Networking / VPC / Controls / v2026.11
Alert on Changes That Redirect or Expose Traffic
CCC.VPC.CN07 · Observability
Ensure that a route change exposing a private subnet or a change to the DNS servers used by resources is published to a monitored channel, so that traffic cannot be redirected or exposed unobserved.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.VPC.CP05 | Private Subnet Creation | The service can create a subnet whose resources cannot directly reach the public internet, so that workloads are reachable only through private connectivity or an outbound gateway. |
| CCC.VPC.CP07 | Routing Control | The service can control traffic within the virtual network and between the network and the internet or on-premises networks using customizable route tables. |
| CCC.VPC.CP14 | Built-in DNS Resolution | The service automatically resolves hostnames to IP addresses for resources within the virtual network, allowing resources to communicate using hostnames instead of IP addresses. |
| CCC.VPC.CP15 | Built-in DHCP Assignment | The service automatically assigns IP addresses, subnet masks, default gateways, and other network configuration to resources within the virtual network. |
Related Threats
| ID | Title | Description |
|---|
| CCC.VPC.TH07 | Routes are Modified to Redirect or Expose Traffic | Route tables may be modified to send traffic through an unauthorized network appliance, or to add an internet or NAT gateway route to a subnet that was designed to be private. Traffic is then observed or altered in transit, or resources gain an unintended path to the public internet, impacting the confidentiality and integrity of data and enabling exfiltration. |
| CCC.VPC.TH11 | DNS Resolution is Hijacked to Redirect Traffic | Private DNS zones, resolver forwarding rules, or the DNS servers handed out through DHCP may be created or modified so that names resolve to addresses controlled by an unauthorized entity. Resources connect to the wrong destination and credentials or data are exposed to that destination, impacting the confidentiality and integrity of data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.VPC.CN07.AR01 | When a route whose next hop is an internet or NAT gateway is added to a route table associated with a private subnet, the service MUST publish an event to a monitored channel. | tlp-amber, tlp-red |
| CCC.VPC.CN07.AR02 | When the DNS servers of the built-in resolver or the DNS servers assigned through DHCP are changed, the service MUST publish an event to a monitored channel. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST_800_53 | CM-5 | |
| NIST_800_53 | SC-20 | |