genai-security-crosswalk 2.0.0

package/data/entries/DSGAI05.json

@@ -0,0 +1,689 @@
+{
+  "id": "DSGAI05",
+  "name": "Data Integrity and Validation Failures",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0020",
+      "control_name": "Poison Training Data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Adversarially crafted payloads bypass ingestion validation to corrupt training or RAG data"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0018",
+      "control_name": "Backdoor ML Model",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Path traversal in snapshot imports (CVE-2024-3584) enables write to model host — backdoor installation path"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0031",
+      "control_name": "Craft Adversarial Data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Payloads crafted to pass syntactic validation while embedding malicious semantic content"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Security testing of all data ingestion interfaces — schema bypass and path traversal scenarios"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-3.3",
+      "control_name": "Data quality",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Data quality controls applied at ingestion — syntactic and semantic validation"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Response procedures for detected ingestion integrity failures"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Ingestion integrity risks mapped to specific pipeline components in risk register"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Ingestion integrity risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data ingestion attack surfaces included in Art. 9 risk management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI resilient against adversarial input manipulation",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure ingestion interfaces and path traversal prevention are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documented procedures for data ingestion and pipeline integrity",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ingestion validation procedures and CVE patching documented in quality management"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.26",
+      "control_name": "Application security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Input validation requirements specified for all GenAI data ingestion interfaces"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Secure coding practices applied to data ingestion, parsing, and snapshot import code"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Security testing of all data ingestion interfaces including schema and semantic validation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.9",
+      "control_name": "Configuration management",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Snapshot import and restore functionality hardened and version controlled"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — preparation",
+      "control_name": "A.7.3",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — operational",
+      "control_name": "A.6.2.3",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Operation",
+      "control_name": "Cl.8",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.1 — Establish secure coding practices",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 8",
+      "control_name": "8.5 — Collect detailed audit logs",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.1.1 — Input validation using allowlists",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.2.1 — HTML/JS output sanitised",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7 Logging",
+      "control_name": "V7.4.1 — Generic error messages",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Multi-stage validation at all GenAI ingestion boundaries — path traversal prevention mandatory in Zone 3"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Runtime monitoring of ingestion pipelines — anomalous payloads detected and rejected"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.6",
+      "control_name": "Use control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Only approved, validated data sources permitted in Zone 3 GenAI ingestion — unapproved sources blocked"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ingestion integrity failure treated as security event — pipeline suspended, forensic capture"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities",
+      "control_name": "§5.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Safety system bypass in OT"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Guardrail bypass must be in OT risk register"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Secure architecture",
+      "control_name": "§7.1",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "GenAI guardrails must be independent of model inference layer"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-04",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure software development — multi-stage validation, path traversal prevention in ingestion code"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data at rest integrity — snapshot import operations sandboxed, path traversal blocked"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring for anomalous data — unusual ingestion patterns, schema violations detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Ingestion interface vulnerabilities documented in risk assessment — CVE-2024-3584 class"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Ingestion validation controls — schema and semantic validation ensuring only accurate inputs enter processing",
+      "control_name": "PI1.2 — System inputs complete and accurate",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Documented ingestion validation procedures — multi-stage validation, path traversal prevention",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Ingestion anomaly detection — unusual payloads detected before pipeline completion",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Ingestion integrity risks in GenAI risk assessment — schema bypass, path traversal, adversarial payload vectors",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.2.4",
+      "control_name": "Bespoke software — injection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All injection vulnerability classes addressed in GenAI ingestion code — schema bypass and path traversal"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.3.3",
+      "control_name": "Vulnerability management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All GenAI software components patched — CVE-2024-3584 class treated as urgent for CDE scope"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Path traversal and ingestion injection in CDE penetration testing scope"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.5",
+      "control_name": "Secure system changes",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Changes to GenAI ingestion pipelines tested — schema validation changes require security review"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All data entering GenAI pipelines validated — schema checks, anomaly detection, and quality gates before model ingestion or RAG indexing"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM and embedding inputs validated for format, length, and content — AI system integrity requirements extend to data pipeline boundaries"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Continuous monitoring of data pipeline quality metrics — alerts on schema violations, unexpected distributions, or sudden quality drops"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Secure Development",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data validation implemented as a secure development requirement for all GenAI pipeline ingestion points"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Guardrails at multiple layers: input, generation, output"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Dedicated adversarial testing programme targeting all guardrail bypass vectors"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Alert on disabled or bypassed guardrails in production"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Guardrail effectiveness metrics reviewed by security leadership"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Pre-deployment review of all guardrail bypass scenarios"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-20",
+      "control_name": "CWE-20",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/20.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-116",
+      "control_name": "CWE-116",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/116.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-74",
+      "control_name": "CWE-74",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/74.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B005",
+      "control_name": "Implement real-time input filtering",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "C",
+      "control_name": "Safety domain (harm prevention)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Service account with guardrail configuration write access",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Minimum scope; no service account has guardrail disable capability"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.2.1-PS",
+      "control_name": "Verify software integrity — data provenance verification",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Verify provenance and integrity of all datasets used in training, fine-tuning, and evaluation; maintain cryptographic attestation of data origin and chain of custody"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — data versioning with provenance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain versioned dataset snapshots with provenance metadata recording origin, collection method, processing steps, and quality metrics"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.4.1-PS",
+      "control_name": "Reuse existing well-secured software — dataset quality vetting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vet all datasets for quality, completeness, representativeness, and fitness for purpose before use in any training or evaluation pipeline"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SR-3",
+      "control_name": "Supply Chain Controls — data provenance tracking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement provenance tracking for all AI training data; document source, collection method, processing history, and licensing for each dataset"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-10",
+      "control_name": "Information Input Validation — data quality controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Validate quality, completeness, and accuracy of data entering AI pipelines; reject data failing quality thresholds"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-3",
+      "control_name": "Configuration Change Control — data source changes",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Require formal change control for all data source additions, modifications, and removals; maintain audit trail"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — data source documentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Document provenance, collection method, and quality characteristics for all AI training data in the ICT asset inventory"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — data quality controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement data quality validation before AI pipeline ingestion; reject data failing quality or provenance thresholds"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — external data source oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include external data sources in third-party risk management; assess data quality, provenance practices, and licensing compliance"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Great Expectations",
+      "type": "open-source",
+      "url": "https://greatexpectations.io"
+    },
+    {
+      "name": "Pandera",
+      "type": "open-source",
+      "url": "https://pandera.readthedocs.io"
+    },
+    {
+      "name": "OWASP ZAP",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "OWASP ZAP (API fuzzing)",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://semgrep.dev"
+    },
+    {
+      "name": "Cerberus",
+      "type": "open-source",
+      "url": "https://github.com/pyeve/cerberus"
+    },
+    {
+      "name": "DVC (Data Version Control)",
+      "type": "open-source",
+      "url": "https://dvc.org"
+    },
+    {
+      "name": "Apache Atlas",
+      "type": "open-source",
+      "url": "https://atlas.apache.org"
+    },
+    {
+      "name": "Pachyderm",
+      "type": "open-source",
+      "url": "https://www.pachyderm.com"
+    },
+    {
+      "name": "OpenLineage",
+      "type": "open-source",
+      "url": "https://openlineage.io"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    },
+    {
+      "name": "WhyLogs",
+      "url": "https://github.com/whylabs/whylogs",
+      "type": "open-source"
+    },
+    {
+      "name": "MLflow",
+      "url": "https://github.com/mlflow/mlflow",
+      "type": "open-source"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Meta Galactica model withdrawn after misinformation at launch",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2022,
+      "incident_id": "INC-031"
+    },
+    {
+      "name": "Hugging Face model card supply chain manipulation",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-038"
+    },
+    {
+      "name": "NYT v OpenAI — copyright training data ruling implications",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-039"
+    },
+    {
+      "name": "Uber ML platform data lineage audit — fragmented provenance across 30+ feature stores",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-042"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM05",
+      "LLM04",
+      "LLM01",
+      "LLM03"
+    ],
+    "dsgai_2026": [
+      "DSGAI13",
+      "DSGAI04"
+    ],
+    "agentic_top10": [
+      "ASI02",
+      "ASI08",
+      "ASI04",
+      "ASI06"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}