Control Strategy DataBaseAccessControl

URI: CSG-DataBaseAccessControl

Description: The data service Service enforces an access control policy for a stored copy of Data.

(empty)

DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.C.CDBSC-DST.4

Malicious query from Client via database Service leaks data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to retrieve data Data. In this scenario, a selection query for Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

(empty)

AccessControl at Role_Service

AccessPolicy at Role_Data

Control Strategy DataBaseAccessControl

Mitigated Threats (0)

Blocked Threats (3)

DS.A.CDBSC-DSF.4

DS.Auth.CDBSC-DSF.4

DS.C.CDBSC-DST.4

Triggers Threats (0)

Control Sets (2)