{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Cryptography & Key Management","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","description":"Adversary counterfeits or compromises a certificate authority so that malware or connections appear legitimate, defeating trust in TLS and code-signing and enabling man-in-the-middle or malicious-code delivery.","details":{"category":"cyber_security","impact":"high","inherent_rating":"high","likelihood":"low","risk_id":"crypto-counterfeit-certificates","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:crypto-counterfeit-certificates","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acrypto-counterfeit-certificates","sourceIds":["aiuc-1","hipaa","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc2"],"sourceUrl":null,"title":"Compromised or counterfeit certificates / certificate authority","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:13f64e9bd86f0bc703948908c3cf78914b528e48bfb571ac0392522a46ce644f","properties":{"rationale":"Requires trusted certificates and rejects insecure fallback, helping reject rogue certs in MITM; the operative approved-CA/revocation defense sits in UC-CRYPTO-03.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-01-55215c11.json","sourceId":"uc:UC-CRYPTO-01","targetDetailPath":"/data/v1/records/risk-crypto-counterfeit-certificates-d9dcc5c5.json","targetId":"risk:crypto-counterfeit-certificates","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5d1f1a0ebca6eba2d224e2dc8357c03b7ae28e3d8419472daabcf58d915afb05","properties":{"rationale":"Prohibiting SHA-1/weak keys and fixing certificate profiles raises the cryptanalytic cost of forging a certificate signature, an enabler of counterfeit certificates.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-02-9be37a83.json","sourceId":"uc:UC-CRYPTO-02","targetDetailPath":"/data/v1/records/risk-crypto-counterfeit-certificates-d9dcc5c5.json","targetId":"risk:crypto-counterfeit-certificates","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9410dcb93a1382eb7e0305ce79840b35ad2b921ea2a9c612e48a2c9c861db977","properties":{"rationale":"Issues certificates only from approved CAs, inventories/monitors them, and revokes promptly on compromise, the direct first-order defense against compromised/counterfeit certificates.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-crypto-03-8821a347.json","sourceId":"uc:UC-CRYPTO-03","targetDetailPath":"/data/v1/records/risk-crypto-counterfeit-certificates-d9dcc5c5.json","targetId":"risk:crypto-counterfeit-certificates","type":"mitigates"}],"schemaVersion":1}