Control Strategy DisableSubnet

URI: CSG-DisableSubnet

Package: Network

< prev | next >

Description: Indicates provision of network LogicalSubnet is disabled at device Gateway, meaning the subnet is not available to potential attackers. This strategy does not represent a contingency plan, but a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction. The most common situation where provision of a subnet is possible but would not be used in practice is where a mobile device provides a WiFi hotspot, which it could do in any location, but the user will keep the hotspot functionality switched off in some locations.

Blocked Threats (3)

LS.IS.HprLS.8

Subnet LogicalSubnet in service: if device Gateway is in service, it will provide subnet LogicalSubnet, unless network provision is explicitly disabled.

LS.L.WSSH-P.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.

LS.L.VSPSH-P.3

Access to virtual subnet LogicalSubnet via physical network PhysicalSubnet: if an attacker has access to physical subnet PhysicalSubnet, they connect to virtual subnet LogicalSubnet routed over PhysicalSubnet, unless prevented by security measures.

Triggers Threats (2)

LS.A.HprLS.6.1

Disabled subnet LogicalSubnet is not available: if provisioning by host Gateway of subnet LogicalSubnet has been disabled, then LogicalSubnet will be unavailable.

LS.IS.HprLSAC.1

Provision of subnet LogicalSubnet by Gateway not disabled: if an attacker has admin rights on host Gateway, they can override a policy to disable provision by Gateway of network LogicalSubnet.