Control Strategy ClientOutOfBandKeyAuthentication

URI: CSG-ClientOutOfBandKeyAuthentication

Package: Network

< prev | next >

Description: Access to service Service is controlled, by authenticating authorised users using a password and a separate key sent to them via a separate (out of band) means.

        (empty)

CSG-ClientOutOfBandKeyAuthentication
CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.HuDFTCS.3

Unauthentic flow of data Data from FlowsFrom directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client via FlowsFrom (e.g. via phishing), can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.HuDSTCS.3

Unauthentic stored input Data directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client by tampering with stored input Data, can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.HuiHCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when the client is running on host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.HuiHrCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when accessing the client via remote access from host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CSG-ClientOutOfBandKeyAuthentication
CC.AuC.HumCCC-nS.3

Credential stuffing to find password used by Human to access Service from Client: this threat applies where a human user of client Client uses a weak password which can guessed or found by brute force attack and used by an attacker to access Service as the client.