SC-35 External Malicious Code Identification asks you to include system components that proactively seek out network based malicious code or malicious websites. The guidance separates it from decoys in SC-26. Decoys wait for attackers. These components go out and probe.
NIST SP 800-53 binds US federal systems, and reaches contractors and cloud providers through contract terms such as FedRAMP. For everyone else it is a reference catalog. It is a specialist control and most smaller teams meet it through a managed service.
What it means in practice
Examples include crawlers that visit suspicious sites in a sandbox, or services that watch for lookalike domains and malicious packages. The guidance warns that you need isolation so any malicious code found cannot infect your own systems. Virtualization is a common way to do that.
The Gold directory and the free dependency scan at https://gold.safeguard.sh/scan address a related, narrower problem on the code side, which is checking packages you pull in against known vulnerable and compromised versions. That is not the same as this control, which is about network based malicious code and websites, but the two sit well together in a monitoring story.
As with decoys, check with legal counsel before you probe external sites at scale. The guidance for SC-26 mentions this concern for decoys, and the same caution is sensible here.
Evidence to collect
- A description of the tool or service doing the seeking.
- Isolation design, such as the sandbox or virtual machine settings.
- Sample output or alerts from the last quarter.
- The process for acting on a finding.
Common gaps
Findings go to an inbox nobody reads. Or the tool runs inside the production network without isolation.
How to implement it
Use a vendor feed or sandbox service if you do not want to build one. Route findings into your ticket system and set an owner and a response time.
Quick check
How is SC-35 different from SC-26?
SC-26 uses decoys that attackers come to. SC-35 uses components that go looking for malicious code and sites.
