Threat I.TA.I.8.2

URI: I.TA.I.8.2

Package: ProcessComms

< prev | next >

Description: Access to services on Host from LogicalSubnet enabled by exception: if the interface between Host and LogicalSubnet is in service, then even if connections to Host via that interface are blocked by default, connections to services running on Host will be allowed unless explicitly disabled.

Threat Type: Primary Threat

Matching Pattern:

I.TA.I.8.2
MP-I

Finds a solo Interface, plus the associated host and subnet (which is not a hotspot) and optionally the host manager.

        (empty)

        (empty)

        CSG-BlockInterface

CSG-DisableServiceAccess-Runtime

Apply a default firewall rule at host Host to drop messages sent to services running on the host from subnet LogicalSubnet. This strategy may represent a run-time adaptation in response to a threat, or a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction, which affect access to services running on Host but not other uses of its connection to LogicalSubnet.