IdentityAwareProxy.json

{
    "name": "Identity Aware Proxy",
    "versions": {
        "attack": "10",
        "navigator": "4.2",
        "layer": "4.2"
    },
    "domain": "enterprise-attack",
    "description": "Identity Aware Proxy (IAP) includes a number of features that can be used to protect access to Google Cloud hosted resources and applications hosted on Google. IAP lets you establish a central authorization layer for applications accessed by HTTPS, so you can use an application-level access control model instead of relying on network-level firewalls.",
    "filters": {
        "platforms": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD",
            "AWS",
            "GCP",
            "Azure",
            "SaaS",
            "PRE",
            "Network"
        ]
    },
    "sorting": 0,
    "layout": {
        "layout": "side",
        "showID": false,
        "showName": true,
        "showAggregateScores": false,
        "countUnscored": false,
        "aggregateFunction": "average"
    },
    "hideDisabled": false,
    "techniques": [
        {
            "techniqueID": "T1550.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Protect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "This control may mitigate or prevent stolen application access tokens from occurring. "
                }
            ],
            "color": "#9CBA7F",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Protect"
        },
        {
            "techniqueID": "T1528",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Protect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "This control may mitigate application access token theft if the application is configured to retrieve temporary security credentials using an IAM role."
                },
                {
                    "divider": true
                },
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "Control can detect potentially malicious applications"
                }
            ],
            "color": "#9305ff",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Mixed"
        },
        {
            "techniqueID": "T1098.001",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Detect"
                },
                {
                    "name": "value",
                    "value": "Minimal"
                },
                {
                    "name": "comment",
                    "value": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment. IAP lets you enforce access control policies for applications and resources. This control may help mitigate against adversaries gaining access through cloud account by the configuration of access controls and firewalls, allowing limited access to systems."
                }
            ],
            "color": "#AEEEEE",
            "score_num": 10,
            "score_display": "Minimal",
            "category": "Detect"
        },
        {
            "techniqueID": "T1078",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Protect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "IAP applies the relevant IAM policy to check if the user is authorized to access the requested resource. If the user has the IAP-secured Web App User role on the Cloud console project where the resource exists, they're authorized to access the application. This control can mitigate against adversaries that try to obtain credentials of accounts, including cloud accounts."
                }
            ],
            "color": "#659D32",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Protect"
        },
        {
            "techniqueID": "T1078.004",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Protect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "Protects access to applications hosted within cloud and other premises. "
                }
            ],
            "color": "#659D32",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Protect"
        },
        {
            "techniqueID": "T1190",
            "enabled": true,
            "showSubtechniques": false,
            "metadata": [
                {
                    "name": "category",
                    "value": "Protect"
                },
                {
                    "name": "value",
                    "value": "Partial"
                },
                {
                    "name": "comment",
                    "value": "When an application or resource is protected by IAP, it can only be accessed through the proxy by principals, also known as users, who have the correct Identity and Access Management (IAM) role. IAP secures authentication and authorization of all requests to App Engine, Cloud Load Balancing (HTTPS), or internal HTTP load balancing.\n\nWith adversaries that may try to attempt malicious activity via applications, the application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application."
                }
            ],
            "color": "#659D32",
            "score_num": 50,
            "score_display": "Partial",
            "category": "Protect"
        }
    ],
    "gradient": {
        "colors": [
            "#ff6666",
            "#ffe766",
            "#8ec843"
        ],
        "minValue": 0,
        "maxValue": 100
    },
    "legendItems": [
        {
            "label": "Protect - Minimal",
            "color": "#9CBA7F"
        },
        {
            "label": "Protect - Partial",
            "color": "#659D32"
        },
        {
            "label": "Protect - Significant",
            "color": "#7FFF00"
        },
        {
            "label": "Detect - Minimal",
            "color": "#AEEEEE"
        },
        {
            "label": "Detect - Partial",
            "color": "#5F9F9F"
        },
        {
            "label": "Detect - Significant",
            "color": "#00FFFF"
        },
        {
            "label": "Respond - Minimal",
            "color": "#ff6b6b"
        },
        {
            "label": "Respond - Partial",
            "color": "#ff0505"
        },
        {
            "label": "Respond - Significant",
            "color": "#b80000"
        },
        {
            "label": "Mixed - Minimal",
            "color": "#bf6bff"
        },
        {
            "label": "Mixed - Partial",
            "color": "#9305ff"
        },
        {
            "label": "Mixed - Significant",
            "color": "#5c00a3"
        }
    ],
    "metadata": [],
    "showTacticRowBackground": false,
    "tacticRowBackground": "#dddddd",
    "selectTechniquesAcrossTactics": true,
    "selectSubtechniquesWithParent": false
}