Question

Cloudbleed THREAT ACTOR | THREAT | VULNERABILITY | TECHNICAL IMPACTS | BUSINESS IMPACTS | CONTROLS External Malicious | TT 1 Data Breach | TT 12 Shared Technology Vulnerabilities | Memory Leakage | Financial - None | Preventative - EKM-03 - IVS-09 | Loss of Confidentiality | Buffer Overrun Vulnerability | Failure/Lack of Isolation | Operational - Forced credential resets - Credential leakage | Detective - TVM-02 - CCC-03 | | | | Compliance - Sensitive Data Leakage | Corrective - TVM-02 - IAM-12 | | | | Reputational - Loss of customer trust | PREVENTATIVE CONTROLS EKM-03: Sensitive data protection—Sensitive data should be protected via encryption. In the event of a data leak, the sensitive information will not be disclosed. IVS-09: Segmentation—Data segmented and protected according to sensitivity levels will provide more protection during a data leak. DETECTIVE CONTROLS TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves. CCC-03: Quality testing—Cloud Service Providers should conduct regular testing of service to discover and re-mediate vulnerabilities in a timely manner. CORRECTIVE CONTROLS TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves. IAM-12: User ID credentials—Affected customers should immediately force password or credential resets for affected systems. ATTACK DETAILS Threat actor: An external malicious actor could send HyperText Transfer Protocol (HTTP) requests to Cloudflare's vulnerable services. The vulnerability was dubbed "Cloudbleed." Threat: To trigger the vulnerability, the following requirements had to be met: (1) the final buffer had to finish with a malformed script or .img tag; (2) the buffer had to be less than 4KB in length; (3) the customer had to have either e-mail obfuscation enabled or automatic HTTPS rewrites/server-side excludes in combination with another feature that utilized the old parser; and (4) the client IP must have a poor reputation. Vulnerability: In a buffer over-read vulnerability, more memory was returned to the requester than was desired, resulting in memory leakage. Furthermore, Cloudflare is a shared technology, so the vulnerability affects more than just one tenant in a cloud service. TECHNICAL IMPACTS Denial of service: Leakage of API keys, passwords and other credentials are possible. Isolation failure: This results in queries to Cloudflare returns dumped memory from any of its customers. BUSINESS IMPACTS Financial: The incident created minimal service disruptions for Cloudflare, and any bigger impacts to Cloudflare customers were undisclosed. Operational: Operational impacts included the time and effort taken to reset passwords; additionally, credentials may have been exposed. Compliance: Sensitive information, such as PII data or health records, could have been leaked due to Cloudbleed. A breach of confidentiality of such data usually leads to compliance impacts, such as fines or investigations. Fortunately, there were no reported incidents related to this Cloudbleed attack. Reputational: Cloudflare probably experienced some reputational impacts for a security company, as the vulnerability led to a loss in confidentiality for their customers. KEY TAKEAWAYS - Vulnerabilities within an organization's supply chain still impact organizational risk - Cloud tenant segmentation depends on implementation, and is not absolute

Cloudbleed

PREVENTATIVE CONTROLS
EKM-03: Sensitive data protection—Sensitive data should be protected via encryption. In the event of a data leak, the sensitive information will not be disclosed.
IVS-09: Segmentation—Data segmented and protected according to sensitivity levels will provide more protection during a data leak.

DETECTIVE CONTROLS
TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves.
CCC-03: Quality testing—Cloud Service Providers should conduct regular testing of service to discover and re-mediate vulnerabilities in a timely manner.

CORRECTIVE CONTROLS
TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves.
IAM-12: User ID credentials—Affected customers should immediately force password or credential resets for affected systems.

ATTACK DETAILS
Threat actor: An external malicious actor could send HyperText Transfer Protocol (HTTP) requests to Cloudflare's vulnerable services. The vulnerability was dubbed "Cloudbleed."
Threat: To trigger the vulnerability, the following requirements had to be met: (1) the final buffer had to finish with a malformed script or .img tag; (2) the buffer had to be less than 4KB in length; (3) the customer had to have either e-mail obfuscation enabled or automatic HTTPS rewrites/server-side excludes in combination with another feature that utilized the old parser; and (4) the client IP must have a poor reputation.
Vulnerability: In a buffer over-read vulnerability, more memory was returned to the requester than was desired, resulting in memory leakage. Furthermore, Cloudflare is a shared technology, so the vulnerability affects more than just one tenant in a cloud service.

TECHNICAL IMPACTS
Denial of service: Leakage of API keys, passwords and other credentials are possible.
Isolation failure: This results in queries to Cloudflare returns dumped memory from any of its customers.

BUSINESS IMPACTS
Financial: The incident created minimal service disruptions for Cloudflare, and any bigger impacts to Cloudflare customers were undisclosed.
Operational: Operational impacts included the time and effort taken to reset passwords; additionally, credentials may have been exposed.
Compliance: Sensitive information, such as PII data or health records, could have been leaked due to Cloudbleed. A breach of confidentiality of such data usually leads to compliance impacts, such as fines or investigations. Fortunately, there were no reported incidents related to this Cloudbleed attack.
Reputational: Cloudflare probably experienced some reputational impacts for a security company, as the vulnerability led to a loss in confidentiality for their customers.

KEY TAKEAWAYS
- Vulnerabilities within an organization's supply chain still impact organizational risk
- Cloud tenant segmentation depends on implementation, and is not absolute

Cloudbleed

THREAT ACTOR | THREAT | VULNERABILITY | TECHNICAL IMPACTS | BUSINESS IMPACTS | CONTROLS
External Malicious | TT 1 Data Breach | TT 12 Shared Technology Vulnerabilities | Memory Leakage | Financial - None | Preventative - EKM-03 - IVS-09
| Loss of Confidentiality | Buffer Overrun Vulnerability | Failure/Lack of Isolation | Operational - Forced credential resets - Credential leakage | Detective - TVM-02 - CCC-03
| | | | Compliance - Sensitive Data Leakage | Corrective - TVM-02 - IAM-12
| | | | Reputational - Loss of customer trust |

PREVENTATIVE CONTROLS
EKM-03: Sensitive data protection—Sensitive data should be protected via encryption. In the event of a data leak, the sensitive information will not be disclosed.
IVS-09: Segmentation—Data segmented and protected according to sensitivity levels will provide more protection during a data leak.

DETECTIVE CONTROLS
TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves.
CCC-03: Quality testing—Cloud Service Providers should conduct regular testing of service to discover and re-mediate vulnerabilities in a timely manner.

CORRECTIVE CONTROLS
TVM-02: Vulnerability/patch management—Cloud Service Providers should inform customers of the extent to which data were exposed and what customers can do to protect themselves.
IAM-12: User ID credentials—Affected customers should immediately force password or credential resets for affected systems.

ATTACK DETAILS
Threat actor: An external malicious actor could send HyperText Transfer Protocol (HTTP) requests to Cloudflare's vulnerable services. The vulnerability was dubbed "Cloudbleed."
Threat: To trigger the vulnerability, the following requirements had to be met: (1) the final buffer had to finish with a malformed script or .img tag; (2) the buffer had to be less than 4KB in length; (3) the customer had to have either e-mail obfuscation enabled or automatic HTTPS rewrites/server-side excludes in combination with another feature that utilized the old parser; and (4) the client IP must have a poor reputation.
Vulnerability: In a buffer over-read vulnerability, more memory was returned to the requester than was desired, resulting in memory leakage. Furthermore, Cloudflare is a shared technology, so the vulnerability affects more than just one tenant in a cloud service.

TECHNICAL IMPACTS
Denial of service: Leakage of API keys, passwords and other credentials are possible.
Isolation failure: This results in queries to Cloudflare returns dumped memory from any of its customers.

BUSINESS IMPACTS
Financial: The incident created minimal service disruptions for Cloudflare, and any bigger impacts to Cloudflare customers were undisclosed.
Operational: Operational impacts included the time and effort taken to reset passwords; additionally, credentials may have been exposed.
Compliance: Sensitive information, such as PII data or health records, could have been leaked due to Cloudbleed. A breach of confidentiality of such data usually leads to compliance impacts, such as fines or investigations. Fortunately, there were no reported incidents related to this Cloudbleed attack.
Reputational: Cloudflare probably experienced some reputational impacts for a security company, as the vulnerability led to a loss in confidentiality for their customers.

KEY TAKEAWAYS
- Vulnerabilities within an organization's supply chain still impact organizational risk
- Cloud tenant segmentation depends on implementation, and is not absolute

Added by Diane G.

Question

Please give Ace some feedback