Attack vectors

What the clause says

An attack vector is a path by which someone tries to circumvent the process for a malicious outcome. The framework expects the provider to identify the vectors that apply to its design.

What it supplies to a comparison

The vector list is the basis for the vulnerability test. A comparison with no vector list has no defined scope for its security claim.

Evidence to keep

• The vector register, with the control for each.
• The test evidence for the vectors marked as in scope.

What the evidence looks like

For 9.2, the first artefact is The vector register, with the control for each.. The second is The test evidence for the vectors marked as in scope.. If 9.2 has no first artefact, the practice is unproven at 9.2, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Which vectors are in scope, and which are excluded with a reason?
2. Has the list been updated since the last incident or fraud report?

How it connects to the draft

Attack vectors belongs to 9 attacks and contra-indicators, and it gives the analysis one fixed point: The vector list is the basis for the vulnerability test. A comparison with no vector list has no defined scope for its security claim. A comparison that cannot place a result against 9.2 is measuring something the framework has not defined, and the report should say so.

In the register, 9.2 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.