CloudStorage.yaml

version: 1
ATT&CK version: 10
creation date: 04/13/2022
last update: 04/18/2022
name: Cloud Storage
contact: ctid@mitre-engenuity.org
organization: Center for Threat Informed Defense (CTID)
platform: GCP
tags:
  - Storage
  - Data Security
  - Encryption
  - Credentials
description: >-
  Google's Cloud Storage is an object storage service that provides customers with replication,
  availability, access control, and data management. A feature to highlight is that Cloud Storage by
  default always encrypts data before it's written to disk on the server side. 
techniques:
  - id: T1530
    name: Data from Cloud Storage Object
    technique-scores:
      - category: Protect
        value: Significant
        comments: >-
          The cloud service provider's default encryption setting for data stored and written to
          disk in the cloud may protect against adversary's attempt to access data from improperly
          secured cloud storage. This technique was rated as significant due to the high protect
          coverage factor.
  - id: T1565.001
    name: Stored Data Manipulation
    technique-scores:
      - category: Protect
        value: Significant
        comments: >-
          The cloud service provider's default encryption setting for data stored and written to
          disk in the cloud may protect against adversary's attempt to manipulate customer
          data-at-rest. This technique was rated as significant due to the high protect coverage
          factor.
  - id: T1588.004
    name: Digital Certificates
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          The cloud service provider's default encryption setting for data stored and written to
          disk in the cloud may protect against adversary's attempt to manipulate customer
          data-at-rest. This technique was rated as partial due to the medium to high protect
          coverage factor against variations of this attack.
  - id: T1588.003
    name: Code Signing Certificates
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          The cloud service provider's default encryption setting for data stored and written to
          disk in the cloud may protect against adversary's attempt to manipulate customer
          data-at-rest. This technique was rated as partial due to the medium to high protect
          coverage factor against variations of this attack.
comments: >-
  There are other methods available for users to secure data with the use of client-side encryption
  and customer encryption-keys.
references:
  - 'https://cloud.google.com/storage/docs/encryption'
  - 'https://cloud.google.com/storage'