Control Strategy ClientUserPasswordAccess

URI: CSG-ClientUserPasswordAccess-Optional

Package: Network

< prev | next >

Description: Users in the role Human choose a password which is registered with the system allowing access to Service.

Blocked Threats (1)

CC.AX.CCC-nS.6.1.1

Client Client unable to authenticate via password with Service: the service Service requires that clients authenticate using a password, but this is not available to client Client.

Triggers Threats (2)

CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.

CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.