Poisoned Pipeline / Techniques / T0127
Exposed database
Cloud Security Infrastructure as code
Exposing a database to the public internet can be a critical security issue, as attackers can use it to gain access to sensitive information.
In the context of cloud security and infrastructure as code, this attack technique typically involves misconfigured security group rules or network access control lists (ACLs) that allow public access to a database.
It can also occur when developers or system administrators accidentally expose database credentials or when misconfigured server configurations allow database access.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1270 Implement proper access control for databases
- M1271 Protect database credentials
- M1272 Audit server configuration
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1131 Implement SIEM
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1270 Implement network scanning
- D1510 Implement Intrusion Detection System and anti-malware
Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.