Poisoned Pipeline / Mitigations / M1550
M1550
Implement strict access control for clouds
Limit access to cloud resources to only authorized users and ensure that proper authentication and authorization mechanisms are in place.
Applies to
- T0196 Backdoor in code
- T0105 Active scanning
- T0155 Cloud workload
- T0156 Exfiltration over webhooks
- T0146 Misconfigured audit logs settings
- T0175 Untagged resources
- T0143 External user accounts
- T0123 Exposed internal API
- T0139 Resource hijacking
- T0184 Harvesting sensitive information from files
- T0176 Disable or misconfigure security measures
- T0161 Implant in zombie instance
- T0137 Weak authentication methods
- T0128 Permissive network access
- T0144 Misconfigured traffic log settings
- T0185 Steal credentials in container artifacts
- T0113 Compromised user account
- T0187 Exposed storage
- T0174 SaaS sprawl
- T0116 Shadow IT
- T0197 Use code from untrusted source
- T0138 Backdoor in code
- T0162 Passwords in CI/CD logs
- T0142 Accidental public disclosure of internal resources
- T0177 Misconfiguration of serverless workloads
- T0131 Overprivileged user account
- T0114 Compromised service account
- T0106 Scan configuration on public resources
- T0127 Exposed database
- T0126 Exposed storage
- T0213 Orchestrate AI-agent fleet as the intrusion workforce