Poisoned Pipeline / Techniques / T0128
Permissive network access
Permissive network access is an attack technique where an attacker targets and exploits network configurations that allow overly permissive access to a cloud-based network.
This could include open ports, insecure protocols, or misconfigured network security groups (NSGs).
An attacker can leverage this permissive access to launch a variety of attacks, such as network scanning, port scanning, or remote code execution.
For example, an organization may have a public-facing web application that requires access to a backend database server.
If the NSG rules for the database server are too permissive, allowing access from any IP address, an attacker could potentially gain access to the database server from anywhere on the internet.
Where this idea came from
Identified in published CI/CD or supply-chain security research cited below.
Mitigations
- M1280 Implement least privilege network access
- M1281 Configure network security group
- M1282 Secure default configurations
- M1550 Implement strict access control for clouds
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware