Skip to main content

CCC.Core.TH09: Runtime Logs are Read by Unauthorized Entities

Threat ID:CCC.Core.TH09
Title:Runtime Logs are Read by Unauthorized Entities
Description:

Unauthorized access to logs may expose valuable information about the system's configuration, operations, and security mechanisms. This could jeopardize system availability through the exposure of vulnerabilities and support the planning of attacks on the service, system, or network. If logs are not adequately sanitized, this may also directly impact the confidentiality of sensitive data.

Related Capabilities

IDTitleDescription
CCC.Core.F03Access Log PublicationThe service automatically publishes structured, verbose records of activities performed within the scope of the service by external actors.
CCC.Core.F09Metrics PublicationThe service automatically publishes structured, numeric, time-series data points related to the performance, availability, and health of the service or its child resources.

External Mappings

Reference IDEntry IDStrengthRemarks
MITRE-ATT&CK
T1003
0
Credential Dumping
MITRE-ATT&CK
T1007
0
System Service Discovery
MITRE-ATT&CK
T1018
0
Remote System Discovery
MITRE-ATT&CK
T1033
0
System Owner/User Discovery
MITRE-ATT&CK
T1046
0
Network Service Discovery
MITRE-ATT&CK
T1057
0
Process Discovery
MITRE-ATT&CK
T1069
0
Permission Groups Discovery
MITRE-ATT&CK
T1070
0
Indicator Removal
MITRE-ATT&CK
T1082
0
System Information Discovery
MITRE-ATT&CK
T1120
0
Peripheral Device Discovery
MITRE-ATT&CK
T1124
0
System Time Discovery
MITRE-ATT&CK
T1497
0
Virtualization/Sandbox Evasion
MITRE-ATT&CK
T1518
0
Software Discovery

Controls

IDTitleObjectiveControl FamilyThreat MappingsGuideline MappingsAssessment Requirements
CCC.AuditLog.C04Ensure Access Logging Is Enabled on the Audit Log BucketEnsure that access logging is enabled for the audit log storage bucket to capture all requests made to the bucket, providing an audit trail of data access. Integrity
2
3
1
CCC.Core.C09Ensure Integrity of Access LogsEnsure that access logs are always recorded to an external location that cannot be manipulated from the context of the service(s) it contains logs for. Data
3
5
3