Route tables may be modified to send traffic through an unauthorized network appliance, or to add an internet or NAT gateway route to a subnet that was designed to be private. Traffic is then observed or altered in transit, or resources gain an unintended path to the public internet, impacting the confidentiality and integrity of data and enabling exfiltration.
Routes are Modified to Redirect or Expose Traffic
CCC.VPC.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP05 | Private Subnet Creation | The service can create a subnet whose resources cannot directly reach the public internet, so that workloads are reachable only through private connectivity or an outbound gateway. |
| CCC.VPC.CP07 | Routing Control | The service can control traffic within the virtual network and between the network and the internet or on-premises networks using customizable route tables. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CN07 | Alert on Changes That Redirect or Expose Traffic | Ensure that a route change exposing a private subnet or a change to the DNS servers used by resources is published to a monitored channel, so that traffic cannot be redirected or exposed unobserved. |