Owasp Infrastructure

OWASP Infrastructure Top 10 — Skill Entry

This SKILL.md is the entrypoint for the OWASP Infrastructure Top 10 skill.

The skill encodes the OWASP Infrastructure Security Top 10 (2024) as structured, machine-readable references that an agent can query to identify, assess, and remediate infrastructure security risks.

Normative references (Infrastructure Top 10)

1. 00 Vulnerability Index 2. 01 Outdated Software 3. 02 Insufficient Threat Detection 4. 03 Insecure Configurations 5. 04 Insecure Resource and User Management 6. 05 Insecure Use of Cryptography 7. 06 Insecure Network Access Management 8. 07 Insecure Authentication Methods and Default Credentials 9. 08 Information Leakage 10. 09 Insecure Access to Resources and Management Components 11. 10 Insufficient Asset Management and Documentation

Skill layout

• SKILL.md — this file (skill entrypoint).
• references/ — the Infrastructure Top 10 normative documents.
• 00-vulnerability-index.md — index of all vulnerability identifiers, categories, and cross-references.
• 01 through 10 — one document per vulnerability aligned with OWASP Infrastructure Security numbering.

00 Vulnerability Index

This document provides the index for the OWASP Infrastructure Security Top 10 (2024) vulnerabilities. Each entry includes its identifier, title, and primary category.

Vulnerability catalog

Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in internal infrastructure. 2. Risk — concrete consequences of exploitation and business impact. 3. Vulnerability checklist — indicators that the environment is exposed. 4. Prevention controls — defensive measures and rectification steps. 5. Example attack scenarios — realistic exploitation narratives. 6. Detection guidance — signals and methods to identify exposure. 7. Remediation — immediate and long-term actions to contain and resolve.

Category groupings

Patch Management

• ISR01:2024 Outdated Software

Observability

• ISR02:2024 Insufficient Threat Detection

Configuration Management

• ISR03:2024 Insecure Configurations

Access Control

• ISR04:2024 Insecure Resource and User Management
• ISR09:2024 Insecure Access to Resources and Management Components

Data Protection

• ISR05:2024 Insecure Use of Cryptography
• ISR08:2024 Information Leakage

Network Security

• ISR06:2024 Insecure Network Access Management

Credential Hygiene

• ISR07:2024 Insecure Authentication Methods and Default Credentials

Governance

• ISR10:2024 Insufficient Asset Management and Documentation

01 Outdated Software

Identifier: ISR01:2024 Category: Patch Management

Description

Outdated software occurs when software components, including libraries and dependencies, are not kept on current, stable, and supported versions. Updates frequently include security-relevant patches, meaning unpatched software may contain vulnerabilities in its current version state. These vulnerabilities are often publicly known and can be discovered by security scanners. Due to the lack of updates and update management, many software components and underlying systems become vulnerable over time, with increasing criticality as time passes.

Risk

• Vulnerabilities ranging from low criticality to full system compromise.
• Severity and count of vulnerabilities in outdated software increase over time as more flaws are

discovered and published.

• Publicly known vulnerabilities are easily exploitable using available scanning tools and exploit

databases.

• Vendors may cease support for older versions, leaving no remediation path.

Vulnerability checklist

• Software components are not on the latest stable and supported version.
• No update management process exists to track and apply patches regularly.
• Vendor sites and security advisories are not monitored for zero-day exploits.
• Retired or end-of-life software remains deployed in the environment.
• Libraries and dependencies are not inventoried or checked for updates.

Prevention controls

1. Keep all software components, including libraries, on an up-to-date, stable, and supported version. 2. Regularly check every software component for updates and new patches. 3. Implement an update management process to ensure no components are missed and checks are timely. 4. Monitor vendor sites and information security hubs for news about zero-day exploits. 5. Take precautions to reduce impact or probability of vulnerabilities when no patch is available.

Example attack scenarios

Scenario A — Outdated web server

A company hosts an internal website for employees. The company lacks an update management process and does not regularly check or update its software. The web server runs on an outdated version with known vulnerabilities, including a Remote Code Execution flaw. An attacker who gained access to an employee's computer enumerates the internal web server version and finds a related CVE. The attacker uses a publicly available exploit to gain access to the underlying server.

Scenario B — Deprecated old server

A company has an update management process for its software components. The process fails to inventory an old internal server containing confidential construction plans. An attacker who gained access to the internal network discovers this server and enumerates its OS version. The vendor no longer supports the version, and it is prone to several critical vulnerabilities. The attacker uses a publicly available exploit to access the server and exfiltrate the confidential plans, selling them to competitors.

Detection guidance

• Automated vulnerability scanning to identify outdated software versions.
• Inventory reconciliation against vendor-supported version lists.
• CVE database monitoring for components in the environment.
• Alerting on end-of-life or end-of-support software still in production.

Remediation

• Update all identified outdated software to the latest stable, supported version.
• Decommission or isolate systems running software that can no longer be patched.
• Establish a recurring update management cycle with defined ownership.
• Subscribe to vendor security advisory feeds for all deployed software.
• Conduct post-update validation to confirm patches are applied and effective.

02 Insufficient Threat Detection

Identifier: ISR02:2024 Category: Observability

Description

Insufficient threat detection occurs when an organization lacks the processes and mechanisms needed to identify threat actors and malicious activities before severe damage is caused. In most cyberattacks, especially internal ones, the first detection of threat actors happens too late, typically when ransomware encrypts data or an important server is disrupted. Threat actors are normally present in an internal network for weeks or months before performing conspicuous actions. Qualitative threat detection is needed to identify threat actors in the initial access phase or, at the latest, in the command and control phase.

Risk

• If threat actors are not detected early, the target organization may be powerless to mount

further defense actions.

• Insufficient threat detection is one of the primary reasons sophisticated cyberattacks succeed.
• Without proper detection and monitoring, organizations cannot observe attackers accessing the

internal network or moving laterally through it.

• Late detection allows attackers to reach critical assets and cause maximum damage before any

response occurs.

Vulnerability checklist

• No Security Incident and Event Management (SIEM) system is deployed.
• Endpoint Detection and Response (EDR) is the only detection mechanism without network-level

coverage.

• Detection sensors are not deployed across multiple infrastructure levels and ISO/OSI layers.
• No anomaly detection for unusual data transfers or access patterns.
• Monitoring coverage gaps exist for servers, network devices, or specific network segments.

Prevention controls

1. Implement processes and mechanisms on different levels and points of the internal infrastructure to build a comprehensive threat detection system. 2. Deploy SIEM systems to aggregate and correlate security events. 3. Deploy Firewalls with inspection and logging capabilities. 4. Deploy EDR applications on endpoints. 5. Implement detection sensors on computers, servers, and the network across different ISO/OSI layers. 6. Implement anomaly detection for unusual data transfers and access patterns.

Example attack scenarios

Scenario A — Insufficient network detection

A company has an internal infrastructure with endpoint systems and servers for internal applications holding mandatory business data. EDR software is deployed on every employee's device. An employee accidentally downloads and executes malware written by an Advanced Persistent Threat group, and the EDR fails to detect it. The malware compromises an internal server from the employee's computer and moves laterally, compromising all internal servers. These lateral movements are undetected because no network-level threat detection system exists. The malware encrypts all server data, halting business operations. A redundant and complete threat detection system beyond EDR would have detected this activity.

Scenario B — Insufficient anomaly detection

A company hosts internal services for employees to share critical data and files, providing laptops and VPN software for remote work. An employee's laptop is stolen on a train; the cybercriminal gains access to the laptop and the employee's account. The criminal finds internal shares and downloads all files. The company fails to detect this data exfiltration because it lacks anomaly detection that would have noticed the large data transfer or access to shares the employee typically does not use. The exfiltrated data and files are later sold to competitors.

Detection guidance

• Monitor for gaps in logging coverage across the infrastructure.
• Validate that detection sensors cover endpoints, servers, and network segments.
• Test detection capabilities with simulated attack exercises and red team engagements.
• Review alert volumes and false positive rates to confirm detection fidelity.

Remediation

• Deploy SIEM and centralized log aggregation across all infrastructure tiers.
• Add network-level detection sensors to complement endpoint-only solutions.
• Implement anomaly detection for data transfer volumes and access patterns.
• Conduct detection coverage gap analysis and address identified blind spots.
• Establish regular detection testing through adversary simulation exercises.

03 Insecure Configurations

Identifier: ISR03:2024 Category: Configuration Management

Description

Insecure configurations arise when hardware, software, or network components are not properly set up, exposing them to potential cyber threats. These vulnerabilities often serve as low-hanging fruit for attackers, offering a relatively easy path into an organization's network. Addressing insecure configurations requires a proactive approach involving regular auditing, robust configuration management, and adherence to security best practices throughout an organization.

Risk

• Insecure configurations create openings for exploits, potential data breaches, and lateral

movement.

• They represent an easily exploitable path into the organization's network.
• Misconfigured systems can enable client-side attacks, cross-site scripting, and data exfiltration.
• Lack of network separation allows attackers to traverse from one operational area to another.

Vulnerability checklist

• Security headers (CSP, X-Content-Type-Options) are missing from internal web applications.
• Network separation between operational areas is absent or insufficient.
• Default or vendor-shipped configurations are deployed without hardening.
• No regular security audits or vulnerability assessments are performed.
• Vendor hardening guides and security advisories are not followed.

Prevention controls

1. Conduct regular security audits and vulnerability assessments to identify insecure configurations; use automated scanning tools for proactive detection and remediation. 2. Follow vendor security advisories and apply hardening guides to configure software securely. 3. Provide cybersecurity training and awareness programs for employees to reduce the likelihood of insecure configurations resulting from not implementing best practices. 4. Implement network segmentation between different operational areas. 5. Apply security headers and secure defaults to all internal web applications.

Example attack scenarios

Scenario A — Missing security headers

A company uses an internal web application hosting sensitive client data. The application lacks essential security headers such as Content Security Policy and X-Content-Type-Options. A disgruntled employee with basic technical knowledge discovers this oversight and crafts a cross-site scripting attack, exploiting the missing headers to inject malicious scripts. The script exfiltrates sensitive client data to an external server controlled by the insider.

Scenario B — No network separation

A healthcare provider relies on a single network for administrative operations and patient data management with no segmentation between the two areas. A system administrator upset over workplace issues exploits this lack of separation. Using elevated access privileges, they traverse from the administrative segment to the patient data management segment and maliciously alter patient records, causing data integrity issues and potentially endangering patient care.

Detection guidance

• Scan for missing or misconfigured security headers on internal web applications.
• Audit network topology for absent or insufficient segmentation.
• Compare deployed configurations against vendor hardening baselines.
• Review change management logs for unauthorized configuration changes.

Remediation

• Apply vendor-recommended hardening guides to all hardware, software, and network components.
• Implement missing security headers on all internal web applications.
• Establish network segmentation between distinct operational areas.
• Create and enforce a configuration management baseline with automated drift detection.
• Schedule recurring security audits and remediate findings promptly.

04 Insecure Resource and User Management

Identifier: ISR04:2024 Category: Access Control

Description

Insecure resource and user management occurs when an organization fails to plan and enforce proper access controls for its resources and users. Most companies rely on centralized tools like Active Directory or Microsoft Entra ID, but rolling out these tools without a proper security concept introduces vulnerabilities. Permission and rights management are often neglected, resulting in users or technical accounts having more permissions than required. Accounts may not be deleted after an employee departs, and password policies may not be technically enforced.

Risk

• Excessive permissions increase the blast radius when a user account is compromised, giving

threat actors more access and leading to devastating cyberattacks.

• Rights and permissions may not be revoked when employees leave the organization.
• Lack of enforced password policies puts account security at risk.
• Resources and users accumulate over time, making it difficult to maintain oversight, and risks

arise from unmanaged growth.

Vulnerability checklist

• Users or technical accounts hold more permissions than needed for their role.
• No need-to-know principle is applied to permission assignments.
• Departed employees' accounts remain active in the directory.
• Password policies are documented but not technically enforced.
• No Privileged Access Management (PAM) solution is implemented.
• Domain administrator accounts are used for routine administration tasks.
• Local administration rights are granted to all employees by default.

Prevention controls

1. Develop a strategy for which resources exist and who needs access to them; apply the need-to-know principle. 2. Apply the strategy to the infrastructure and its centralized management tools (e.g., Active Directory). 3. Ensure restrictions are enforced and the management tool is configured securely. 4. Implement Privileged Access Management (PAM) to harden resource and user management. 5. Establish an Authorization Management team that decides who receives which rights, permissions, and for how long. 6. Maintain an updated inventory of resources and users, adding new assets and removing retired ones promptly.

Example attack scenarios

Scenario A — Insecure privilege management

A company uses Active Directory for resource and user management. All employees have local administration rights, and every IT administrator has domain-admin rights used for routine tasks. An employee opens a malicious email attachment via social engineering. The infected laptop is exploited with a credential extraction tool because local admin rights allow it to run. An IT administrator's cached credentials are extracted from the laptop because they logged on recently to help with a printer problem. The threat actor obtains domain-admin credentials and compromises the entire infrastructure from a single system, due to the absence of privileged user management following the need-to-know principle.

Scenario B — Deprecated and insecure user accounts

A company has an internal infrastructure with a central customer data management system. The company does not technically enforce its password policy. An employee leaves their locked laptop in a café and steps away. A threat actor tries standard passwords and gains access after a few attempts. They find a link to the central customer data system and copy all data to their phone. They also discover an administrative share holding sensitive configuration data and exfiltrate it. The weak password and lack of resource management enabled unauthorized access and data theft.

Detection guidance

• Audit user accounts for excessive or stale permissions on a recurring schedule.
• Monitor for active accounts belonging to departed employees.
• Check for local administrator rights granted broadly across endpoints.
• Review domain-admin account usage for routine non-administrative tasks.

Remediation

• Remove excessive permissions and enforce the need-to-know principle across all accounts.
• Disable or delete accounts for departed employees immediately.
• Technically enforce password policies through the centralized management platform.
• Remove default local administration rights from standard employee accounts.
• Deploy PAM for all privileged accounts and restrict domain-admin usage to designated tasks.
• Establish an ongoing access review cycle with defined ownership.

05 Insecure Use of Cryptography

Identifier: ISR05:2024 Category: Data Protection

Description

Insecure use of cryptography occurs when encryption and cryptographic methods are not sufficiently implemented on systems and protocols used in the internal network. This is well understood for external applications but is often overlooked for internal infrastructure. If sufficient encryption is absent, an adjacent threat actor may read, modify, or inject data into communications and systems. A defense line only to the outside does not fully protect internal systems; once an attacker gains internal network access (e.g., via phishing), external defenses are largely bypassed. Internal infrastructure security must be as strong as, or stronger than, external system security.

Risk

• Information leakage and compromise of privileged accounts when insecure cryptographic methods

or configurations are used.

• Significantly increased chance of devastating cyberattacks and greater impact.
• Unencrypted remote access protocols allow adjacent threat actors to read credentials from

network traffic.

• Protocols without cryptographic integrity checks enable man-in-the-middle attacks where data

is modified in transit.

Vulnerability checklist

• Remote access tools (e.g., Telnet, unencrypted RDP) transmit credentials in clear text.
• Protocols in use do not perform cryptographic identity or integrity checks.
• Insecure or deprecated cryptographic algorithms are configured on internal systems.
• Internally developed cryptographic implementations are used instead of established libraries.
• Communication paths between internal systems lack encryption.

Prevention controls

1. Ensure all protocols, communication tools, remote access tools, and data transfer tools are configured to use secure cryptographic methods and configurations. 2. Migrate protocols that do not support secure encryption to secure alternatives (Telnet to SSH, FTP to SFTP). 3. Verify that cryptographic methods and configurations are sufficient, implemented per best practices, and follow official recommendations. 4. Use publicly available and established cryptographic libraries; do not develop custom cryptographic implementations.

Example attack scenarios

Scenario A — Unencrypted remote access tools

A company has an internal infrastructure with servers providing applications to employees, including a CRM system holding sensitive customer data. A threat actor gains access to the internal network through a misconfigured internet-exposed system. The threat actor sniffs internal network traffic from the compromised machine. An administrator connects to an internal file server using Telnet to perform an update. Because Telnet transmits data without encryption, the administrator's credentials are sent in clear text. The threat actor captures the credentials and uses them to log on to the CRM server, exfiltrating all customer data.

Scenario B — Insufficient use of cryptography

A company has an internal infrastructure with an invoice management application. A threat actor gains access to the internal network and can inspect and inject packets into traffic. An employee connects to the invoice system to create invoices. The communication protocol is encrypted but does not perform a cryptographic identity or integrity check. The threat actor performs a man-in-the-middle attack, modifying data packets to redirect invoice payments from the company's account to an attacker-controlled account. Customers unknowingly transfer money to the attacker.

Detection guidance

• Scan internal network traffic for unencrypted protocols (Telnet, FTP, unencrypted RDP).
• Audit cryptographic configurations on servers, remote access tools, and data transfer services.
• Identify use of deprecated algorithms or cipher suites in internal communications.
• Monitor for man-in-the-middle indicators such as certificate warnings or unexpected traffic

patterns.

Remediation

• Replace all unencrypted protocols with secure alternatives (SSH, SFTP, encrypted RDP).
• Update cryptographic configurations to use current, recommended algorithms and cipher suites.
• Remove internally developed cryptographic implementations and adopt established libraries.
• Enable cryptographic identity and integrity verification on all internal communication

protocols.

• Conduct a full audit of internal communication paths and remediate any unencrypted channels.

06 Insecure Network Access Management

Identifier: ISR06:2024 Category: Network Security

Description

Network Access Management is a fundamental aspect of internal infrastructure architecture and access control regulation. Qualitative Network Access Management prevents a variety of attacks and can reduce the impact of cyberattacks as well as the movement of threat actors inside the internal infrastructure. A critical risk is the lack of network separation, which would restrict access from one part of the infrastructure to another. Organizations often fail to prevent threat actors from accessing the internal network when the attacker gains physical access to a network port or nearby Wi-Fi. Traffic should be supervised and regulated context-based, close to the application layers, for communication paths that must be allowed.

Risk

• Absence of network separation severely increases the risk of cyberattacks spreading through the

internal infrastructure and compromising the entire environment from a single compromised component.

• Without Network Access Control (NAC), an attacker who gains physical access to network

components, convinces employees to plug in malicious devices, or reaches nearby Wi-Fi can access internal networks.

• Insufficient access regulation at the application layer allows threat actors to abuse commonly

allowed communication paths.

Vulnerability checklist

• No network separation exists between distinct infrastructure segments.
• No Network Access Control (NAC) mechanisms (e.g., certificate-based NAC) are implemented.
• Communication paths between network segments are not dynamically regulated at the application

layer.

• Remote access is not secured with technologies like VPNs.
• No access matrix exists to plan and enforce network access management.

Prevention controls

1. Implement NAC mechanisms (e.g., certificate-based NAC) to ensure only approved devices can access the company network. 2. Design network separation in the architecture phase; keep network segments as small as possible following the need-to-know principle. 3. Use VLANs to separate the infrastructure. 4. Supervise and regulate communication paths between isolated network segments. 5. Dynamically regulate bridges and network transitions based on application layer context. 6. Secure remote access using VPN technologies. 7. Develop an access matrix to plan the network access management structure.

Example attack scenarios

Scenario A — Insufficient network separation

A company hosts different customer-facing applications accessible online. Multiple database servers hold data for those applications, alongside servers for internal applications and data. A threat actor finds a vulnerability in one publicly accessible application server and gains complete control. Because of absent network separation, the attacker moves laterally and compromises all database servers as well as internal application and data servers from a single entry point. The exfiltrated data is later sold to other cybercriminals.

Scenario B — Missing NAC allowing rogue device

A company uses a common internal infrastructure with application servers and employee file shares. New network printers are ordered to replace old ones. A threat actor injects malicious hardware into a new printer before it arrives at the company. When the printer is connected to the internal network, the embedded small computer also gains network access because no NAC is in place. The malicious hardware connects to a remote host controlled by the threat actor, establishing a pivot point into the internal network for additional attacks.

Detection guidance

• Audit network topology for missing segmentation between operational zones.
• Check for NAC enforcement on all physical and wireless network ports.
• Monitor for unauthorized or unknown devices appearing on the network.
• Review application-layer traffic controls at segment boundaries.

Remediation

• Implement network segmentation with VLANs and firewall rules between operational zones.
• Deploy certificate-based NAC on all network ports and wireless access points.
• Create and enforce an access matrix governing inter-segment communication.
• Implement dynamic application-layer filtering at network boundaries.
• Secure all remote access channels with VPN or equivalent encrypted tunneling.
• Conduct regular network topology reviews and penetration tests.

07 Insecure Authentication Methods and Default Credentials

Identifier: ISR07:2024 Category: Credential Hygiene

Description

Passwords remain a fundamental part of cybersecurity, and many Identity and Access Management (IAM) systems rely on username and password authentication. Insecure authentication methods refer to passwords that are easy to guess or crack due to simplicity, predictability, or insufficient length. Default credentials preconfigured on hardware devices or software applications by manufacturers or vendors are often left unchanged by users or administrators, creating a security vulnerability.

Risk

• Credentials are crucial to restrict access to internal resources to authenticated and

authorized users only.

• Weak passwords can be exploited through brute-force and dictionary attacks.
• Default credentials can be found in product documentation and exploited by attackers.
• Exploitation of unchanged default settings or stolen passwords can lead to unauthorized access,

data breaches, and compromise of critical systems.

Vulnerability checklist

• Default credentials on hardware devices or software applications remain unchanged.
• Password complexity requirements are not enforced.
• Multi-factor authentication (MFA) is not implemented.
• Account lockout policies are absent after multiple failed login attempts.
• Password management tools are not available to employees.

Prevention controls

1. Enforce password complexity requirements across all systems and accounts. 2. Implement multi-factor authentication (MFA) for all user and administrative access. 3. Change default credentials on all hardware devices and software applications upon installation. 4. Educate employees about the importance of strong, unique passwords. 5. Provide password management tools to help employees manage credentials securely. 6. Implement account lockout after multiple failed login attempts. 7. Restrict access to devices with changed credentials to authorized personnel only.

Example attack scenarios

Scenario A — Default printer credentials

Many networked printers are shipped with default usernames and passwords that are widely known. An attacker exploits this by accessing the printer and viewing printing jobs containing sensitive information. Organizations must change default printer credentials upon installation and restrict access to authorized personnel.

Scenario B — Weak user passwords

Weak or easily guessable passwords for user accounts are a primary target for attackers. A malicious employee gains unauthorized access to sensitive information or systems by exploiting weak user passwords. Organizations should enforce password policies, implement account lockouts after multiple failed login attempts, and promote password best practices among users.

Detection guidance

• Scan for devices and applications still using manufacturer default credentials.
• Audit password policy enforcement across all IAM systems.
• Monitor for brute-force and dictionary attack patterns in authentication logs.
• Check MFA enrollment rates and identify accounts without MFA enabled.

Remediation

• Change all default credentials immediately on every hardware device and software application.
• Enforce password complexity and length requirements through technical controls.
• Deploy MFA across all user and administrative accounts.
• Implement account lockout and alerting for repeated failed authentication attempts.
• Provide organization-wide password management tooling and security awareness training.

08 Information Leakage

Identifier: ISR08:2024 Category: Data Protection

Description

Information leakage occurs when confidential or sensitive data is unintentionally or maliciously exposed, either within or outside an organization, due to inadequate security measures or personnel negligence. This leakage can manifest in various forms: improper disposal of documents, misconfigured permissions on network shares, or unsecured communication channels. It can also result from insider threats where disgruntled employees or malicious insiders intentionally exfiltrate data for personal gain or sabotage. This threat requires a holistic approach encompassing robust access control, data encryption, regular audits, and a culture of security awareness among employees.

Risk

• The severity depends on what information is leaked; internal IP addresses expose new network

targets, while personally identifiable information or protected data can lead to fraud, identity theft, or competitive disadvantage.

• Information leakage can expose an organization to extortion threats from malicious actors.
• Cumulative risk emphasizes the need for stringent cybersecurity measures, continuous monitoring,

and a well-informed workforce.

Vulnerability checklist

• Access permissions on network shares or databases are misconfigured or overly permissive.
• Sensitive data is transmitted over unsecured communication channels.
• Documents containing sensitive information are improperly disposed of.
• No data handling policies exist or adherence to regulatory compliance is not enforced.
• Employees lack security awareness training on data leakage prevention.
• Incident reporting processes are absent or slow.

Prevention controls

1. Employ encryption technologies to ensure data remains unintelligible in case of interception or unauthorized access. 2. Implement strict access control measures so only authorized individuals can access sensitive information. 3. Conduct regular security audits and network monitoring to identify and rectify potential weaknesses. 4. Provide comprehensive security training and awareness programs to equip employees with knowledge to recognize and prevent data leakage scenarios. 5. Foster a culture of accountability and quick incident reporting to mitigate damage when leakage occurs. 6. Establish clear data handling policies and ensure adherence to regulatory compliance.

Example attack scenarios

Scenario A — Customer data access for all employees

Due to a system misconfiguration, all employees gain unrestricted access to a database containing sensitive customer information. A curious employee browses the database and inadvertently shares customer data externally while on a public network. Simultaneously, a malicious insider extracts and sells the data on the dark web. Customers report fraudulent activities traced back to the data leakage, resulting in significant financial, legal, and reputational damage.

Detection guidance

• Monitor access logs for unusual or broad access patterns to sensitive data stores.
• Scan network shares and databases for overly permissive access configurations.
• Detect sensitive data patterns in outbound network traffic.
• Review document disposal and data handling practices during audits.

Remediation

• Restrict access permissions to sensitive data stores following the principle of least privilege.
• Encrypt all sensitive data at rest and in transit.
• Remediate misconfigured network shares and database permissions immediately.
• Establish and enforce data classification and handling policies.
• Implement data loss prevention (DLP) monitoring on egress points.
• Conduct organization-wide security awareness training focused on data handling.

09 Insecure Access to Resources and Management Components

Identifier: ISR09:2024 Category: Access Control

Description

Lack of proper access controls and permissions allows unauthorized individuals or programs to access sensitive data, systems, or physical locations. This vulnerability manifests in misconfigured access policies, overly permissive settings, or improper authentication mechanisms. The compromise of management components can give attackers a foothold within the organization's infrastructure, enabling them to pivot and expand their access.

Risk

• Critical data, sensitive information, and proprietary resources are exposed to unauthorized

access, resulting in data breaches, intellectual property theft, and confidential information compromise.

• Unauthorized manipulation of systems and configurations allows malicious employees or external

attackers over compromised clients to disrupt essential services, manipulate network traffic, or inject malicious code, leading to system outages and loss of business continuity.

• Compromised management components enable attackers to pivot and expand access across the

infrastructure.

• Reputational damage, regulatory compliance violations, and financial losses from incident

response and legal consequences.

Vulnerability checklist

• Access control to file shares does not follow the need-to-know principle.
• Network device management interfaces (routers, switches, firewalls) lack strong authentication.
• Management traffic is not isolated from the general network.
• Access rights are not regularly reviewed, audited, or updated.
• Management components (hardware and software) are not updated with security patches.

Prevention controls

1. Implement robust access control mechanisms across the entire infrastructure, adhering to the principle of least privilege and granting only the minimum necessary permissions. 2. Regularly review, audit, and update access rights, ensuring access is granted on a need-to-know basis. 3. Employ strong authentication and authorization protocols, including multi-factor authentication, to protect against unauthorized access. 4. Provide security awareness training for employees to reduce unintentional access misconfigurations. 5. Keep all management components, including hardware and software, updated with security patches and secure configurations. 6. Employ network segmentation to isolate management traffic from the general network. 7. Implement monitoring and logging of network device and management component activities.

Example attack scenarios

Scenario A — File share access

An attacker exploits insecure access controls on a file share, gaining unauthorized access to sensitive documents. The access permission is not managed by the need-to-know principle. Organizations should configure access rights for file shares, enforce strict permissions, and update server management components with strong access controls and authentication measures.

Scenario B — Network device management

An internal attacker accesses a router management interface and modifies routing tables, intercepts network traffic, or launches denial-of-service attacks. Organizations should secure network device management interfaces with strong authentication and access controls, keep device firmware up to date, employ network segmentation to isolate management traffic, and implement regular monitoring and logging of network device activities.

Detection guidance

• Audit file share permissions for violations of the need-to-know principle.
• Scan network device management interfaces for weak or default authentication.
• Monitor management component access logs for unauthorized or anomalous activity.
• Verify that management traffic is isolated from general network traffic.

Remediation

• Enforce least-privilege access controls on all file shares and management interfaces.
• Deploy multi-factor authentication for all management component access.
• Segment management traffic into dedicated network zones.
• Patch and update all management hardware and software on a defined schedule.
• Establish recurring access rights reviews with documented approval workflows.
• Enable comprehensive logging and alerting on management component activities.

10 Insufficient Asset Management and Documentation

Identifier: ISR10:2024 Category: Governance

Description

Insufficient asset management refers to shortcomings in an organization's ability to accurately identify, track, and document all its hardware and software assets, along with associated configurations, dependencies, and lifecycles. It encompasses the lack of an organized and up-to-date inventory of IT assets, which is essential for effective security, compliance, and operational efficiency. A complete asset inventory enables fast mapping of affected resources and accurate incident response.

Risk

• Unauthorized or unmanaged devices and software within the network make it difficult to enforce

security policies and monitor for vulnerabilities effectively.

• Incident response capabilities are hampered because the organization may struggle to identify

the scope and impact of a security incident or breach.

• Compliance with industry regulations and internal policies becomes challenging, exposing the

organization to legal and financial liabilities.

• Inefficient resource allocation results in overspending on redundant assets or underinvesting

in critical IT infrastructure.

Vulnerability checklist

• No complete inventory of hardware and software assets exists.
• Asset inventory is not continuously updated to reflect changes in the environment.
• Assets are not classified by criticality and function.
• No lifecycle management process exists for procurement, deployment, maintenance, and disposal.
• Regular audits and vulnerability scanning cycles are not conducted.
• Process, responsibility, and implementation documentation is incomplete or absent.

Prevention controls

1. Develop and maintain a complete inventory of all hardware and software assets, including servers, workstations, mobile devices, applications, and network equipment; continuously update this inventory. 2. Categorize assets based on criticality and function to prioritize security measures and resource allocation. 3. Implement a systematic approach to asset lifecycle management, including procurement, deployment, maintenance, and disposal; securely decommission or renew outdated assets before they become a security risk. 4. Conduct regular audits and reconciliation of the asset inventory to identify discrepancies, including regular vulnerability scanning cycles. 5. Provide accurate documentation describing all IT and business processes, corresponding responsibilities, and technical details.

Example attack scenarios

Scenario A — Undetected vulnerabilities

An organization has a vast and complex IT infrastructure. Due to a lack of systematic vulnerability scanning and asset management, the IT team is unaware of accumulating security weaknesses. Attackers exploit undetected vulnerabilities to gain unauthorized access, disrupt operations, or exfiltrate sensitive data. As the organization expands, the risk associated with these undetected vulnerabilities grows.

Scenario B — Incident response with good asset management

An incident response team confronts a critical security breach where attackers exploited a software vulnerability in the corporate platform, compromising webservers and creating an entry point to the internal network. Due to accurate and up-to-date asset documentation, the team quickly identifies critical systems, maps affected resources, defends weaknesses, and prevents significant data breaches. Damaged systems are rebuilt without extended disruption.

Detection guidance

• Compare deployed assets against the maintained inventory for discrepancies.
• Scan for unknown or unauthorized devices and software on the network.
• Review asset lifecycle records for items past end-of-life or end-of-support.
• Audit documentation completeness for IT processes, responsibilities, and technical details.

Remediation

• Conduct a full asset discovery and build a comprehensive hardware and software inventory.
• Classify all assets by criticality and function.
• Establish lifecycle management processes covering procurement through secure disposal.
• Schedule recurring inventory audits and automated vulnerability scanning.
• Create and maintain documentation for all IT processes, responsibilities, and configurations.
• Assign ownership for inventory accuracy and documentation currency.