Control Strategy DataStorageEncryption

URI: CSG-DataStorageEncryption

Package: DataLifecycle

< prev | next >

Description: The copy of Data stored on Host is encrypted.

        (empty)

CSG-DataStorageEncryption
DF.A.HPDSDADF-V.6

Service Process cannot send unencrypted data Data to FlowsTo: because the stored copy of Data on Host is not encrypted, and FlowsTo expects an encrypted version, it is not possible for Process to send it without a key.
CSG-DataStorageEncryption
DS.A.HPmDF-kDAcDS.6

Encrypted data Data cannot be stored on Host by Process: service Process manages storage of an unencrypted copy of data Data, so if all flows of Data to Process are encrypted the stored copy cannot be created unless Process has a decryption key.
CSG-DataStorageEncryption
DS.A.HPsACDOdDS-V.6

Process Process cannot create decrypted output data Data: if the local copy of Data is sypposed to be decrypted, then process Process creating the data in the encrypted domain will be unable to store the output.
CSG-DataStorageEncryption
DS.C.HPsACr-pDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and serve the locally stored copy of Data.
CSG-DataStorageEncryption
DS.C.HsACDS-V.1.2

Use of admin privileges at Host to access stored data Data: anyone with admin rights at Host can read (unencrypted) copies of Data stored on the Host.
CSG-DataStorageEncryption
DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.
CSG-DataStorageEncryption
DS.T.HPDF-VDAuDS.6

Unencrypted data Data stored on Host cannot be updated by Process with encrypted input from FlowsFrom: process Process manages an unencrypted stored copy of data Data on Host, so if the flows of updates from FlowsFrom is encrypted, then Process cannot update this copy of Data without a key, so this copy will become out of date.
CSG-DataStorageEncryption
DS.Y.HDS-V.8

Stored copy of Data on Host is unencrypted: which means this copy is not available for encrypted access.
CSG-DataStorageEncryption
DS.C.HDS-V.2.1

Physical access to data Data on stolen host Host: an attacker in possession of device PhysicalHost can physically transfer its storage media to another device to access data stored there.
CSG-DataStorageEncryption
DS.C.HDS-V.2.2

Use of admin rights on stolen device Host to access stored data Data: if an attacker gains access to stolen device Host, they can read (unencrypted) copies of Data stored on the Host.
CSG-DataStorageEncryption
DS.C.HPsACr-pDS-V.2

Use of Process to access Data stored on stolen device Host: if an attacker can access Process on stolen device Host, they can exploit the rights of Process to read and serve the locally stored copy of Data.
CSG-DataStorageEncryption
DS.Auth.HDS-V.4

Attacker exploit at Host alters stored copy of Data: the attacker exploits a vulnerability in device Host and is able to alter the stored copy of Data on the device.
CSG-DataStorageEncryption
DS.Auth.HPsACd-pDS-V.4

Attacker exploit at service Process alters Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data on its host device Host.
CSG-DataStorageEncryption
DS.C.HDS-V.4

Attacker exploit at Host accesses stored data Data: the attacker is able to exploit a vulnerability in device Host gaining access to its stored copy of Data.
CSG-DataStorageEncryption
DS.C.HPsACr-pDS-V.4

Attacker exploit at Process accesses Data: the attacker is able to exploit a vulnerability in process Process and gains access to the stored copy of Data on device Host which is served by the process.