CloudKeyManagement.yaml

version: 1
ATT&CK version: 10
creation date: 02/25/2022
name: Cloud Key Management
contact: ctid@mitre-engenuity.org
organization: Center for Threat Informed Defense (CTID)
platform: GCP
tags:
  - Credentials
description: >-
  A cloud-hosted key management service that allows a user manage symmetric and asymmetric
  cryptographic keys for cloud services the same way one does on-premises. It also manages
  encryption keys on Google cloud.
techniques:
  - id: T1552
    name: Unsecured Credentials
    technique-scores:
      - category: Protect
        value: Minimal
  - id: T1552.005
    name: Cloud Instance Metadata API
    technique-scores:
      - category: Protect
        value: Significant
        comments: ' This control''s protection is specific to a minority of this technique''s sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal.'
  - id: T1588
    name: Obtain Capabilities
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control manages symmetric and asymmetric cryptographic keys for cloud services and
          protects against stealing credentials, certificates, keys from the organization.
  - id: T1553
    name: Subvert Trust Controls
    technique-scores:
      - category: Protect
        value: Significant
        comments: Protects against trust mechanisms and stealing of code signing certificates
  - id: T1555
    name: Credentials from Password Stores
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control manages symmetric and asymmetric cryptographic keys for cloud services and
          protects against stealing credentials, certificates, keys from the organization.
  - id: T1528
    name: Steal Application Access Token
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          Provides protection against attackers stealing application access tokens if they are
          stored within Cloud KMS.
  - id: T1588.003
    name: Code Signing Certificates
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control manages symmetric and asymmetric cryptographic keys for cloud services and
          protects against stealing credentials, certificates, keys from the organization.
  - id: T1588.004
    name: Digital Certificates
    technique-scores:
      - category: Protect
        value: Partial
        comments: >-
          This control manages symmetric and asymmetric cryptographic keys for cloud services and
          protects against stealing credentials, certificates, keys from the organization.
  - id: T1552.001
    name: Credentials In Files
    technique-scores:
      - category: Protect
        value: Minimal
        comments: >-
          This control's protection is specific to a minority of this technique's sub-techniques and
          procedure examples resulting in a Minimal Coverage score and consequently an overall score
          of Minimal.
  - id: T1552.004
    name: Private Keys
    technique-scores:
      - category: Protect
        value: Minimal
        comments: ' This control''s protection is specific to a minority of this technique''s sub-techniques and procedure examples resulting in a Minimal Coverage score and consequently an overall score of Minimal.'
comments: 'Similar to AWS Key Management Service, AWS Cloud HSM, and Azure KeyVault.'
references:
  - 'https://cloud.google.com/security-key-management'