grc.store

Search / finos-ccc/ccc.blocstor.th / v2026.07-rc

Release · v2026.07-rc

FINOS-CCC/CCC.BlocStor.TH Threat Catalog

FINOS-CCC/CCC.BlocStor.TH

Threats for Block Storage technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

License Community-Spec-1.0

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.blocstor.th --version v2026.07-rc

grcli unpack verifies this signature against the recorded identity below and fails closed before writing any files — no separate verify step needed. Pass --no-verify to skip.

Coordinate
oci.grc.store/finos-ccc/ccc.blocstor.th:v2026.07-rc
Manifest digest
sha256:d0c3d0116e7795330448d4f963c96ebba218d7a3696b0f6d29fe0dfea808ccf3
Signed by
no signature recorded

Identity recorded by this hub when the version was published; unpack (above) checks the signature against it.

Verify in CI — check the signature without downloading
$grcli verify --repository finos-ccc/ccc.blocstor.th --version v2026.07-rc

Read-only: downloads nothing and exits non-zero if the signature or the recorded identity doesn't match — use it as an admission/policy gate.

Provenance

1 layer
Digest Media type Size
229aeeb3dea0… application/vnd.gemara.artifact.v1+yaml 7.3 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.BlocStor.TH",
            "type": "ThreatCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.blocstor.th",
            "tag": "v2026.07-rc"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "28763687249",
          "GITHUB_SHA": "3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1",
          "GITHUB_WORKFLOW": "Batch Release All Catalogs",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/storage/block/threats.yaml",
            "uri": "file://artifacts/storage/block/threats.yaml",
            "digest": {
              "sha256": "229aeeb3dea04eab93983cf6fe9018e9b692d55a0be029aa18f2375ac5c4d146"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1",
            "digest": {
              "gitCommit": "3e4a2c0ef4b966fcf7c8e2f0fd4f8da3f6ae02e1"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/28763687249",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.4.1"
          }
        },
        "metadata": {
          "invocationId": "28763687249-1",
          "startedOn": "2026-07-06T02:26:56.061815114Z",
          "finishedOn": "2026-07-06T02:26:56.554776306Z"
        },
        "byproducts": [
          {
            "name": "threats.yaml",
            "digest": {
              "sha256": "229aeeb3dea04eab93983cf6fe9018e9b692d55a0be029aa18f2375ac5c4d146"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "threats.yaml",
      "type": "ThreatCatalog",
      "id": "CCC.BlocStor.TH",
      "role": "artifact"
    }
  ]
}

CCC Block Storage Threats

Threats for Block Storage technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.BlocStor.TH
Version
v2026.07-rc
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

Data Resilience

The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.

  1. CCC.BlocStor.TH01 Residual Data Remains on Reallocated Volume Storage

    When a block volume is deleted or detached, the underlying physical storage blocks may be returned to a shared allocation pool before being cryptographically erased or overwritten. Data written by a previous user can then persist on the medium and be read when the same blocks are provisioned to a subsequent volume. This results in a loss of confidentiality of previously stored data.

    References to Other Documents
    Capabilities
    • CCC.BlocStor.Capabilities
      • CCC.BlocStor.CP01 — Block Volumes
    • CCC.Core.Capabilities
      • CCC.Core.CP02 — Encryption at Rest Enabled by Default

  2. CCC.BlocStor.TH02 Snapshots are Exposed to Unauthorized Accounts

    Volume snapshots may be configured as publicly accessible or shared with external accounts through sharing settings or time-limited access tokens. An external system can then create a new volume from the exposed snapshot and read its full contents outside the original trust boundary. This results in a loss of confidentiality of all data captured in the snapshot.

    References to Other Documents
    Capabilities
    • CCC.BlocStor.Capabilities
      • CCC.BlocStor.CP01 — Block Volumes
    • CCC.Core.Capabilities
      • CCC.Core.CP11 — Backup

  3. CCC.BlocStor.TH04 Multi-Attached Volume is Corrupted by Uncoordinated Writes

    When a single block volume is attached to multiple compute instances without a cluster-aware file system to serialize access, concurrent writes to the same blocks are applied without coordination. The file system metadata and stored data can then become inconsistent or unreadable. This results in a loss of integrity and availability of the data on the volume.

    References to Other Documents
    Capabilities
    • CCC.BlocStor.Capabilities
      • CCC.BlocStor.CP04 — Multi-Attach Volumes

Access Control

The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.

  1. CCC.BlocStor.TH03 Volume is Attached to an Unauthorized Compute Instance

    A detached block volume may be attached to a compute instance other than the one it was provisioned for when attachment permissions are scoped too broadly. The instance then gains direct block-level access to the volume's file system, bypassing access controls enforced within the originally attached instance. This results in a loss of confidentiality and integrity of the data on the volume.

    References to Other Documents
    Capabilities
    • CCC.BlocStor.Capabilities
      • CCC.BlocStor.CP02 — Volume Attachment
      • CCC.BlocStor.CP03 — Boot Volumes

Encryption

The Encryption group covers entries related to protecting data confidentiality and integrity through cryptographic mechanisms. This includes encryption in transit and at rest, key management, and certificate lifecycle management.

  1. CCC.BlocStor.TH05 Volumes are Provisioned Without Encryption

    Volumes or snapshot copies may be provisioned with encryption disabled, or created from an unencrypted source, when encryption is not enforced by organizational policy. Data is then written to the storage medium in cleartext and can be read by any entity that obtains access to the underlying blocks or a copy of the volume. This results in a loss of confidentiality of the stored data.

    References to Other Documents
    Capabilities
    • CCC.BlocStor.Capabilities
      • CCC.BlocStor.CP01 — Block Volumes
      • CCC.BlocStor.CP08 — Customer-Managed Encryption Keys
    • CCC.Core.Capabilities
      • CCC.Core.CP02 — Encryption at Rest Enabled by Default