Synthetic and uptime checks run with an identity, network placement, and stored credentials that allow them to reach endpoints not otherwise exposed. If the check definition or its script can be modified, the check becomes a trusted path through which arbitrary requests are issued against internal systems and their responses are recorded. This impacts the confidentiality and integrity of the internal systems reached.
Monitoring Probes are Used to Reach Internal Systems
CCC.Monitor.TH04
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CP06 | Synthetic Monitoring | The service may be configured to run scripted sample user interactions against an application on a schedule from provider-operated locations, in order to identify issues before real users are impacted. |
| CCC.Monitor.CP07 | Uptime Monitoring | The service may be configured to probe an endpoint from external provider-operated locations on a schedule and record whether it is reachable and responding. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN03 | Restrict Monitoring Probe Reach | Ensure that synthetic and uptime checks that reach non-public endpoints cannot be used as a path into other internal systems. |