genai-security-crosswalk 2.0.0

package/data/entries/DSGAI13.json

@@ -0,0 +1,688 @@
+{
+  "id": "DSGAI13",
+  "name": "Vector Store Platform Security",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store content exfiltrated through unauthenticated access or RBAC bypass"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Embeddings and retrieved passages extracted through vector store query API"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0020",
+      "control_name": "Poison Training Data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store content poisoned through path traversal or unauthenticated write (CVE-2024-3584)"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store risks mapped — each deployment assessed for RBAC, encryption, and network exposure"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store security testing — RBAC bypass, path traversal, unauthenticated access scenarios"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-3.3",
+      "control_name": "Data quality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data integrity controls applied to vector store ingestion and query operations"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Incident response for vector store compromise — containment, data exposure scoping, index rebuild"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Vector store security risks identified and mitigated",
+      "control_name": "Art. 9 — Risk management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All vector store deployments assessed in Art. 9 risk management"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "High-risk AI infrastructure protected against cybersecurity risks",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RBAC, encryption, and CVE patching for vector stores are Art. 15 requirements"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering AI infrastructure components",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store security monitoring in post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RBAC enforced on all vector store collections — collection-level and namespace-level access control"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.24",
+      "control_name": "Use of cryptography",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Encryption of all vector store data at rest and in transit"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Audit logging on all vector store read, write, and admin operations"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "DLP controls on vector store query results — sensitive content in retrieved passages detected"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — acquisition",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — preparation",
+      "control_name": "A.7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — design",
+      "control_name": "A.6.1.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Third-party",
+      "control_name": "A.10.1",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.11 — Encrypt sensitive data at rest",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.1 — Establish access control inventory",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.7 — Use standard-security components",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.3 — Deny by default",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V6 Cryptography",
+      "control_name": "V6.1.1 — Sensitive data not stored in cleartext",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V12 Files/Resources",
+      "control_name": "V12.1.1 — File upload validation",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Human user authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RBAC on all Zone 3 vector stores — no unauthenticated access in any OT environment"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Zone 3 vector store content encrypted — equipment documentation and procedure embeddings as sensitive OT data"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 3.7",
+      "control_name": "Software and information integrity monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store integrity monitoring — anomalous access patterns indicating bulk extraction detected"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risks",
+      "control_name": "§5.5",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Third-party OT tool data leakage"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Supply chain risk management",
+      "control_name": "§6.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Tool data scope in OT security assessment"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor OT tool data flows"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store content encrypted at rest — embeddings treated as sensitive derived data assets"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RBAC on all vector stores — no unauthenticated access in any environment"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.PS-02",
+      "control_name": "Platform Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Software managed to reduce risk — vector database CVEs patched promptly"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitoring for anomalous access — bulk extraction, RBAC bypass attempts detected"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Vector store content encrypted at rest — embeddings of confidential data protected",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "RBAC on all vector store collections — no unauthenticated access",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Vector database CVE patching managed through change management — timely remediation documented",
+      "control_name": "CC8.1 — Change management",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Vector store query anomaly monitoring — bulk extraction patterns detected",
+      "control_name": "CC7.2 — Anomaly detection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored account data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector stores in CDE scope encrypted — embeddings of CHD-adjacent content encrypted at rest"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "RBAC on all vector stores in PCI scope — no unauthenticated access in any CDE environment"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 6.3.3",
+      "control_name": "Vulnerability management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector database CVEs patched — CVE-2024-3584 class treated as urgent for CDE-scope stores"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 11.3.1",
+      "control_name": "Penetration testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector store attacks in CDE penetration testing — RBAC bypass, path traversal, bulk extraction"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector stores governed as sensitive AI data assets — classified, access-controlled, encrypted, and integrity-verified"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "SCS",
+      "control_name": "Supply Chain Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector database platforms assessed as AI supply chain components — CVEs tracked, security configuration reviewed"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All vector store query and mutation operations logged — anomaly detection for unexpected access patterns"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Vector stores require authentication and authorisation — no unauthenticated access, least-privilege query scopes"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum data returned per tool; response scope limitations"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Filter tool responses to minimum data required before passing to model"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-ST",
+      "control_name": "Verification / Security Testing",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Automated tests verifying tool responses are scoped to minimum"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "All tools reviewed for data scope before integration"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all tool responses; alert on anomalous data volumes"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-284",
+      "control_name": "CWE-284",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/284.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-327",
+      "control_name": "CWE-327",
+      "tier": "Foundational",
+      "scope": "Both",
+      "url": "https://cwe.mitre.org/data/definitions/327.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L4",
+      "control_name": "Deployment & Infrastructure",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B003",
+      "control_name": "Third-party security assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B007",
+      "control_name": "Third-party permission controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Third-party tool credentials with excessive data access",
+      "control_name": "NHI-3 Vulnerable Third-Party NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Review all third-party tool credentials; reduce to minimum scope"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Tool integration credentials with broad data access",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum scope per tool integration"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Same credential used across multiple tool integrations",
+      "control_name": "NHI-9 NHI Reuse",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Separate credentials per tool"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — purpose limitation controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define security requirements enforcing data purpose limitation — each dataset must have documented permitted uses and technical controls preventing unauthorised repurposing"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.7.2-PS",
+      "control_name": "Review for security vulnerabilities — misuse and manipulation detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include data misuse and manipulation scenarios in pre-release reviews; verify that purpose limitation controls are enforced and cannot be bypassed"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "RV.1.1-PS",
+      "control_name": "Identify and confirm vulnerabilities — production misuse monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Establish procedures to detect data misuse and manipulation in production including monitoring for purpose-scope violations and data manipulation patterns"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — purpose-limited data access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce purpose-limitation on AI data access; restrict usage to approved purposes documented in data processing agreements"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — data operation logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log all data operations with purpose context; enable detection of purpose drift and unauthorised usage"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "SI-4",
+      "control_name": "System Monitoring — misuse detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor AI data usage patterns for misuse indicators; alert on data access inconsistent with approved purposes"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — data usage governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include data usage policies in ICT risk management; define approved purposes for each AI data category; restrict repurposing"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — purpose-limited data controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement controls enforcing purpose-limitation on AI data usage; restrict processing to approved purposes per data classification"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 17–23",
+      "control_name": "ICT Incident Management — misuse incident reporting",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Classify AI data misuse as ICT-related incidents where customer or regulatory impact occurs; report per DORA criteria"
+    }
+  ],
+  "tools": [
+    {
+      "name": "Weaviate (with RBAC)",
+      "type": "open-source",
+      "url": "https://weaviate.io"
+    },
+    {
+      "name": "Qdrant (with API key auth)",
+      "type": "open-source",
+      "url": "https://qdrant.tech"
+    },
+    {
+      "name": "OWASP ZAP",
+      "type": "open-source",
+      "url": "https://www.zaproxy.org"
+    },
+    {
+      "name": "Weaviate",
+      "type": "open-source",
+      "url": "https://github.com/weaviate/weaviate"
+    },
+    {
+      "name": "Qdrant",
+      "type": "open-source",
+      "url": "https://github.com/qdrant/qdrant"
+    },
+    {
+      "name": "Immuta",
+      "type": "commercial",
+      "url": "https://www.immuta.com"
+    },
+    {
+      "name": "Privacera",
+      "type": "commercial",
+      "url": "https://privacera.com"
+    },
+    {
+      "name": "Apache Ranger",
+      "type": "open-source",
+      "url": "https://ranger.apache.org"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Splunk",
+      "type": "commercial",
+      "url": "https://www.splunk.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Clearview AI biometric bias — $50M class action settlement",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-036"
+    },
+    {
+      "name": "Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-044"
+    },
+    {
+      "name": "Stability AI synthetic CSAM generation — training data and output safety failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-049"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM08",
+      "LLM07",
+      "LLM06",
+      "LLM03"
+    ],
+    "agentic_top10": [
+      "ASI06",
+      "ASI05",
+      "ASI01",
+      "ASI02"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}