genai-security-crosswalk 2.0.0

package/data/entries/DSGAI12.json

@@ -0,0 +1,695 @@
+{
+  "id": "DSGAI12",
+  "name": "Unsafe Natural Language Data Gateways",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "Critical",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051",
+      "control_name": "Exploit Public-Facing Application",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway interface exploited through crafted natural language to generate destructive or exfiltrating queries"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Database accessed through LLM-generated queries — adversary extracts sensitive records without direct database access"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM inference API used to generate queries that extract data from connected databases"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "LLM-to-database interface risks mapped — privilege level, query scope, and data exposure per interface"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "SQL injection, privilege escalation, and bulk extraction testing on all LLM gateway interfaces"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Incident response for LLM gateway misuse — query log forensics, data exposure scoping"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.7",
+      "control_name": "Policies for trustworthy AI",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Policy requiring least-privilege execution and read-only defaults for all LLM-to-database interfaces"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "LLM gateway risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM-to-database interfaces mapped in Art. 9 risk management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI designed to allow effective human oversight — ability to pause, stop, and override",
+      "control_name": "Art. 14 — Human oversight",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated destructive database queries executing autonomously are an Art. 14 human oversight failure"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity measures protecting against adversarial misuse",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Least-privilege execution, query allowlisting, and SQL injection prevention are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Documented procedures for LLM gateway security",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Security testing procedures and query log retention documented in quality management"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.26",
+      "control_name": "Application security requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Security requirements for LLM-to-SQL interfaces — read-only by default, parameterisation mandatory"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "LLM-generated queries execute under least-privilege credentials matching the requesting user's access"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.28",
+      "control_name": "Secure coding",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Parameterised queries, allowlisted operations, and row-level policy enforcement in LLM gateway code"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.29",
+      "control_name": "Security testing",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "SQL injection and privilege escalation testing on all LLM-to-database interfaces"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — operational",
+      "control_name": "A.6.2.3",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — access control",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Use of AI systems",
+      "control_name": "A.9.1",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.2 — Establish secure configuration for software",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.3 — Require password manager for service accounts",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 18",
+      "control_name": "18.1 — Establish penetration testing programme",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.1.1 — Allowlist input validation",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V5 Validation",
+      "control_name": "V5.3.4 — SQL injection prevention",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.1 — Access control on every request",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V13 API",
+      "control_name": "V13.1.1 — API protection against enumeration",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway executes under requesting operator's permissions — never shared high-privilege OT service account"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.1",
+      "control_name": "Use control enforcement",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway query allowlisting — only pre-approved query patterns permitted to OT data systems"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.3",
+      "control_name": "Software and information integrity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway input validation — injection addressed as a known vulnerability class in Zone 3"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 6.1",
+      "control_name": "Timely response to events",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway misuse treated as Critical security event — query log forensics, data exposure scope"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "OT knowledge encoded in models requires protection"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction as OT intelligence gathering vector"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitor for systematic extraction query patterns"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated queries execute under requesting user's permissions — not shared high-privilege service account"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-04",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Secure development — query allowlisting, parameterised execution as platform security requirements"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM-generated queries to data systems logged and monitored — bulk extraction patterns detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway interfaces documented in risk assessment — privilege level, query scope, data categories accessible"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM-generated queries execute under requesting user's permissions — least privilege, no shared high-privilege accounts",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Policy requiring LLM-generated queries to be validated before execution — only authorised processing permitted",
+      "control_name": "PI1.1 — Processing integrity policy",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM-generated query results validated — destructive or over-broad queries blocked before execution",
+      "control_name": "PI1.3 — Outputs complete and accurate",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "LLM-generated query anomaly monitoring — bulk extraction, unusual patterns, out-of-scope queries alerted",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Query allowlisting and human confirmation procedures documented",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-generated queries execute under requesting user's CDE permissions — never shared high-privilege account"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.2.4",
+      "control_name": "Bespoke software",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-to-SQL interfaces address injection as a known vulnerability class — query allowlisting, parameterised execution"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.4.1",
+      "control_name": "Public-facing application protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "LLM-powered query interfaces in CDE scope protected — WAF or equivalent, input validation"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All LLM-generated queries to CDE systems logged — full audit trail with user identity"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All NL gateway inputs validated and query scope enforced — generated queries reviewed before execution as AI system integrity requirement"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All NL gateway queries logged — anomaly detection for unexpected data volumes, query patterns, or access scope"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data access through NL gateways governed by the same classification and authorisation controls as direct API access"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "NL gateway operates under database least-privilege credentials — cannot execute DDL, cannot access tables outside defined scope"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-TA",
+      "control_name": "Design / Threat Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model extraction attack surface: API rate limits, confidence scores, output verbosity"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Attempt model extraction via systematic querying; verify detection and rate limiting"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Alert on systematic query patterns consistent with extraction attempts"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Minimise logit exposure, confidence scores, and internal state leakage"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-89",
+      "control_name": "CWE-89",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/89.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-20",
+      "control_name": "CWE-20",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/20.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "D",
+      "control_name": "Reliability domain",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "API credentials with high quota enabling systematic extraction",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Per-user quotas; minimum default quota"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Long-lived inference API credentials enable sustained extraction campaigns",
+      "control_name": "NHI-7 Long-Lived Credentials",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Rotate API credentials; implement per-session tokens"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — data ownership and rights management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define security requirements that establish clear data ownership, licensing terms, and permitted use for all datasets in AI pipelines"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PS.1.1-PS",
+      "control_name": "Protect all code from unauthorised access — ownership-based access controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement access controls that enforce data ownership boundaries; prevent use of datasets outside their licensed scope or ownership agreement"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — ownership governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, outputs, and derived insights"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — ownership-based access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce access controls aligned with data ownership; restrict usage based on ownership rights and licence terms"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — usage tracking",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log data usage for ownership compliance; track how data is used across AI systems for licence and rights management"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — ownership governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define data ownership policies for AI data; clarify rights and responsibilities for training data, model outputs, and derived financial insights"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 28–44",
+      "control_name": "Third-Party Risk — data rights management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Address data ownership and usage rights in third-party agreements; clarify ownership of AI outputs and derived data produced using vendor models"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — ownership mapping",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Map ownership for all AI data assets; document rights, restrictions, and licensing for training data and outputs"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Semgrep",
+      "type": "open-source",
+      "url": "https://semgrep.dev"
+    },
+    {
+      "name": "OWASP ZAP",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "Immuta",
+      "type": "commercial",
+      "url": "https://www.immuta.com"
+    },
+    {
+      "name": "Rebuff",
+      "type": "open-source",
+      "url": "https://github.com/protectai/rebuff"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "SQLFluff",
+      "type": "open-source",
+      "url": "https://github.com/sqlfluff/sqlfluff"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    },
+    {
+      "name": "Alation",
+      "type": "commercial",
+      "url": "https://www.alation.com"
+    },
+    {
+      "name": "Apache Atlas",
+      "type": "open-source",
+      "url": "https://atlas.apache.org"
+    },
+    {
+      "name": "CycloneDX",
+      "type": "open-source",
+      "url": "https://cyclonedx.org"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "OneTrust",
+      "type": "commercial",
+      "url": "https://www.onetrust.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "NYT v OpenAI — copyright training data ruling implications",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-039"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM05",
+      "LLM01",
+      "LLM02",
+      "LLM03",
+      "LLM09"
+    ],
+    "agentic_top10": [
+      "ASI02",
+      "ASI05",
+      "ASI01",
+      "ASI04",
+      "ASI09"
+    ],
+    "dsgai_2026": [
+      "DSGAI14"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}