genai-security-crosswalk 2.0.0

package/data/entries/DSGAI15.json

@@ -0,0 +1,655 @@
+{
+  "id": "DSGAI15",
+  "name": "Over-Broad Context Windows",
+  "source_list": "DSGAI-2026",
+  "version": "2026-Q1",
+  "severity": "High",
+  "aivss_score": null,
+  "audience": [
+    "red-teamer",
+    "security-engineer",
+    "ciso",
+    "compliance",
+    "ml-engineer",
+    "ot-engineer",
+    "auditor",
+    "developer",
+    "data-engineer"
+  ],
+  "mappings": [
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0051",
+      "control_name": "Exploit Public-Facing Application",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Prompt injection via LLM interface accesses all content injected into over-broad context window"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0025",
+      "control_name": "Exfiltrate via Cyber Means",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Over-broad context window content exfiltrated through successful injection — adversary retrieves aggregated sensitive data"
+    },
+    {
+      "framework": "MITRE ATLAS",
+      "control_id": "AML.T0035",
+      "control_name": "Exfiltrate via ML Inference API",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inference API queries designed to surface maximum context window content through crafted prompts"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MP-2.3",
+      "control_name": "Risk categorisation",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Context window risks mapped — identify which deployments aggregate data across trust domains"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.5",
+      "control_name": "Testing — adversarial",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Adversarial testing of context window content — cross-trust-domain aggregation and injection scenarios"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MS-2.6",
+      "control_name": "Testing — data leakage",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Data leakage testing on context window content — sensitive data accessible to injection attacks"
+    },
+    {
+      "framework": "NIST AI RMF 1.0",
+      "control_id": "MG-2.2",
+      "control_name": "Risk response",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Response for context window exploitation — session containment, content audit, impact scoping"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Data governance applies to all data in AI system scope — including context window content",
+      "control_name": "Art. 10 — Data and data governance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window data governance — minimum content, classification tracking — is Art. 10 requirement"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Cybersecurity against adversarial exploitation of context window content",
+      "control_name": "Art. 15 — Accuracy, robustness, cybersecurity",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context minimisation and access controls are Art. 15 cybersecurity measures"
+    },
+    {
+      "framework": "EU AI Act",
+      "control_id": "Post-market monitoring covering context window exploitation incidents",
+      "control_name": "Art. 17 — Quality management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window security in post-market monitoring programme"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.3",
+      "control_name": "Information access restriction",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Context window content restricted to minimum required — no cross-trust-domain aggregation without access control"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.12",
+      "control_name": "Classification of information",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "All content injected into context window classified — highest classification drives handling requirement"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.8.11",
+      "control_name": "Data masking",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Sensitive content redacted or masked before injection into shared context windows"
+    },
+    {
+      "framework": "ISO/IEC 27001:2022",
+      "control_id": "A.5.14",
+      "control_name": "Information transfer",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Controls on content transfer into context windows — documented data flow for each RAG pipeline"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Data — minimisation",
+      "control_name": "A.7.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Lifecycle — operational",
+      "control_name": "A.6.2.3",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Impact assessment",
+      "control_name": "A.5.2",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Hardening"
+    },
+    {
+      "framework": "ISO/IEC 42001:2023",
+      "control_id": "Operation",
+      "control_name": "Cl.8",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.3 — Configure data access control lists",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 3",
+      "control_name": "3.1 — Data minimisation",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "CIS Controls v8.1",
+      "control_id": "CIS 16",
+      "control_name": "16.6 — Security requirements",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V4 Access Control",
+      "control_name": "V4.1.3 — Deny by default access control",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V8 Data Protection",
+      "control_name": "V8.1.4 — Data minimisation",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "OWASP ASVS 4.0.3",
+      "control_id": "V3 Session Management",
+      "control_name": "V3.1.1 — Session isolation",
+      "tier": "Foundational",
+      "scope": "Build"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 2.2",
+      "control_name": "Least privilege",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT context assembly restricted to minimum data required for the specific query — not broad process datasets"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 4.1",
+      "control_name": "Data confidentiality",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "OT context window classification tracking — highest classification drives response handling"
+    },
+    {
+      "framework": "ISA/IEC 62443",
+      "control_id": "SR 5.1",
+      "control_name": "Information flow restriction",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context assembly limits in Zone 3 — cross-trust-domain aggregation restricted"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "OT data confidentiality",
+      "control_name": "§5.4",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inference inputs are OT data and require protection"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Risk assessment",
+      "control_name": "§6.2",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Inference data exposure in OT risk assessment"
+    },
+    {
+      "framework": "NIST SP 800-82 Rev 3",
+      "control_id": "Network monitoring",
+      "control_name": "§7.3",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Monitor inference data leaving OT boundary"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.AA-05",
+      "control_name": "Identity Management, Authentication & Access Control",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access permissions applied to context assembly — minimum-necessary context injection enforced"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "PR.DS-01",
+      "control_name": "Data Security",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window content protected — highest classification of any included document drives handling"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "DE.CM-01",
+      "control_name": "Continuous Monitoring",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context assembly monitored — over-broad injection patterns detected"
+    },
+    {
+      "framework": "NIST CSF 2.0",
+      "control_id": "ID.RA-01",
+      "control_name": "Risk Assessment",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window risks documented — which deployments aggregate data across trust domains"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Context window assembly respects user authorisation — no content from higher classification tier than user's access level",
+      "control_name": "CC6.1 — Logical access",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Highest classification in context window drives handling — response treated as confidential if context contains confidential data",
+      "control_name": "C2.1 — Confidential information protection",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Minimum-necessary context injection procedures — documented and enforced",
+      "control_name": "CC5.2 — Control activities",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "SOC 2",
+      "control_id": "Over-broad context risks identified — cross-trust-domain aggregation assessed",
+      "control_name": "CC3.2 — Risk assessment",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 7.2.1",
+      "control_name": "Restrict access",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context assembly restricted to minimum CHD required — users cannot access CHD beyond their authorised scope through context injection"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 3.4.1",
+      "control_name": "PAN rendering",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "PANs in context window masked — cleartext PANs in LLM context is a Req 3 exposure"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 12.3.2",
+      "control_name": "Targeted risk analysis",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Targeted risk analysis for context window CHD exposure — blast radius of over-broad injection documented"
+    },
+    {
+      "framework": "PCI DSS v4.0",
+      "control_id": "Req 10.2.1",
+      "control_name": "Logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window assembly logged — all CHD accessed through context injection traceable"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Data and Model Security (DMS)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Context window population governed by data minimisation principle — only data necessary for the current task included"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "AI System Integrity (ASI)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "AI system integrity controls include context window scope limits — over-broad context documented as a risk in AI risk assessment"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L2",
+      "control_name": "Governance and Risk (GOV)",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Over-broad context included as a risk factor in AI risk assessment — treatment controls and data minimisation requirements documented"
+    },
+    {
+      "framework": "ENISA Multilayer Framework",
+      "control_id": "L1",
+      "control_name": "General ICT — Data Protection",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Data minimisation principle applied as a baseline data protection requirement for all AI system design"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "D-SR",
+      "control_name": "Design / Security Requirements",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Define what inference data may be logged, retained, and shared"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "I-SB",
+      "control_name": "Implementation / Secure Build",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Log only what is operationally necessary; scrub sensitive data from logs"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "O-EM",
+      "control_name": "Operations / Environment Management",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Access controls, encryption, and retention policies for all inference logs"
+    },
+    {
+      "framework": "OWASP SAMM v2.0",
+      "control_id": "G-PC",
+      "control_name": "Governance / Policy & Compliance",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Documented policy on inference data retention periods and deletion"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-200",
+      "control_name": "CWE-200",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/200.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-201",
+      "control_name": "CWE-201",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/201.html"
+    },
+    {
+      "framework": "CWE/CVE",
+      "control_id": "CWE-285",
+      "control_name": "CWE-285",
+      "tier": "Foundational",
+      "scope": "Build",
+      "url": "https://cwe.mitre.org/data/definitions/285.html"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L2",
+      "control_name": "Data Operations",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L1",
+      "control_name": "Foundation Models",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "MAESTRO",
+      "control_id": "L3",
+      "control_name": "Agent Frameworks",
+      "tier": "Foundational",
+      "scope": "Both"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "A",
+      "control_name": "Data & Privacy domain",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "B006",
+      "control_name": "Prevent unauthorized AI actions",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "AIUC-1",
+      "control_id": "E",
+      "control_name": "Audit trails and logging",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Foundational"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Inference log service account with broad read access",
+      "control_name": "NHI-5 Over-Privileged NHI",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Minimum scope: only authorised audit function can read inference logs"
+    },
+    {
+      "framework": "OWASP NHI Top 10",
+      "control_id": "Service account credentials embedded in inference log entries",
+      "control_name": "NHI-2 Secret Leakage",
+      "tier": "Foundational",
+      "scope": "Both",
+      "notes": "Scan and scrub credentials from inference logs"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.1.1-PS",
+      "control_name": "Define security requirements — data minimisation requirements",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Define security requirements enforcing data minimisation — AI systems must collect and process only the data necessary for their documented purpose"
+    },
+    {
+      "framework": "NIST SP 800-218A",
+      "control_id": "PW.2.1-PS",
+      "control_name": "Design software — minimisation-by-design",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Design AI data pipelines with data minimisation controls built in; implement field-level filtering, aggregation, and anonymisation at ingestion"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "AC-6",
+      "control_name": "Least Privilege — data collection restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict AI data collection to minimum necessary for stated purpose; enforce at pipeline ingestion points"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "CM-7",
+      "control_name": "Least Functionality — data processing restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Restrict AI data processing to minimum necessary scope; disable collection of non-essential data fields"
+    },
+    {
+      "framework": "FedRAMP",
+      "control_id": "PM-9",
+      "control_name": "Risk Management Strategy — minimisation governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include data minimisation in AI risk management; define minimum necessary data per AI use case"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 5–7",
+      "control_name": "ICT Risk Management — minimisation governance",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Include data minimisation in ICT risk management; define minimum necessary data per AI use case and processing activity"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 9",
+      "control_name": "Protection and Prevention — collection restrictions",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Implement controls restricting AI data collection to minimum necessary; enforce at pipeline ingestion points and model training configuration"
+    },
+    {
+      "framework": "DORA",
+      "control_id": "Art. 8",
+      "control_name": "Identification — data necessity mapping",
+      "tier": "Foundational",
+      "scope": "Build",
+      "notes": "Document data necessity justification for each AI data asset; map minimum required data per use case"
+    }
+  ],
+  "tools": [
+    {
+      "name": "LlamaIndex",
+      "type": "open-source",
+      "url": "https://www.llamaindex.ai"
+    },
+    {
+      "name": "Guardrails AI",
+      "type": "open-source",
+      "url": "https://github.com/guardrails-ai/guardrails"
+    },
+    {
+      "name": "LLM Guard",
+      "type": "open-source",
+      "url": "https://github.com/protectai/llm-guard"
+    },
+    {
+      "name": "Garak",
+      "type": "open-source",
+      "url": "https://github.com/leondz/garak"
+    },
+    {
+      "name": "Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "ARX Data Anonymization",
+      "type": "open-source",
+      "url": "https://arx.deidentifier.org"
+    },
+    {
+      "name": "Amnesia",
+      "type": "open-source",
+      "url": "https://amnesia.openaire.eu"
+    },
+    {
+      "name": "Google Differential Privacy",
+      "type": "open-source",
+      "url": "https://github.com/google/differential-privacy"
+    },
+    {
+      "name": "Microsoft Presidio",
+      "type": "open-source",
+      "url": "https://github.com/microsoft/presidio"
+    },
+    {
+      "name": "Open Policy Agent",
+      "type": "open-source",
+      "url": "https://www.openpolicyagent.org"
+    },
+    {
+      "name": "OneTrust",
+      "type": "commercial",
+      "url": "https://www.onetrust.com"
+    }
+  ],
+  "incidents": [
+    {
+      "name": "Italy Garante orders ChatGPT GDPR enforcement — consent and data minimization failures",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-035"
+    },
+    {
+      "name": "Synthetic data re-identification — de-anonymized patients from synthetic health records",
+      "url": "https://github.com/emmanuelgjr/GenAI-Security-Crosswalk/blob/main/data/incidents.json",
+      "year": 2025,
+      "incident_id": "INC-040"
+    }
+  ],
+  "crossrefs": {
+    "llm_top10": [
+      "LLM07",
+      "LLM02",
+      "LLM08",
+      "LLM06"
+    ],
+    "agentic_top10": [
+      "ASI01",
+      "ASI06",
+      "ASI02"
+    ],
+    "dsgai_2026": [
+      "DSGAI03"
+    ]
+  },
+  "changelog": [
+    {
+      "date": "2026-03-27",
+      "version": "1.0.0",
+      "change": "Initial entry — generated from GenAI Security Crosswalk v1.5.1 mapping files",
+      "author": "emmanuelgjr"
+    }
+  ]
+}