Control Strategy DataFlowSharedKeyOutbound

URI: CSG-DataFlowSharedKeyOutbound

Package: DataLifecycle

< prev | next >

Description: The data Data flowing between processesFlowsTo and FlowsTo is encrypted end-to-end (i.e. not relying on transport level encryption), and FlowsFrom has the key needed to encrypt the data for transmission.

Triggers Threats (3)

DF.Auth.ACDF-VFS-i.3.6

Encrypted flow of data Data to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can access its cryptographic key and alter data Data flowing between Service and FlowsTo.

DF.Auth.AC-iDF-VFC.2.6

Client Client on stolen host CHost injects fake content into the encrypted flow of Data via Service: if an attacker has possession of host CHost and can access client Client, they can access its cryptographic key and inject malicious content into the flow of Data from Client to FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.