genai-security-crosswalk 2.0.0

package/data/entries/DSGAI03.json

@@ -0,0 +1,671 @@
+{
+  "id": "DSGAI03",
+  "name": "Shadow AI and Unsanctioned Data Flows",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0012",
+      "control_name": "Obtain Capabilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Shadow AI tools are external AI capabilities the adversary may already operate or compromise"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051",
+      "control_name": "Exploit Public-Facing Application",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Unapproved AI services may themselves be adversary-controlled or compromised"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive data pasted into shadow AI tools ends up in external data stores accessible to the AI service provider"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use policy for AI tools — approved list, prohibited use cases, data handling requirements"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-3.5",
+      "control_name": "AI system impact",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Impact assessment of shadow AI on organisational data security posture — ungoverned data flows quantified"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Evaluation of shadow AI detection effectiveness — DLP coverage, endpoint monitoring"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Response procedures for detected shadow AI usage — data impact assessment, user notification"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Shadow AI usage is a foreseeable risk requiring mitigation in the risk management system",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ungoverned AI tool usage mapped and treated in Art. 9 risk assessment"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Organisations deploying AI are responsible for AI used within their operations",
+      "control_name": "Art. 25 — Value chain responsibilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Shadow AI use by employees does not exempt the deployer from AI Act obligations triggered by that use"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Deployers must use AI systems as instructed and ensure appropriate oversight",
+      "control_name": "Art. 29 — Deployer obligations",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deployers have affirmative obligations to prevent and detect shadow AI usage"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.10",
+      "control_name": "Acceptable use of assets",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy explicitly covering acceptable use of AI tools — approved list and prohibited use cases"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.23",
+      "control_name": "Security for cloud services",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Due diligence and security requirements for any cloud-based AI service including shadow AI SaaS"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP controls detecting and blocking sensitive data transfer to unapproved AI endpoints"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.1",
+      "control_name": "Policies for information security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI acceptable use policy as a formal ISMS policy document"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Policies — acceptable use",
+      "control_name": "A.2.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Use of AI systems",
+      "control_name": "A.9.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Third-party relationships",
+      "control_name": "A.10.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Context",
+      "control_name": "Cl.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 2",
+      "control_name": "2.1 — Maintain authorised software inventory",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 4",
+      "control_name": "4.1 — Establish secure configuration",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 13",
+      "control_name": "13.4 — Perform traffic filtering",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 14",
+      "control_name": "14.6 — Train workforce on AI security",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V1 Architecture",
+      "control_name": "V1.1.4 — Trust boundaries documented and enforced",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.5 — Access control failures logged",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7 Logging",
+      "control_name": "V7.2.2 — Log entries contain required information",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V14 Configuration",
+      "control_name": "V14.1.4 — All components inventoried",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Network controls block OT data flows to unapproved AI endpoints — DLP at OT DMZ boundary"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Approved AI tools only on OT workstations — unapproved services blocked at network layer"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Shadow AI discovery triggers incident response — data impact assessment, vendor notification"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data confidentiality requirements apply to training data"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assess sensitivity of OT data in training sets"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor for unexpected exfiltration of OT training data"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use policy for AI tools — approved list, prohibited use cases, data handling requirements"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AT-01",
+      "control_name": "Awareness and Training",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Users trained on shadow AI risk — policy awareness, prohibited tool use, reporting obligations"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring for use of unauthorised software — shadow AI tool usage detected on endpoints and network"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All approved AI tools managed as suppliers — TPSP assessment, contractual obligations"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Acceptable use procedures for AI tools — approved list, prohibited use cases, employee acknowledgement",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Shadow AI vendors not in vendor risk programme — shadow AI discovery identifies unapproved vendors",
+      "control_name": "CC9.1 — Vendor risk",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Shadow AI usage identified as a risk in assessment — ungoverned data flows, training use by vendors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Confidentiality policy covers AI tool use — employees informed of restrictions on sharing confidential data",
+      "control_name": "C1.1 — Confidentiality policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.1",
+      "control_name": "Third-party service providers",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Shadow AI tools processing CHD are unapproved TPSPs — not in TPSP list, no written agreements"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.5.2",
+      "control_name": "TPSP oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Shadow AI discovery as part of TPSP monitoring — identify unapproved vendors receiving CHD"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 1.3.2",
+      "control_name": "Network security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Network controls prevent CHD flows to unapproved AI endpoints — block at network layer"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.6.1",
+      "control_name": "Security awareness",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PCI security awareness programme covers shadow AI risk — staff trained on prohibition"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Acceptable use policy covers all GenAI services — unapproved use is a policy violation; AI asset register maintained"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Network-level detection of data flows to unapproved AI endpoints — DLP covering SaaS AI API calls"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Supply Chain Security (SCS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All AI services assessed before authorisation — vendor security review, data processing agreement, sub-processor disclosure"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Network",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Egress filtering to block unapproved AI service domains; proxy logging of AI API calls"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require data classification check before any dataset enters training pipeline"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Policy mandating PII/sensitive data removal before training"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated PII scanning of all training datasets before use"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-RT",
+      "control_name": "Verification / Requirements-Driven Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated tests verifying PII detection coverage"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Periodic probing of deployed models for sensitive data memorisation"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-668",
+      "control_name": "CWE-668",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/668.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L7",
+      "control_name": "Agent Ecosystem",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain (all)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Pipeline service account with access to sensitive data stores",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scope pipeline credentials to approved data sources only"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Credentials embedded in config files include sensitive data source access",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Audit config files for embedded credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — AI tool vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all AI tools, services, and plugins before organisational adoption; verify data handling, security posture, and compliance capabilities"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — shadow AI detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement controls to detect and prevent unauthorised AI tool usage that processes organisational data outside governed pipelines"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — shadow AI exposure monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish procedures to identify data exposure from shadow AI tool usage; define triage and remediation workflows for unsanctioned data processing"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — approved AI tools only",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Restrict AI tool usage to approved, vetted tools within the FedRAMP boundary; disable or block access to unauthorised AI services"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SA-9",
+      "control_name": "External Information System Services — third-party AI controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require FedRAMP authorisation or equivalent for all third-party AI services; block data transfer to unauthorised AI tools"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — AI tool access control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce access control preventing data transfer to unauthorised AI tools; monitor and block shadow AI usage"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — AI tool vendor oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include AI tools and services in third-party ICT risk management; conduct due diligence before approval; monitor ongoing compliance with financial sector requirements"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — shadow AI discovery",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Identify and register all AI tools — authorised and unauthorised — in the ICT asset inventory; maintain discovery mechanisms for unapproved AI services"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — AI tool governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define approved AI tools policy in ICT risk management framework; require vetting and approval before use in financial data processing"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Zscaler (CASB)",
+      "type": "commercial",
+      "url": "https://www.zscaler.com"
+    },
+    {
+      "name": "Microsoft Defender for Cloud Apps",
+      "type": "commercial",
+      "url": "https://www.microsoft.com/en-us/security"
+    },
+    {
+      "name": "Nightfall AI",
+      "type": "commercial",
+      "url": "https://nightfall.ai"
+    },
+    {
+      "name": "Netskope CASB",
+      "type": "commercial",
+      "url": "https://www.netskope.com"
+    },
+    {
+      "name": "OpenDLP",
+      "type": "open-source",
+      "url": "https://github.com/ezarko/opendlp"
+    },
+    {
+      "name": "Zscaler Internet Access",
+      "type": "commercial",
+      "url": "https://www.zscaler.com"
+    },
+    {
+      "name": "Zscaler (DLP)",
+      "type": "commercial",
+      "url": "https://www.zscaler.com"
+    },
+    {
+      "name": "Netskope",
+      "type": "commercial",
+      "url": "https://www.netskope.com"
+    },
+    {
+      "name": "Zscaler",
+      "type": "commercial",
+      "url": "https://www.zscaler.com"
+    },
+    {
+      "name": "Nightfall DLP",
+      "type": "commercial",
+      "url": "https://www.nightfall.ai"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Samsung employees leak source code and meeting notes via ChatGPT",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-001"
+    }
+  ],
+  "crossrefs": {
+    "dsgai_2026": [
+      "DSGAI07",
+      "DSGAI08"
+    ],
+    "llm_top10": [
+      "LLM03",
+      "LLM02",
+      "LLM05",
+      "LLM06"
+    ],
+    "agentic_top10": [
+      "ASI04",
+      "ASI10"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}