genai-security-crosswalk 2.0.0

package/data/entries/DSGAI09.json

@@ -0,0 +1,687 @@
+{
+  "id": "DSGAI09",
+  "name": "Multimodal Cross-Channel Leakage",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sensitive content extracted from multimodal inputs (OCR, transcription) transmitted through standard exfiltration paths"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal content processed by AI system extracted through inference API queries referencing extracted content"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0024.000",
+      "control_name": "Membership Inference",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Sensitive multimodal content in training data confirmed through membership inference queries"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal data governance policy — classification propagation from source modality to all extracted forms"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal leakage risks mapped per modality — image, audio, video, document — in risk register"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data leakage testing extended to multimodal pipelines — OCR output, transcripts, derived embeddings"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Incident response for multimodal data leakage — content identification, deletion, regulatory notification"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Data governance covers all input modalities — images, audio, video — not only text",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal input governance is an Art. 10 requirement for high-risk systems processing such inputs"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures covering all data channels including multimodal inputs",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "DLP and access controls on multimodal pipelines are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Technical documentation covers all input modalities processed by the model",
+      "control_name": "Art. 53(1)(a) — GPAI documentation",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal data governance documented in GPAI technical documentation"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Masking and redaction applied to extracted text from OCR and audio transcription — same as source"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "DLP applied to all modality-extracted content — text, OCR output, transcripts"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Classification of multimodal inputs must propagate to all derived extracted content"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Encryption of multimodal uploads and all derived content at rest and in transit"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — operational",
+      "control_name": "A.6.2.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Impact assessment",
+      "control_name": "A.5.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Operation",
+      "control_name": "Cl.8",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.13 — Deploy DLP solutions",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 13",
+      "control_name": "13.1 — Centralise security event alerting",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.12 — Implement code-level security checks",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.2.5 — Unstructured data sanitised",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.1.4 — Sensitive data minimised",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V12 Files/Resources",
+      "control_name": "V12.1.3 — Malicious file detection on upload",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Extracted OT content from multimodal inputs classified and protected — OCR output of P&ID is as sensitive as the P&ID"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Multimodal extraction pipelines validated — no uncontrolled OT data entering unclassified processing"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.6",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Multimodal OT data leakage treated as security event"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "ICS vulnerabilities — data integrity",
+      "control_name": "§5.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Corpus manipulation directly threatens OT operational integrity"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "OT corpus manipulation must be in risk register as critical scenario"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Security controls",
+      "control_name": "§7.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Write authentication on all OT corpus stores"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Extracted content from multimodal inputs protected — OCR output of sensitive document classified and protected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-02",
+      "control_name": "Data Security",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Extracted sensitive content encrypted in transit — multimodal extraction pipelines covered"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal extraction output monitored — DLP on OCR results, transcription outputs"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.AM-08",
+      "control_name": "Asset Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal processing pipelines inventoried — what modalities are processed, what is extracted and stored"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Multimodal derived content (OCR output, transcripts) protected at same level as source uploads",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information extracted from multimodal inputs subject to same use restrictions as source data",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls on multimodal content stores — same rigour as equivalent text data stores",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "DLP monitoring on multimodal extraction pipelines — PII in OCR output and transcripts detected",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "PAN rendering",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "PANs extracted from multimodal content masked in all outputs — OCR-extracted PANs are CHD requiring Req 3 treatment"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored CHD",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All CHD extracted from multimodal inputs encrypted at rest — OCR output of a payment document is CHD"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 4.2.1",
+      "control_name": "Encryption in transit",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Multimodal extraction pipelines encrypted in transit where CHD is in scope"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All PAN access through multimodal pipelines logged"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Data classification and handling requirements apply equally across all modalities — images, audio, video, and documents governed as GenAI assets"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Monitoring and Detection (MON)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "DLP and monitoring extended to cover all output modalities — AI-specific monitoring for sensitive content in generated images, audio, or documents"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "AI risk assessment explicitly covers multimodal data flows — blind spots between modality types documented and controlled"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Encryption and access control applied uniformly across all modalities stored or processed by GenAI systems"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Enumerate all write paths to the corpus and attack scenarios for each"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Authenticate and verify all corpus writes; hash embeddings at ingest"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Attempt to inject manipulated documents; verify detection"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-IM",
+      "control_name": "Operations / Incident Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Alert on unexpected corpus changes or embedding distribution shifts"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "All corpus changes go through a review and approval process"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-201",
+      "control_name": "CWE-201",
+      "tier": "Hardening",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/201.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Hardening",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B001",
+      "control_name": "Third-party adversarial robustness testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B002",
+      "control_name": "Detect adversarial input",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Corpus write access held by service accounts that do not need it",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Separate read and write credentials; write accounts require MFA"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Corpus write credentials in plaintext config",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Vault all corpus write credentials"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived corpus write credentials persist beyond need",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rotate corpus write credentials; implement short-lived write pattern"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — IP protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Protect model weights, architecture specifications, training data, and proprietary algorithms from unauthorised access; implement defence against model extraction attacks"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.3.1-PS",
+      "control_name": "Archive and protect software releases — IP asset management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Maintain access-controlled, versioned registries for all IP-sensitive AI artefacts; enforce need-to-know access and log all access events"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SC-28",
+      "control_name": "Protection of Information at Rest — IP encryption",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encrypt all intellectual property — model weights, proprietary training data, algorithms — at rest with FIPS 140-validated modules"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — IP access control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce strict access control on AI intellectual property; restrict to minimum necessary personnel with audit trail"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-12",
+      "control_name": "Audit Generation — IP access tracking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Generate audit records for all access to AI intellectual property; enable detection of unauthorised access and exfiltration"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — IP protection controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement security controls protecting AI intellectual property — encryption, access controls, and DLP for model weights, training data, and proprietary algorithms"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — IP protection in vendor relationships",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Address IP protection in third-party agreements; ensure vendors cannot access, replicate, or misuse proprietary AI assets"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — IP exfiltration detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Deploy detection for IP exfiltration attempts; monitor model weight access and download patterns"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Microsoft Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "AWS Macie",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/macie/"
+    },
+    {
+      "name": "Google Cloud DLP",
+      "type": "commercial",
+      "url": "https://cloud.google.com/dlp"
+    },
+    {
+      "name": "AWS Rekognition",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/rekognition/"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Azure AI Content Safety",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety"
+    },
+    {
+      "name": "ModelScan",
+      "type": "open-source",
+      "url": "https://github.com/protectai/modelscan"
+    },
+    {
+      "name": "Sigstore",
+      "type": "open-source",
+      "url": "https://www.sigstore.dev"
+    },
+    {
+      "name": "AWS Nitro Enclaves",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/ec2/nitro/nitro-enclaves/"
+    },
+    {
+      "name": "Azure Confidential Computing",
+      "type": "commercial",
+      "url": "https://azure.microsoft.com/en-us/solutions/confidential-compute/"
+    },
+    {
+      "name": "HashiCorp Vault",
+      "type": "commercial",
+      "url": "https://www.vaultproject.io"
+    },
+    {
+      "name": "Nightfall DLP",
+      "type": "commercial",
+      "url": "https://www.nightfall.ai"
+    },
+    {
+      "name": "AWS KMS / Azure Key Vault",
+      "type": "commercial",
+      "url": "https://aws.amazon.com/kms/"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Multimodal indirect injection — image-embedded instructions in GPT-4V",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-015"
+    },
+    {
+      "name": "AI voice deepfake CEO fraud — Hong Kong $25M loss",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-026"
+    },
+    {
+      "name": "Clearview AI biometric bias — $50M class action settlement",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-036"
+    },
+    {
+      "name": "NYT v OpenAI — copyright training data ruling implications",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-039"
+    }
+  ],
+  "crossrefs": {
+    "dsgai_2026": [
+      "DSGAI01",
+      "DSGAI14"
+    ],
+    "llm_top10": [
+      "LLM02",
+      "LLM04",
+      "LLM08",
+      "LLM03",
+      "LLM05"
+    ],
+    "agentic_top10": [
+      "ASI03",
+      "ASI04"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}