Ensure that health-check results cannot be influenced by entities other than the load balancer, so that healthy targets are not removed from service.
Protect Health-Check Endpoints
CCC.LB.CN10 · Networking
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP12 | Target Health Checks | The service automatically performs continuous health checks on backend targets by checking the response to an HTTP request, a TCP connection, or another application-specific parameter. |
| CCC.LB.CP13 | Health Checks-based Target Removal | The service automatically removes a backend target from its list of available targets when a health check detects that the target is unhealthy, so that traffic is no longer routed to that target. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH05 | Health Checks Are Exploited to Take Services Offline | Manipulating health-check endpoints or responses can cause healthy targets to be marked unavailable, leading to denial of service. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.LB.CN10.AR01 | When a backend target exposes a health-check endpoint, network access to that endpoint MUST be restricted to the load balancer's health-check source address ranges. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.LB.CN10.AR02 | When more than 10 percent of the targets behind a listener change from healthy to unhealthy within five minutes, the service MUST publish an alert to a monitored channel. | tlp-green, tlp-amber, tlp-red |