genai-security-crosswalk 2.0.0

package/data/entries/DSGAI14.json

@@ -0,0 +1,703 @@
+{
+  "id": "DSGAI14",
+  "name": "Excessive Telemetry and Monitoring Leakage",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Sensitive inference inputs and outputs captured in telemetry stores accessed through weaker controls"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry stores containing sensitive GenAI interaction data exfiltrated through standard data access paths"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0057",
+      "control_name": "Data from Information Repositories",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Observability databases and log stores accessed as information repositories — sensitive content available at scale"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "GV-1.6",
+      "control_name": "Policies for data privacy",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Telemetry governance policy — least-logging defaults, classification of captured data, retention limits"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Telemetry leakage risks mapped — identify which pipelines capture full payload and at what retention"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Data leakage testing on telemetry stores — sensitive content in logs and traces"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.4",
+      "control_name": "Risk response — data",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Response for telemetry data leakage incidents — access log review, data deletion, notification"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Data governance applies to all data in AI system scope — including telemetry and monitoring data",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry data governance — classification, access controls, retention — is an Art. 10 requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring required — but the monitoring infrastructure must itself be secured",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry security is both an Art. 17 obligation and an Art. 10 data governance requirement"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.15",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Logging controls applied to AI telemetry — least-logging defaults, no full payload capture by default"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.12",
+      "control_name": "Data leakage prevention",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "DLP applied to telemetry streams — sensitive content redacted before storage"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Telemetry data classified — full prompt captures classified at same level as content they contain"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Masking of sensitive content in logs and traces before storage"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — governance",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Policies",
+      "control_name": "A.2.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — testing",
+      "control_name": "A.6.2.6",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Performance evaluation",
+      "control_name": "Cl.9",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 8",
+      "control_name": "8.2 — Collect audit logs",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 8",
+      "control_name": "8.10 — Retain audit logs",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.13 — Deploy DLP on log pipelines",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 6",
+      "control_name": "6.3 — Access control on log infrastructure",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7 Logging",
+      "control_name": "V7.1.1 — No credential logging",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V7 Logging",
+      "control_name": "V7.1.2 — No sensitive data in logs",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.1.1 — Sensitive data not in URLs",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.1 — Access control on log stores",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT GenAI telemetry stores classified and protected — process data in logs requires same protection as live data"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.4",
+      "control_name": "Use of physical diagnostic and test interfaces",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT-specific data masking before telemetry capture — tag IDs, equipment identifiers masked before logging"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 1.2",
+      "control_name": "Human user authentication",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls on OT GenAI telemetry stores — need-to-know enforced"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "OT-trained model weights are sensitive OT intellectual property"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Model theft as OT IP theft scenario"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Monitor model storage access patterns"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "GV.OC-01",
+      "control_name": "Organisational Context",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry governance policy — least-logging defaults, classification of captured data, retention limits"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry stores containing sensitive data protected — same requirements as production data stores"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls on telemetry stores — need-to-know enforced, not open access because \"just logs\""
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-09",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry store access monitored — anomalous access patterns detected"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "GenAI telemetry classified and encrypted — content captured in traces protected at same level as source data",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Personal information in telemetry used only for authorised purposes — same restrictions as production data",
+      "control_name": "P5.1 — Personal information use",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access controls on telemetry stores — same rigour as production data stores",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Access anomaly monitoring on telemetry stores — bulk access patterns detected",
+      "control_name": "CC7.2 — Monitoring",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.5.1",
+      "control_name": "Protect stored account data",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry stores containing CHD encrypted — observability data is CHD if it contains PANs"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "PAN rendering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PANs in telemetry masked before logging — cleartext PANs in observability data is a Req 3 finding"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls on CDE telemetry stores — Req 7 need-to-know applies"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access to CDE telemetry stores logged — accessing observability data containing CHD requires Req 10 trail"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry data classified and governed — observability pipelines subject to the same data governance policy as primary data assets"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "MON",
+      "control_name": "Monitoring and Detection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Observability stores protected against unauthorised access — access controls, encryption, and retention limits applied to all telemetry"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Telemetry pipelines scanned for sensitive data before storage — redaction and masking applied to GenAI inputs and outputs in logs"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Logs protected from tampering and unauthorised access — separation between security logs and operational telemetry"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SA",
+      "control_name": "Design / Security Architecture",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Treat model weights as crown-jewel assets with appropriate access controls"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Classify model weights; require formal access control and custodian assignment"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "V-AA",
+      "control_name": "Verification / Architecture Assessment",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Periodic review of model storage access controls"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-OM",
+      "control_name": "Operations / Operational Management",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Alert on unexpected access to model weight storage"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-SM",
+      "control_name": "Governance / Strategy & Metrics",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Document model IP protection controls in security programme roadmap"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-312",
+      "control_name": "CWE-312",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/312.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-532",
+      "control_name": "CWE-532",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/532.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L5",
+      "control_name": "Evaluation & Observability",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L6",
+      "control_name": "Security & Compliance",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Model storage service account with read access from unexpected paths",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Minimum scope: only authorised inference service can read model weights"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Model storage credentials in plaintext config",
+      "control_name": "NHI-6 Insecure Credential Storage",
+      "tier": "Hardening",
+      "scope": "Both",
+      "notes": "Vault all model storage credentials"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — consent management requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define security requirements mandating consent verification before personal data enters AI training, fine-tuning, or inference pipelines"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — consent enforcement architecture",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Design AI systems with consent enforcement mechanisms that validate consent status before data processing and honour consent withdrawal across all pipeline stages"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — consent governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include consent management in AI risk management strategy; define consent requirements per data type and processing activity"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-3",
+      "control_name": "Access Enforcement — consent-based access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Enforce access controls aligned with consent status; block AI processing on data where consent has been withdrawn"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AU-2",
+      "control_name": "Event Logging — consent compliance logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log consent status and changes; enable audit of consent compliance for all AI data processing activities"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — consent governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Include consent management in ICT risk management; define consent requirements per data type and AI processing activity for financial services"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — consent-aligned controls",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Implement access controls aligned with consent status; block AI processing on data where consent has been withdrawn or is insufficient"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 10",
+      "control_name": "Detection — consent violation monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor for AI processing inconsistent with consent status; alert on violations"
+    }
+  ],
+  "tools": [
+    {
+      "name": "OpenTelemetry",
+      "type": "open-source",
+      "url": "https://opentelemetry.io"
+    },
+    {
+      "name": "Langfuse",
+      "type": "open-source",
+      "url": "https://langfuse.com"
+    },
+    {
+      "name": "Helicone",
+      "type": "open-source",
+      "url": "https://www.helicone.ai"
+    },
+    {
+      "name": "Grafana Loki",
+      "type": "open-source",
+      "url": "https://github.com/grafana/loki"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Fluent Bit",
+      "type": "open-source",
+      "url": "https://github.com/fluent/fluent-bit"
+    },
+    {
+      "name": "OneTrust",
+      "type": "commercial",
+      "url": "https://www.onetrust.com"
+    },
+    {
+      "name": "Transcend",
+      "type": "commercial",
+      "url": "https://transcend.io"
+    },
+    {
+      "name": "CookieYes",
+      "type": "open-source",
+      "url": "https://www.cookieyes.com"
+    },
+    {
+      "name": "Osano",
+      "type": "commercial",
+      "url": "https://www.osano.com"
+    },
+    {
+      "name": "Collibra",
+      "type": "commercial",
+      "url": "https://www.collibra.com"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "TrustArc",
+      "type": "commercial",
+      "url": "https://trustarc.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Cursor AI code agent leaking repository secrets via context window",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-034"
+    },
+    {
+      "name": "Italy Garante orders ChatGPT GDPR enforcement — consent and data minimization failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-035"
+    },
+    {
+      "name": "Clearview AI biometric bias — $50M class action settlement",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-036"
+    },
+    {
+      "name": "TikTok EU data localization enforcement — Project Clover + EUR 345M GDPR fine",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2023,
+      "incident_id": "INC-043"
+    },
+    {
+      "name": "Scale AI / Sama contractor data exposure — third-party AI labeling workforce privacy violations",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-044"
+    },
+    {
+      "name": "OpenAI ChatGPT data retention GDPR challenge — right to erasure vs model training",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2024,
+      "incident_id": "INC-050"
+    }
+  ],
+  "crossrefs": {
+    "dsgai_2026": [
+      "DSGAI01",
+      "DSGAI07",
+      "DSGAI12"
+    ],
+    "llm_top10": [
+      "LLM02",
+      "LLM03",
+      "LLM06"
+    ],
+    "agentic_top10": [
+      "ASI09",
+      "ASI02"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}