Poisoned Pipeline / Techniques / T0125
Unencrypted data in transit
Cloud Security Infrastructure as code CI/CD Posture
Data encryption in transit refers to the process of encrypting data as it moves between two points over a network or the internet.
In cloud security, this involves encrypting data as it travels between a user's device and the cloud server or between different cloud servers.
Encryption in transit is important because data transmitted over networks can be intercepted and read by attackers.
Without encryption, sensitive data such as login credentials, financial information, or personal data can be easily accessed by attackers, putting the data and the users at risk.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://docs.aws.amazon.com/whitepapers/latest/efs-encrypted-file-systems/encryption-of-data-in-transit.html
- https://cloud.google.com/docs/security/encryption-in-transit
Mitigations
- M1241 Use strong encryption algorithms
- M1250 Enable data encryption in transit
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.