{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Network & Communications Security","Access Control & Identity Management"],"inherent_rating":"medium","taxonomy":["nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Anet-session-hijacking","description":"Adversary hijacks established legitimate sessions (externally or internally based) and conducts attacks/exfiltration using unauthorized ports, protocols, and permitted information flows across the perimeter.","details":{"category":"cyber_security","impact":"high","inherent_rating":"medium","likelihood":"medium","risk_id":"net-session-hijacking","taxonomies":["nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:net-session-hijacking","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Anet-session-hijacking","sourceIds":["iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Session hijacking and unauthorized-protocol egress","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:11afed6ff3a04605fedc03979f7728595f8a27c1260f33594854cc2fc8ee6a6f","properties":{"rationale":"Enforcing authorized flow directions/types at cross-domain interconnections constrains the permitted flows abused for egress.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-net-14-bacae152.json","sourceId":"uc:UC-NET-14","targetDetailPath":"/data/v1/records/risk-net-session-hijacking-434ddd0c.json","targetId":"risk:net-session-hijacking","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31b4f0d75b70d4f10a48567f6a5f4649166edb266cf0c28fd5e2e5f8d3d338b6","properties":{"rationale":"Deny-by-default egress control and monitoring of communications crossing the boundary block exfiltration over unauthorized ports/protocols named in the risk.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-net-01-30bfdc5f.json","sourceId":"uc:UC-NET-01","targetDetailPath":"/data/v1/records/risk-net-session-hijacking-434ddd0c.json","targetId":"risk:net-session-hijacking","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:97979f542865a8450a21cfbc3a41b77acd617ad5ea8619189e3fad0c9d09ffd4","properties":{"rationale":"Inactivity termination, concurrent-session limits, and re-authentication for sensitive operations directly shrink the window and impact of hijacked sessions.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-12-8ef9e477.json","sourceId":"uc:UC-ACCESS-12","targetDetailPath":"/data/v1/records/risk-net-session-hijacking-434ddd0c.json","targetId":"risk:net-session-hijacking","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bc8ea202106a924ddb3a875e605bb3d30f1dadb05a4863351a30bc2825213f92","properties":{"rationale":"Protecting session authenticity/integrity against hijacking, insertion, and replay and terminating idle sessions is the operative session-hijacking defense.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-net-03-3b26b0a0.json","sourceId":"uc:UC-NET-03","targetDetailPath":"/data/v1/records/risk-net-session-hijacking-434ddd0c.json","targetId":"risk:net-session-hijacking","type":"mitigates"}],"schemaVersion":1}