Skip to main content

CCC.Core.TH06: Data is Lost or Corrupted

Threat ID:CCC.Core.TH06
Title:Data is Lost or Corrupted
Description:

Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of.

External Mappings

Reference IDEntry IDStrengthRemarks
MITRE-ATT&CK
T1485
0
Data Destruction
MITRE-ATT&CK
T1565
0
Data Manipulation
MITRE-ATT&CK
T1491
0
Defacement
MITRE-ATT&CK
T1490
0
Inhibit System Recovery

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.AuditLog.C01Implement Digital Signatures With Hash ChainingDigital signatures allows for external verification of log data tampering and hash chaining allows for deleted log files to be detected. Integrity
2
2
2
CCC.AuditLog.C02Enable And Validate All Audit Log TypesReview audit log configuration and ensure that all audit log types are being generated and replicated to configured sinks Integrity
1
4
1
CCC.AuditLog.C06Enforce Retention Policy on Audit Log BucketConfigure a custom retention policy on the designated audit log bucket to ensure that logs are retained for the correct number of days as defined by your organization's policy. Availability
2
3
1
CCC.AuditLog.C07Enforce MFA Delete on Audit Log BucketEnable Multi-Factor Authentication (MFA) delete on the audit log bucket to provide greater protection against accidental or malicious deletion of audit data. Availability
2
3
1
CCC.Core.C08Replicate Data to Multiple LocationsEnsure that data is replicated across multiple physical locations to protect against data loss due to hardware failures, natural disasters, or other catastrophic events. Data
1
6
2