{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Incident Management & Response","Network & Communications Security"],"inherent_rating":"high","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-coordinated-campaign","description":"Adversary coordinates continuous, adaptive, multi-staged campaigns (hopping across systems, combining insider/outsider/supply-chain vectors, spreading from existing presence) to persist and progressively undermine mission/business functions.","details":{"category":"cyber_security","impact":"critical","inherent_rating":"high","likelihood":"medium","risk_id":"cyber-coordinated-campaign","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:cyber-coordinated-campaign","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-coordinated-campaign","sourceIds":["aiuc-1","cobit-2019","iso-27001","nist-800-53","nist-ai-agent-identity","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Coordinated multi-stage / APT campaigns","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:19af8d390c683ffcb3d00e55c317843f13efad665104555c71a75a09a6ecda8a","properties":{"rationale":"Gating recovery on confirmed eradication and forensic preservation before restoration prevents re-compromise by a persistent adversary during return to production.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-09-6caefe96.json","sourceId":"uc:UC-IR-09","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:38173739b599c45e79e6a42539344dc60fdd459595320bbd50b2202a8f20fe8a","properties":{"rationale":"Hardware/software-enforced separation of critical security functions resists implant persistence and tampering during a campaign.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-06-f006626f.json","sourceId":"uc:UC-NET-06","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4047da6470cf29342248d3b7ba589cfb2a1618ee80f92230df74801cb3e633b2","properties":{"rationale":"Endpoint/network protection plus security monitoring block malware and lateral movement across multi-stage campaigns.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-13-aa7feb8e.json","sourceId":"uc:UC-BCDR-13","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55409d00ae2ca068bd2082a7df6baef0eb46372e4e19254a95e598cb654ab197","properties":{"rationale":"Internal segmentation with deny-by-default limits an intruder's lateral hopping between systems, containing campaign spread.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-01-30bfdc5f.json","sourceId":"uc:UC-NET-01","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:555c305b867382f6e047236ce939a617dc892557ae2f1ac3b7fedf661df555ed","properties":{"rationale":"Isolating functions and partitioning domains limits an adversary's lateral movement and progression across systems.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-04-d99d6d16.json","sourceId":"uc:UC-NET-04","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5bb59e4c98b691c719678138493071e201727982d39ba0f8b36d1fb55054662c","properties":{"rationale":"Estimating the scope of affected systems (DE.AE-04) reveals the spread and extent of a multi-stage campaign to inform containment.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","sourceId":"uc:UC-IR-05","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7224cf4c9eebce6b4b910f2a958b9083a933dd59078e90805ca1b81c2747aadc","properties":{"rationale":"Containment stops lateral movement/spread and eradication removes artifacts and closes exploited weaknesses — the direct defense against a persisting multi-stage campaign (RS.MI-01/02).","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","sourceId":"uc:UC-IR-06","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:97cd5cbbbc55b1553e712071e30149a44148e4e1ac171f8195b56904e01bae81","properties":{"rationale":"Monitoring provider activity against contractual obligations detects the supply-chain vector campaigns exploit to enter.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-09-54136146.json","sourceId":"uc:UC-LOG-09","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:addce231f3d916e566dba07dd45ef3b05099e207cc115ee9a5654265ff810e91","properties":{"rationale":"Central correlation across multiple sources enriched with threat intel connects dispersed signals to detect multi-stage APT campaigns.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-05-8f316c34.json","sourceId":"uc:UC-LOG-05","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c568c95ea582b081732f38851e7e052712cb91243d94998bb9f1d6eafac70730","properties":{"rationale":"Root-cause analysis establishes the full extent and method of a multi-stage intrusion so eradication can be made complete.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","sourceId":"uc:UC-IR-07","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d11ffe0ac5bfc702e0a30dddda5b08268f3392e543773abf1e7e108ee8742c83","properties":{"rationale":"Perimeter-and-interior monitoring for IOCs and anomalous behavior detects lateral movement and persistence of multi-stage campaigns.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-log-04-4bc40d21.json","sourceId":"uc:UC-LOG-04","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e831b8a5d7d217ed1bfa299b37207847c718595e688084ec797d5acf0f2bca14","properties":{"rationale":"Immutable log storage and tamper alerts counter the anti-forensic log-deletion tactic APT campaigns use to hide persistence.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-03-68ab930e.json","sourceId":"uc:UC-LOG-03","targetDetailPath":"/data/v1/records/risk-cyber-coordinated-campaign-b5879769.json","targetId":"risk:cyber-coordinated-campaign","type":"mitigates"}],"schemaVersion":1}