Poisoned Pipeline / Techniques / T0124
Unencrypted data at rest
Encryption at rest is a critical security control in cloud computing that involves encrypting data when it is stored on different cloud storage entities.
This type of encryption is designed to protect data from unauthorized access.
In cloud environments, encryption at rest is typically implemented using encryption keys that are managed by the cloud provider or by the customer.
The cloud provider may provide encryption services as part of their cloud offering, or customers may choose to use their own encryption tools or services to encrypt their data before storing it in the cloud.
The risks of not having encryption at rest in a cloud environment can lead to data theft, data loss, regulatory non-compliance, reputation damage, and legal liability.
It is important for organizations to implement encryption at rest to protect their sensitive data and comply with regulatory requirements.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/protecting-data-at-rest.html
- https://cloud.google.com/docs/security/encryption/default-encryption
- https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest
Mitigations
- M1240 Enable data encryption at rest
- M1241 Use strong encryption algorithms
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware