Private connections, site-to-site VPNs, and transit hubs may be configured with routes and network rules that permit broad access between on-premises networks and the virtual network. A compromise of either side can be used to move laterally into the other, impacting the confidentiality, integrity, and availability of resources on both sides of the connection.
Compromise Propagates Over Hybrid Connections
CCC.VPC.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP10 | Connectivity Options - Private Connection | The service can be configured with a dedicated, private, high-speed connection between on-premises networks and the virtual network that does not traverse the public internet. |
| CCC.VPC.CP12 | Connectivity Options - Transit Hub | The service can connect multiple virtual networks and on-premises networks through a central transit hub in a hub-and-spoke model. |
| CCC.VPC.CP13 | Connectivity Options - Site-to-site VPN | The service can establish an encrypted site-to-site VPN connection over the public internet between the virtual network and an on-premises network. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CN10 | Restrict Traffic Over Hybrid Connections | Ensure that private connections, VPNs, and transit hubs only carry explicitly allowed traffic, so that a compromise on one side cannot propagate to the other. |