unified
UC-VULN-11 — Embed taint mechanisms to detect data exfiltration
Embed covert taint mechanisms — such as beacon files, honeytokens, or watermarked records — into organizational systems and datasets so that exfiltration, improper modification, or unauthorized use of data can be detected. Monitor for taint activations, alert the security team when they fire, and periodically test that the mechanisms remain functional.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Vulnerability & Patch Management
- type
- detective
- category
- technical
Details
- unified_id
- UC-VULN-11
- title
- Embed taint mechanisms to detect data exfiltration
- statement
- Embed covert taint mechanisms — such as beacon files, honeytokens, or watermarked records — into organizational systems and datasets so that exfiltration, improper modification, or unauthorized use of data can be detected. Monitor for taint activations, alert the security team when they fire, and periodically test that the mechanisms remain functional.
- domain
- Vulnerability & Patch Management
- control_type
- detective
- control_category
- technical
- members
- framework
- nist-800-53
- control_id
- SI-20
- coverage
- full
- relationship
- equal
- guidance
Source
No record-specific source URL is provided.
Connections
- Security Control Assessment & POA&M Remediation tests UC-VULN-11 — Embed taint mechanisms to detect data exfiltration
- UC-VULN-11 — Embed taint mechanisms to detect data exfiltration maps_to SI-20 — Tainting
- framework
- nist-800-53
- control_id
- SI-20
- coverage
- full
- relationship
- equal
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- Deception, Honeytoken & OPSEC Concealment Operations operates UC-VULN-11 — Embed taint mechanisms to detect data exfiltration
- UC-VULN-11 — Embed taint mechanisms to detect data exfiltration mitigates Zero-day exploitation
- strength
- related
- rationale
- Taint activations detect exfiltration from exploitation of unknown vulnerabilities that preventive and signature controls missed.