CCC Object Storage Threats Catalog
This page renders the FINOS Common Cloud Controls Object Storage threats as a
Gemara ThreatCatalog, including shared CCC Core
threats this service imports.
For the companion catalogs, see the Capabilities Catalog and Controls Catalog.
Data
Data storage, lifecycle, and durability capabilities.
CCC.ObjStor.TH01Data Exfiltration via Insecure Lifecycle Policies
Misconfigured lifecycle policies may unintentionally allow data to be exfiltrated or destroyed prematurely, resulting in a loss of availability and potential exposure of sensitive data.
CCC.ObjStor.CPCCC.ObjStor.CP08
CCC.Core.CPCCC.Core.CP11
CCC.ObjStor.TH03Storage Class Downgrade Leading to Durability or Availability Loss
An authorized entity or misconfigured lifecycle policy may transition objects from a high-durability or high-availability storage class to a lower-durability or single-zone class. This degradation manifests only when a subsequent failure occurs (e.g., availability zone outage). Objects may also be transitioned to archival tiers, rendering them effectively inaccessible for extended retrieval periods during incidents.
CCC.ObjStor.CPCCC.ObjStor.CP08Lifecycle PoliciesCCC.ObjStor.CP12Storage Classes
CCC.Core.TH02Data is Intercepted in Transitimported
Imported from CCC.Core.TH
Data transmitted by the service is susceptible to collection by any entity with access to any part of the transmission path. Packet observations can be used to support the planning of attacks by profiling origin points, destinations, and usage patterns. The data may also be vulnerable to interception or modification in transit if not properly encrypted, impacting the confidentiality or integrity of the transmitted data.
CCC.Core.CapabilitiesCCC.Core.CP08Data ReplicationCCC.Core.CP14API Access
CCC.Core.TH03Deployment Region Network is Untrustedimported
Imported from CCC.Core.TH
Systems are susceptible to unauthorized access or interception by actors with social or physical control over the network in which they are deployed. If the geopolitical status of the deployment network is untrusted, unstable, or insecure, this could result in a loss of confidentiality, integrity, or availability of the service and its data.
CCC.Core.CapabilitiesCCC.Core.CP08Data ReplicationCCC.Core.CP22Location Lock-In
CCC.Core.TH04Data is Replicated to Untrusted or External Locationsimported
Imported from CCC.Core.TH
Systems are susceptible to unauthorized access or interception by actors with political or physical control over the network in which they are deployed. Confidentiality may be impacted if the data is replicated to a network where the geopolitical status is untrusted, unstable, or insecure.
CCC.Core.CapabilitiesCCC.Core.CP21Replication
CCC.Core.TH05Interference with Replication Processesimported
Imported from CCC.Core.TH
Misconfigured or manipulated replication processes may lead to data being copied to unintended locations, delayed, modified, or not being copied at all. This could lead to compromised data confidentiality and integrity, potentially also affecting recovery processes and data availability.
CCC.Core.CapabilitiesCCC.Core.CP08Data ReplicationCCC.Core.CP12RecoveryCCC.Core.CP21Replication
CCC.Core.TH06Data is Lost or Corruptedimported
Imported from CCC.Core.TH
Services that rely on accurate data are susceptible to disruption in the event of data loss or corruption. Any actions that lead to the unintended deletion, alteration, or limited access to data can impact the availability of the service and the system it is part of.
CCC.Core.CapabilitiesCCC.Core.CP11BackupCCC.Core.CP18Versioning
Access
Access control and public exposure boundaries.
CCC.ObjStor.TH02Pre-Signed URL Abuse
Pre-signed URLs generated with excessive permissions, overly long expiry durations, or insufficient scope constraints may be leaked or shared beyond their intended audience. Because the URL itself acts as a bearer credential, any entity in possession of the URL can access the referenced resource without further authentication, bypassing standard access controls.
CCC.Core.CPCCC.Core.CP05Signed URLsCCC.Core.CP06Access Control
CCC.Core.TH01Access is Granted to Unauthorized Usersimported
Imported from CCC.Core.TH
Logic designed to give different permissions to different entities may be misconfigured or manipulated, allowing unauthorized entities to access restricted parts of the service, its data, or its child resources. This could result in a loss of data confidentiality or tolerance of unauthorized actions which impact the integrity and availability of resources and data.
CCC.Core.CapabilitiesCCC.Core.CP06Access ControlCCC.Core.CP29Active Ingestion
CCC.Core.TH15Automated Enumeration and Reconnaissance by Non-human Entitiesimported
Imported from CCC.Core.TH
Automated processes may be used to gather details about service and child resource elements such as APIs, file systems, or directories. This information can reveal vulnerabilities, misconfigurations, and the network topology, which can be used to plan an attack against the system, the service, or its child resources.
CCC.Core.CapabilitiesCCC.Core.CP14API Access
Observability
The Observability group covers entries related to logging, monitoring, metrics, alerting, and event publication. This includes audit trail integrity, enumeration detection, and protection against tampering or unauthorized access to operational telemetry.
CCC.Core.TH07Logs are Tampered With or Deletedimported
Imported from CCC.Core.TH
Tampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP10Logging
CCC.Core.TH08Runtime Metrics are Manipulatedimported
Imported from CCC.Core.TH
Manipulation of runtime metrics can lead to inaccurate representations of system performance and resource utilization. This compromised data integrity may also impact system availability through misinformed scaling decisions, budget exhaustion, financial losses, and hindered incident detection.
CCC.Core.CapabilitiesCCC.Core.CP15Cost Management
CCC.Core.TH09Runtime Logs are Read by Unauthorized Entitiesimported
Imported from CCC.Core.TH
Unauthorized access to logs may expose valuable information about the system's configuration, operations, and security mechanisms. This could jeopardize system availability through the exposure of vulnerabilities and support the planning of attacks on the service, system, or network. If logs are not adequately sanitized, this may also directly impact the confidentiality of sensitive data.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP09Metrics Publication
CCC.Core.TH10State-change Events are Read by Unauthorized Entitiesimported
Imported from CCC.Core.TH
Unauthorized access to state-change events can reveal information about the system's design and usage patterns. This opens the system up to attacks of opportunity and support the planning of attacks on the service, system, or network.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP07Event PublicationCCC.Core.CP09Metrics PublicationCCC.Core.CP17Alerting
Resource Management
The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.
CCC.Core.TH11Publications are Incorrectly Triggeredimported
Imported from CCC.Core.TH
Incorrectly triggered publications may disseminate inaccurate or misleading information, creating a data integrity risk. Such misinformation can cause unintended operations to be initiated, conceal legitimate issues, and disrupt the availability or reliability of systems and their data.
CCC.Core.CapabilitiesCCC.Core.CP07Event PublicationCCC.Core.CP17Alerting
CCC.Core.TH12Resource Constraints are Exhaustedimported
Imported from CCC.Core.TH
Exceeding the resource constraints through excessive consumption, resource-intensive operations, or lowering of rate-limit thresholds can impact the availability of elements such as memory, CPU, or storage. This may disrupt availability of the service or child resources by denying the associated functionality to users. If the impacted system is not designed to expect such a failure, the effect could also cascade to other services and resources.
CCC.Core.CapabilitiesCCC.Core.CP04Transaction Rate LimitsCCC.Core.CP16BudgetingCCC.Core.CP19Auto-scaling
CCC.Core.TH13Resource Tags are Manipulatedimported
Imported from CCC.Core.TH
When resource tags are altered, it can lead to misclassification or mismanagement of resources. This can reduce the efficacy of organizational policies, billing rules, or network access rules. Such changes could cause compromised confidentiality, integrity, or availability of the system and its data.
CCC.Core.CapabilitiesCCC.Core.CP20Tagging
CCC.Core.TH14Older Resource Versions are Usedimported
Imported from CCC.Core.TH
Running older versions of child resources can expose the system to known vulnerabilities that have been addressed in more recent versions. If the version identifier is detected by an attacker, it may be possible to exploit these vulnerabilities to compromise the confidentiality, integrity, or availability of the system and its data.
CCC.Core.CapabilitiesCCC.Core.CP18Versioning