Threat DF.Auth.HPDSDADF.0

URI: DF.Auth.HPDSDADF.0

Package: DataLifecycle

< prev | next >

Description: Service Process serves an unauthentic stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is unauthentic, so will the flow of Data served to FlowsTo.

Threat Type: Secondary Threat

Matching Pattern:

DF.Auth.HPDSDADF.0
MP-HPDSDADF

Finds a Host storing a Data Copy that is read and sent in a data flow by a Process on the same Host, plus optionally the Host and Process managers.

DF.Auth.HPDSDADF.0
P.IS.HP.8

Process Process in service: if host Host is in service, then Process running on Host will also be in service and subject to attack, unless explicitly disabled.
DF.Auth.HPDSDADF.0
P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.
DF.Auth.HPDSDADF.0
P.IS.HP.2

Process Process re-enabled on stolen device Host: if an attacker gains access to stolen device Host, they can restart Process, overriding the policy to disable Process.
DF.Auth.HPDSDADF.0
DS.Auth.HPDFDADS.0

Flow of unauthentic data Data from FlowsFrom is stored by data service Process: if the flow of data Data from FlowsFrom to Process is unauthentic, then so will be the copy saved locally on device Host by Process.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACd-pDS-V.1

Use of Process to alter Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to serve and update the locally stored copy of Data.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACdpDS-V.1

Use of Process to alter Data on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to process and update the locally stored copy of Data.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACd-pDS-V.1.6

Use of compromised key at Process to alter Data stored on Host: someone with the rights of Process on its host device Host can alter the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
DF.Auth.HPDSDADF.0
DS.Auth.HsACDS-V.1.2

Use of admin privileges at Host to alter Data stored on Host: anyone with admin rights at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.
DF.Auth.HPDSDADF.0
DS.Auth.HsACDS-V.1.3

Use of user privileges at Host to alter Data stored on Host: anyone with user privileges at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.
DF.Auth.HPDSDADF.0
DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.
DF.Auth.HPDSDADF.0
DS.Auth.HDS-V.4

Attacker exploit at Host alters stored copy of Data: the attacker exploits a vulnerability in device Host and is able to alter the stored copy of Data on the device.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACd-pDS-V.4

Attacker exploit at service Process alters Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data on its host device Host.
DF.Auth.HPDSDADF.0
DS.Auth.HPsACdpDS-V.4

Attacker exploit at Process alters output Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data updated by the process on its host device Host.

        (empty)

        (empty)