Dashboards, uptime results, and service level objective status may be shared beyond the intended audience through overly broad sharing settings or public links. Degraded or failing components are then visible to unauthorized viewers, who can target systems that are already in a weakened state or time activity to coincide with existing incidents. This impacts the confidentiality of operational information and the availability of the affected systems.
System Health is Exposed to Unauthorized Viewers
CCC.Monitor.TH02
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CP05 | Service Level Objective Monitoring | The service may be configured to evaluate user-defined service level objectives against service level indicators derived from collected metrics, and to report the remaining error budget. |
| CCC.Monitor.CP07 | Uptime Monitoring | The service may be configured to probe an endpoint from external provider-operated locations on a schedule and record whether it is reachable and responding. |
| CCC.Monitor.CP09 | Dashboards | The service can present metrics, alerts, service level objectives, and uptime results in user-defined visual dashboards that may be shared with other users. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.Monitor.CN04 | Restrict Access to Dashboards and Health Status | Ensure that dashboards, uptime results, and service level objective status are visible only to authorized users. |