add(threat) Add in common threat and control on network access rules

services/common-controls.yaml

@@ -503,3 +503,28 @@ controls:
         tlp_levels:
           - tlp_amber
           - tlp_red
+
+  - id: CCC.C12
+    title: Ensure Secure Network Access Rules
+    objective: |
+      Ensure network access to the service is restricted to explicitly
+      authorized IP addresses, ports, and protocols by properly
+      configuring security group and/or firewall rules. Configuration
+      must follow the principle of least privilege to minimize the
+      attack surface and prevent unauthorized  inbound connections.
+      Overly permissive rules such as, 0.0.0.0/0 must be disallowed or
+      strictly controlled.
+    threats:
+      - CCC.TH17 # Unauthorized Network Access via Misconfigured Rules
+    nist_csf:
+      - PR.AC-3 # Access permissions, entitlements are managed
+    control_mappings:
+      NIST_800_53: AC-4 # Information Flow Enforcement
+    test_requirements:
+      - id: CCC.C12.TR01
+        text: |
+          When an unauthorized source (IP or network) attempts to connect
+          to the service the request must be denied.
+        tlp_levels:
+          - tlp_red
+          - tlp_amber

services/common-threats.yaml

@@ -257,3 +257,16 @@ threats:
       - CCC.F09 # Monitoring
     mitre_technique:
       - T1562 # Impair Defenses
+
+  - id: CCC.TH17
+    title: Unauthorized Network Access via Misconfigured Rules
+    description: |
+      Improperly configured or overly permissive network access rules
+      such as security groups can allow unauthorized inbound connections,
+      to the service, which could result in unauthorized access to sensitive
+      resources or data and disruption to service availability.
+    features:
+      - CCC.F23 # Network Access Rules
+    mitre_technique:
+      - T1046 # Network Service Scanning
+      - T1133 # External Remote Services

services/database/relational/controls.yaml

@@ -9,6 +9,7 @@ common_controls:
   - CCC.C08 # Enable Multi-zone or Multi-region Data Replication
   - CCC.C09 # Prevent tampering, deletion, or unauthorized access to access logs
   - CCC.C10 # Prevent data replication to destinations outside of perimeter
+  - CCC.C12 # Ensure Secure Network Access Rules
 
 controls:
   - id: CCC.RDMS.C01

services/database/relational/threats.yaml

@@ -13,6 +13,7 @@ common_threats:
   - CCC.TH13 # Resource tags are manipulated
   - CCC.TH15 # Automated enumeration and reconnaissance by non-human entities
   - CCC.TH16 # Logging and Monitoring are Disabled
+  - CCC.TH17 # Unauthorized Network Access via Misconfigured Rules
 
 threats:
   - id: CCC.RDMS.TH01