Networking / VPC / Controls / DEV
Restrict Traffic Mirroring Targets
CCC.VPC.CN12 · Observability
Ensure that mirrored packet copies are only delivered to authorized monitoring destinations and that every mirroring session is visible.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP18 | Traffic Mirroring | The service can be configured to copy network traffic from selected network interfaces to a monitoring destination for out-of-band inspection. Azure offers this only in preview. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH13 | Mirrored Traffic is Delivered to Unauthorized Destinations | A traffic mirroring session may be created or its target modified so that full packet copies of network traffic are delivered to a resource that is not an authorized monitoring destination. Plaintext payloads and credentials within the mirrored traffic are exposed, impacting the confidentiality of data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN12.AR01 | When a traffic mirroring session is created or modified, the service MUST reject targets outside the organization's trust perimeter. | tlp-green, tlp-amber, tlp-red |
| CCC.VPC.CN12.AR02 | When a traffic mirroring session is created or modified, the service MUST publish an event to a monitored channel which includes the client identity, time, and target of the session. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | SC-7 | |
| NIST_800_53 | AU-12 | |