised token can taint content that many people trust. The Twilio TaskRouter SDK compromise shows the pattern: a storage path serving a JavaScript SDK had a policy granting read and write to every AWS principal, added while troubleshooting a build system and never removed, and someone replaced the file. The control that would have held is plain resource mediation: only the publishing identity may write. Give publishing paths a single scoped writer, put expiry on troubleshooting grants and alert on policy changes that widen access. See the Public S3 Exposure Check and the Least Privilege Techniques Guide.
Implementation steps
- Inventory shared resources and their writers. For each share, bucket, site and API list the identities and groups with write or delete rights, human and non-human, and an owner.
- Remove broad write first. Take write away from groups such as all staff, authenticated users and wildcard principals. This addresses all three direct D3FEND techniques at once.
- Scope reads to need. Turn on access-based enumeration for file shares, review sites with organisation-wide read and restrict sensitive repositories to named groups.
- Front internal web apps with mediation. Put an identity-aware proxy or gateway in front of applications that rely on network location alone.
- Test before enforcing. Use audit logging and report-only policies where the platform supports them, review denials for a business cycle, then apply changes in rings with a documented rollback (restore the previous permission set from export).
- Time-limit exceptions. Give temporary grants an expiry, in line with D3-AMED's scoped-duration expectation. See the JIT Access Guide.
How to verify it works
- Write test per shared location: with a standard test identity, try to create a file in each high-value share, bucket and publishing path. Expect a denial and an audit record.
- Enumeration test: list shares and sites as a standard user; only those the user can open should appear.
- Machine identity test: confirm each pipeline or service identity can write only to its own path, not to sibling paths.
- Policy drift alert test: widen a test bucket policy or share permission and confirm the change raises an alert.
- Proxy bypass test: try to reach a proxied internal application directly by address; it should not answer outside the proxy.
| Metric (example, not a standard) | What it shows | Direction |
|---|---|---|
| Shared locations writable by broad groups or wildcard principals | Exposure to T1080 and T1074.002 | Zero for high-value locations |
| Share of shared resources with a named owner | Whether anyone can approve or remove grants | Rising to 100% |
| Non-human identities with write on more than one shared path | Blast radius of a stolen pipeline credential | Falling |
| Permission changes that widened access, reviewed within a week | Drift control | All reviewed |
| Internal web apps reachable without the proxy | Mediation bypass paths | Zero |
Limits, bypasses and failure patterns
- Authorised identity, wrong person: D3-NRAM grants what the identity is allowed. A stolen session, token or service account key passes. Pair it with session controls and anomaly detection on access patterns.
- Grants added for troubleshooting: temporary write permissions that are never removed, as in the TaskRouter case.
- Nested and inherited groups: share permissions that look narrow but include a group nesting all users.
- Direct paths around the proxy: an application published through a proxy but still reachable by address or through a forgotten load balancer.
- Read-heavy reviews: access reviews that focus on who can read sensitive data and miss who can write to content that others execute or trust.
- Host-level attacks: once an attacker runs code on the file server or web server itself, network resource mediation is behind them; host controls and file integrity monitoring take over.
Framework mapping
| Framework | Reference | Relationship to D3-NRAM |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 Access Enforcement, AC-6 Least Privilege | Per-resource grant and deny on least privilege |
| NIST SP 800-53 Rev 5 | AC-17 Remote Access | Access to organisational systems and services over a network |
| NIST SP 800-53 Rev 5 | AC-4 Information Flow Enforcement | Proxy and gateway enforcement between subjects and services |
| NIST CSF 2.0 | PR.AA-05 | Access permissions defined, managed, enforced and reviewed with least privilege |
| MITRE ATT&CK | M1035 Limit Access to Resource Over Network, M1022 Restrict File and Directory Permissions | Closest mitigations in intent (NHI Mgmt Group mapping, not D3FEND) |
D3FEND cites SP 800-53 Rev. 5 as its reference for D3-NRAM; the specific control rows are NHI Mgmt Group's mapping by control intent.
Related countermeasures
- Network gate: D3-NAM Network Access Mediation decides who reaches the network in the first place.
- Local enforcement: D3-LFP Local File Permissions applies the same idea to files on the host.
- Detection beside mediation: D3-RAPA Resource Access Pattern Analysis flags unusual access by identities that hold valid grants.
- Deception: a D3-DF Decoy File on a share detects collection that permissions allowed.
Practitioner checklist
- Inventory shares, buckets, sites and APIs with every identity that can write or delete, and assign owners.
- Remove write from broad groups and wildcard principals on every high-value shared location.
- Give each publishing path one scoped writer identity and deny all others.
- Turn on access-based enumeration and restrict organisation-wide read on sensitive repositories.
- Put identity-aware mediation in front of internal web apps and close direct paths.
- Put expiry on temporary grants and alert on policy changes that widen access.
- Test denials per location with standard and machine test identities each quarter.
- Report D3FEND's direct mapping (T1074.002, T1080, T1491.002) separately from the inherited list.
Standards and references
- MITRE D3FEND: Network Resource Access Mediation (D3-NRAM)
- MITRE D3FEND: Access Mediation (D3-AMED)
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls (D3FEND reference)
- NIST: SP 800-207 Zero Trust Architecture
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: T1080 Taint Shared Content
- MITRE ATT&CK: T1074.002 Remote Data Staging
Related NHI Mgmt Group resources: MITRE D3FEND Access Mediation Implementation Guide · Unstructured Data and File Share Security Guide · Identity-Aware Proxy Guide · MITRE D3FEND Guide