VPCServiceControls.yaml

version: 1
ATT&CK version: 10
creation date: 02/14/2022
last update: 06/07/2022
name: VPC Service Controls
contact: ctid@mitre-engenuity.org
organization: Center for Threat Informed Defense (CTID)
platform: GCP
tags:
  - Virtual Private Cloud
  - Access Control Policies
  - Network
description: >-
  VPC Service Controls improves your ability to mitigate the risk of data exfiltration from Google
  Cloud services such as Cloud Storage and BigQuery. You can use VPC Service Controls to create
  perimeters that protect the resources and data of services that you explicitly specify.
techniques:
  - id: T1078
    name: Valid Accounts
    technique-scores:
      - category: Protect
        value: Significant
        comments: >-
          This control is able to mitigate against abuse of compromised valid accounts by
          restricting access from those accounts to resources contained within the VPC perimeter the
          account belongs to. Resources and services contained in other VPC networks also cannot be
          accessed by user accounts that are not within the VPC network perimeter.
  - id: T1537
    name: Transfer Data to Cloud Account
    technique-scores:
      - category: Protect
        value: Significant
        comments: >-
          This control may mitigate against exfiltration attempts to external cloud accounts by
          limiting egress of data from accounts and services contained within the VPC network
          perimeter. 
  - id: T1530
    name: Data from Cloud Storage Object
    technique-scores:
      - category: Protect
        value: Significant
        comments: >-
          This control may mitigate against access to cloud storage objects by limiting access to
          accounts and services contained within the VPC network perimeter that contains those cloud
          storage objects. 
  - id: T1567
    name: Exfiltration Over Web Service
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control is able to mitigate against exfiltration of data over a web service. Data
          contained within a VPC network perimeter can not be moved to a Google cloud resource or
          service outside of the perimeter but may be moved to third party services or storage.
  - id: T1619
    name: Cloud Storage Object Discovery
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control may mitigate against discovery of cloud storage objects. This control is not
          able to protect metadata, such as cloud storage bucket names but can protect against
          discovery of the contents of a storage bucket. 
references:
  - 'https://cloud.google.com/vpc-service-controls/docs/overview'