{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Logging, Monitoring & Detection","Network & Communications Security"],"inherent_rating":"medium","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-reconnaissance","description":"Because adversaries scan perimeters, sniff exposed networks, mine open-source and public information, and surveil personnel and processes, they build a detailed map of the IT environment and its weaknesses, resulting in better-targeted, more likely-to-succeed follow-on attacks.","details":{"category":"cyber_security","impact":"low","inherent_rating":"medium","likelihood":"very_high","risk_id":"cyber-reconnaissance","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:cyber-reconnaissance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acyber-reconnaissance","sourceIds":["cobit-2019","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Adversary reconnaissance and information gathering","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:27fbcdefdc01a2921c37a8984890510fb47f2656985fd473c5b19bf8470afd6b","properties":{"rationale":"Detecting and removing improperly disclosed information reduces the open-source attack surface adversaries mine during reconnaissance.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-11-abdbb946.json","sourceId":"uc:UC-LOG-11","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3183b71e7b89264ebce5205e8eaf7d00921d999ca3396bc723e43d276ef19733","properties":{"rationale":"Threat-intel-enriched correlation flags distributed scanning and traffic to known reconnaissance infrastructure.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-05-8f316c34.json","sourceId":"uc:UC-LOG-05","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3e46286a36f9c16aae646c1f3d1213f70e9d73f89964fb92865df5fc91568bba","properties":{"rationale":"Deny-by-default boundary reduces externally reachable/scannable services, shrinking the attack surface adversaries map.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-01-30bfdc5f.json","sourceId":"uc:UC-NET-01","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8b3dc8d32fb0a5fb775f0657e998c546292281ac3c06e98f1dc82074be05acbb","properties":{"rationale":"Perimeter monitoring detects active scanning/probing, catching the reconnaissance subset that generates observable network activity.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-log-04-4bc40d21.json","sourceId":"uc:UC-LOG-04","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9c85d1e72b061a3bbd6024276984478b0ea57ccba623be0691fe331022b09863","properties":{"rationale":"OPSEC denial of adversary collection plus concealment/misdirection and randomized observables directly defeat reconnaissance and information gathering.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-net-11-717b0ac9.json","sourceId":"uc:UC-NET-11","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:abf9226cdd511d30b5dcdf9023ebc5bac072b0807420c3975138b8c31f0ca33c","properties":{"rationale":"Decoy components attract and detect scanning and probing, revealing reconnaissance activity.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-10-81c56654.json","sourceId":"uc:UC-NET-10","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c41e24cb892012b34d8ff1c203f483babd8eee9ecdf89442ee0e9f7d125abc30","properties":{"rationale":"Network/perimeter protection limits the scanning and probing adversaries use to map the environment.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-bcdr-13-aa7feb8e.json","sourceId":"uc:UC-BCDR-13","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e3b4713c11b4843a4c0c6d9494552460311c3f3897ba8461879374261860e6ec","properties":{"rationale":"Prohibiting remote activation of cameras/microphones and restricting sensor data denies an adversary a surveillance/collection channel.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-12-3fbb3db4.json","sourceId":"uc:UC-NET-12","targetDetailPath":"/data/v1/records/risk-cyber-reconnaissance-3a7a6c33.json","targetId":"risk:cyber-reconnaissance","type":"mitigates"}],"schemaVersion":1}