Control Data-Centric Vulnerabilities

NIST SP 800-154 (Initial Public Draft) Guide to Data-Centric System Threat Modeling establishes data-centric threat l modeling as a methodology and framework for focusing on the authorized movement, locations, execution, and input and output of data within, from, and into a system. This approach aligns with protecting data throughout its life cycle, encompassing transit, at rest, and in use. Additionally, data classification and categorization provide a framework for implementing tailored security measures based on the sensitivity of the information.

According to NIST SP 800154, a data-centric approach to security means focusing on protecting the information itself rather than solely on infrastructure components like servers and hosts.

NIST SP 800-154 explains it as follows:

• Input data provided to applications can cause them to behave abnormally. This can expose other data to unauthorized access, allow for arbitrary code to be executed, corrupt data being written to storage by the application, or cause the application to terminate in abnormal ways.
• Incorrect data input processes can allow false or fraudulent data to be entered into a system for subsequent processing. False invoices and requests for access to shared resources such as on SharePoint or other cloud systems are examples of this.
• Improper use of systems utilities to read or extract data from file systems, databases, and knowledge management systems could be steps in a data exfiltration attack.

Protective measures are designed to safeguard the assets and operations fundamental to an organization's overall success. They are not isolated objectives but rather the pathways to achieving broader organizational goals and ensuring a secure and resilient environment.