Ensure that private connections, VPNs, and transit hubs only carry explicitly allowed traffic, so that a compromise on one side cannot propagate to the other.
Restrict Traffic Over Hybrid Connections
CCC.VPC.CN10 · Networking
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP10 | Connectivity Options - Private Connection | The service can be configured with a dedicated, private, high-speed connection between on-premises networks and the virtual network that does not traverse the public internet. |
| CCC.VPC.CP12 | Connectivity Options - Transit Hub | The service can connect multiple virtual networks and on-premises networks through a central transit hub in a hub-and-spoke model. |
| CCC.VPC.CP13 | Connectivity Options - Site-to-site VPN | The service can establish an encrypted site-to-site VPN connection over the public internet between the virtual network and an on-premises network. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.VPC.TH09 | Compromise Propagates Over Hybrid Connections | Private connections, site-to-site VPNs, and transit hubs may be configured with routes and network rules that permit broad access between on-premises networks and the virtual network. A compromise of either side can be used to move laterally into the other, impacting the confidentiality, integrity, and availability of resources on both sides of the connection. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.VPC.CN10.AR01 | When traffic arrives over a private connection, site-to-site VPN, or transit hub, the service MUST deny it unless a network access rule explicitly allows the source range and destination port. | tlp-green, tlp-amber, tlp-red |