genai-security-crosswalk 2.0.0

package/data/entries/DSGAI06.json

@@ -0,0 +1,673 @@
+{
+  "id": "DSGAI06",
+  "name": "Tool Plugin and Agent Data Exchange",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051",
+      "control_name": "Exploit Public-Facing Application",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Malicious MCP server exploits trust relationship with agent to capture context payloads"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context data flowing through tool integrations captured and transmitted to adversary"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool API acts as exfiltration channel — sensitive context content captured in tool call payloads"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party data handling policy covering all tool and plugin integrations"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-5.1",
+      "control_name": "Interdependencies",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool and plugin integrations mapped — data received, retained, and used for training"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security testing of tool API integrations — payload inspection, data minimisation validation"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-3.2",
+      "control_name": "Residual risk — third party",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Residual risk from tool providers documented, monitored, and reviewed"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Third-party tool data exchange risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool integrations assessed in Art. 9 risk management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Providers document obligations flowing to deployers; deployers verify",
+      "control_name": "Art. 25 — Value chain responsibilities",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool data exchange obligations explicitly distributed along the value chain"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "GPAI providers document all third-party integrations",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool and plugin data exchange documented in GPAI technical documentation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.19",
+      "control_name": "Supplier relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security due diligence on all tool and plugin providers receiving agent context"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.20",
+      "control_name": "Supplier agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Contractual requirements covering data minimisation, retention, and training use for tool providers"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tools receive only the minimum context required for their function — not full conversation history"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.23",
+      "control_name": "Security for cloud services",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Cloud-based tool and plugin providers assessed against A.5.23 security requirements"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Third-party — AI supply chain",
+      "control_name": "A.10.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Third-party — customer data",
+      "control_name": "A.10.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — design",
+      "control_name": "A.6.1.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 4",
+      "control_name": "4.2 — Maintain secure configuration of cloud assets",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.4 — Require password manager",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 15",
+      "control_name": "15.1 — Establish service provider management policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.1 — Access control on every request",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V9 Communication",
+      "control_name": "V9.1.1 — TLS for all connections",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V11 Business Logic",
+      "control_name": "V11.1.4 — Business logic limits on repeated actions",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.2",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All OT tool integrations assessed — security requirements in vendor contracts per 62443-2-4"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.3",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT-sensitive context minimised before tool API calls — tools receive minimum required, not full OT context"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool data exchange anomalies detected — unusual data volumes in tool calls alerted"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT data must not be disclosed without authorisation"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Assess disclosure risk for each OT data type in GenAI outputs"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor outputs for OT data disclosure patterns"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.SC-01",
+      "control_name": "Supply Chain Risk Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool and plugin providers treated as suppliers — data handling requirements in contracts"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context minimisation — tools receive minimum required payload, not full context history"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool API calls monitored — DLP on outbound tool payloads"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.AM-08",
+      "control_name": "Asset Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool integrations inventoried — data received, retained, training use, security assessment status"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Tool and plugin providers assessed in vendor risk programme — what data they receive, retain, and use",
+      "control_name": "CC9.1 — Vendor risk",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Contractual data handling obligations for tool providers — data minimisation, retention, training use restrictions",
+      "control_name": "CC9.2 — Vendor agreements",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Context minimisation for tool calls — tools receive minimum confidential data required for function",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Tool access scoped to minimum required — agent tool permissions as privileged access",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.1",
+      "control_name": "TPSP list",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool and plugin providers receiving CHD in TPSP list — even if access is indirect through agent context"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.8.3",
+      "control_name": "TPSP agreements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Written agreements with tool providers acknowledging CHD security responsibility"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context minimisation — tools receive minimum CHD-containing context required"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool call payloads containing CHD logged — Req 10 audit trail requirement"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tools, plugins, and agent connectors treated as supply chain components — security assessment before integration, ongoing monitoring"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool descriptors and API responses validated before use — content received from external tools treated as untrusted input"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tool invocations logged — data volumes, destination, and content patterns monitored for anomalies"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Supply Chain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Plugin SBOM maintained — all integration components inventoried, vulnerabilities tracked"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define what categories of data may appear in model outputs"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Apply DLP scanning to all model outputs before delivery"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated testing for memorisation and over-retrieval of sensitive content"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Continuous monitoring of production outputs for sensitive content patterns"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented policy on what data may be surfaced in model responses"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-269",
+      "control_name": "CWE-269",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/269.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-602",
+      "control_name": "CWE-602",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/602.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B009",
+      "control_name": "Validate AI-generated content",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Credentials embedded in model outputs or training data surface in responses",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Output scanning for credential patterns"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Over-broad retrieval credentials return data beyond user entitlement",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum scope for retrieval service accounts"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — lineage-aware artefact management",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Maintain end-to-end data lineage records linking every model version to its training data, transformations, and intermediate artefacts"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — traceable data pipeline architecture",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Design AI data pipelines with built-in lineage tracking; require lineage metadata capture at every transformation step as an explicit design requirement"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-3",
+      "control_name": "Configuration Change Control — pipeline lineage documentation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Maintain comprehensive data lineage documentation for all AI pipelines; update on every transformation, combination, or processing change"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — data transformation logging",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Log all data transformation events in AI pipelines; enable end-to-end lineage reconstruction from source to model"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — lineage requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include data lineage completeness in AI risk management strategy; define minimum lineage requirements per data sensitivity level"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — data transformation mapping",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Map all data transformations in AI pipelines; document inputs, outputs, and processing logic for each stage"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 12",
+      "control_name": "Backup Policies — lineage metadata preservation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include lineage metadata in backup policies; ensure lineage records can be restored alongside data and models"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — lineage governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include data lineage requirements in ICT risk management; define minimum lineage completeness per data sensitivity"
+    }
+  ],
+  "tools": [
+    {
+      "name": "MCP Inspector",
+      "type": "open-source",
+      "url": "https://github.com/modelcontextprotocol/inspector"
+    },
+    {
+      "name": "Nightfall AI",
+      "type": "commercial",
+      "url": "https://nightfall.ai"
+    },
+    {
+      "name": "OWASP Dependency-Check",
+      "type": "open-source",
+      "url": "https://github.com/jeremylong/DependencyCheck"
+    },
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://github.com/returntocorp/semgrep"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "NeMo Guardrails",
+      "type": "open-source",
+      "url": "https://github.com/NVIDIA/NeMo-Guardrails"
+    },
+    {
+      "name": "OpenLineage",
+      "type": "open-source",
+      "url": "https://openlineage.io"
+    },
+    {
+      "name": "Marquez",
+      "type": "open-source",
+      "url": "https://marquezproject.ai"
+    },
+    {
+      "name": "MLflow",
+      "type": "open-source",
+      "url": "https://mlflow.org"
+    },
+    {
+      "name": "DataHub",
+      "type": "open-source",
+      "url": "https://datahubproject.io"
+    },
+    {
+      "name": "Apache Atlas",
+      "type": "open-source",
+      "url": "https://atlas.apache.org"
+    },
+    {
+      "name": "dbt",
+      "type": "open-source",
+      "url": "https://www.getdbt.com"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Uber ML platform data lineage audit — fragmented provenance across 30+ feature stores",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-042"
+    }
+  ],
+  "crossrefs": {
+    "agentic_top10": [
+      "ASI02",
+      "ASI04",
+      "ASI07",
+      "ASI06"
+    ],
+    "llm_top10": [
+      "LLM06",
+      "LLM03",
+      "LLM05",
+      "LLM02"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}