Control Strategy ClientOneTimeKeyAuthentication

URI: CSG-ClientOneTimeKeyAuthentication

Package: Network

< prev | next >

Description: Access to service Service is controlled, by authenticating authorised users using a one time key created using a client-side authentication device provided to them.

        (empty)

CSG-ClientOneTimeKeyAuthentication
CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.HuDFTCS.3

Unauthentic flow of data Data from FlowsFrom directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client via FlowsFrom (e.g. via phishing), can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.HuDSTCS.3

Unauthentic stored input Data directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client by tampering with stored input Data, can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.HuiHCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when the client is running on host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.HuiHrCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when accessing the client via remote access from host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CSG-ClientOneTimeKeyAuthentication
CC.AuC.HumCCC-nS.3

Credential stuffing to find password used by Human to access Service from Client: this threat applies where a human user of client Client uses a weak password which can guessed or found by brute force attack and used by an attacker to access Service as the client.