Skip to main content

CCC.Core.TH10: State-change Events are Read by Unauthorized Entities

Threat ID:CCC.Core.TH10
Title:State-change Events are Read by Unauthorized Entities
Description:

Unauthorized access to state-change events can reveal information about the system's design and usage patterns. This opens the system up to attacks of opportunity and support the planning of attacks on the service, system, or network.

Related Capabilities

IDTitleDescription
CCC.Core.F03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.
CCC.Core.F07Event PublicationThe service automatically publishes a structured state-change record upon creation, deletion, or modification of data, configuration, components, or child resources.
CCC.Core.F09Metrics PublicationThe service automatically publishes structured, numeric, time-series data points related to the performance, availability, and health of the service or its child resources.
CCC.Core.F17AlertingThe service may be configured to emit a notification based on a user-defined condition related to the data published by a child or networked resource.

External Mappings

Reference IDEntry IDStrengthRemarks
MITRE-ATT&CK
T1057
0
Process Discovery
MITRE-ATT&CK
T1049
0
System Network Connections Discovery
MITRE-ATT&CK
T1083
0
File and Directory Discovery

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.Monitor.C05Restrict access to silence or acknowledge an alertEnsure only a subset of users can silence or acknowledge alerts to prevent attackers hiding their activity. Identity and Access Management
1
3
1