Matching CCC-nS

URI: MP-CCC-nS

Package: ProcessComms

< prev | next >

Description: Finds a Client that is not sharing or forwarding credentials, with access to a Service that does not use a separate authenticator, the ClientChannel between them, the Client and Service hosts and optionally the Client user and Service manager.

Root Pattern: R-CCCS

R-CCCS

Finds a Client and Service with a Client Channel between them, plus their hosts.

Threat Patterns (4)

CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.

CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.

CC.AX.CCC-nS.6.1.1

Client Client unable to authenticate via password with Service: the service Service requires that clients authenticate using a password, but this is not available to client Client.

CC.AX.CCC-nS.6.1.3

Client Client unable to use 2-factor authentication to access service Service: if service Service requires clients to authenticate using a second factor (e.g. a one time key or out of band key exchange), but this is not available to Client then access will be impossible.