GRC Store

Search / finos-ccc/ccc.lb.th / v2026.06-rc5

Release · v2026.06-rc5

FINOS-CCC/CCC.LB.TH Threat Catalog

FINOS-CCC/CCC.LB.TH

Threats for Load Balancer Capabilities technologies, as defined by the FINOS Common Cloud Controls project.

Published by FINOS Common Cloud Controls

Install

OCI v1.1
$grcli unpack --repository finos-ccc/ccc.lb.th --tag v2026.06-rc5
Coordinate
oci.grc.store/finos-ccc/ccc.lb.th:v2026.06-rc5
Manifest digest
sha256:d5a527a5ebba017b6582f143fa62c6d221c37bd993c61126c24c60ca5288fedc

Provenance

1 layer
Digest Media type Size
0e92e87f9864… application/vnd.gemara.artifact.v1+yaml 5.6 KiB
Bundle config blob 
{
  "bundle-version": "1.0",
  "gemara-version": "v1.2.0",
  "metadata": {
    "provenance": {
      "buildDefinition": {
        "buildType": "https://grc.store/grcli/buildtype/v0",
        "externalParameters": {
          "artifact": {
            "id": "CCC.LB.TH",
            "type": "ThreatCatalog"
          },
          "target": {
            "registry": "oci.grc.store",
            "repository": "finos-ccc/ccc.lb.th",
            "tag": "v2026.06-rc5"
          }
        },
        "internalParameters": {
          "CI": "true",
          "GITHUB_ACTIONS": "true",
          "GITHUB_ACTOR": "eddie-knight",
          "GITHUB_REF": "refs/heads/main",
          "GITHUB_REPOSITORY": "eddie-knight/common-cloud-controls",
          "GITHUB_RUN_ATTEMPT": "1",
          "GITHUB_RUN_ID": "26771723499",
          "GITHUB_SHA": "a9503345caf59a144d8ab9b4bede212b393ca56a",
          "GITHUB_WORKFLOW": "Batch Release All Catalogs",
          "RUNNER_OS": "Linux"
        },
        "resolvedDependencies": [
          {
            "name": "artifacts/networking/loadbalancer/threats.yaml",
            "uri": "file://artifacts/networking/loadbalancer/threats.yaml",
            "digest": {
              "sha256": "0e92e87f9864ca9dc070f99fcba46129eff4fe510739d8db4008435fa829433f"
            }
          },
          {
            "name": "source",
            "uri": "git+https://github.com/eddie-knight/common-cloud-controls@a9503345caf59a144d8ab9b4bede212b393ca56a",
            "digest": {
              "gitCommit": "a9503345caf59a144d8ab9b4bede212b393ca56a"
            }
          }
        ]
      },
      "runDetails": {
        "builder": {
          "id": "https://github.com/eddie-knight/common-cloud-controls/actions/runs/26771723499",
          "version": {
            "go": "go1.25.0",
            "go-arch": "amd64",
            "go-os": "linux",
            "grcli": "v0.2.2"
          }
        },
        "metadata": {
          "invocationId": "26771723499-1",
          "startedOn": "2026-06-01T17:48:36.735247908Z",
          "finishedOn": "2026-06-01T17:48:36.839808151Z"
        },
        "byproducts": [
          {
            "name": "threats.yaml",
            "digest": {
              "sha256": "0e92e87f9864ca9dc070f99fcba46129eff4fe510739d8db4008435fa829433f"
            }
          }
        ]
      }
    }
  },
  "artifacts": [
    {
      "name": "threats.yaml",
      "type": "ThreatCatalog",
      "id": "CCC.LB.TH",
      "role": "artifact"
    }
  ]
}

CCC Load Balancer Capabilities Threats

Threats for Load Balancer Capabilities technologies, as defined by the FINOS Common Cloud Controls project.

ID
CCC.LB.TH
Version
v2026.06-rc5
Gemara version
v1.2.0
Author
FINOS Common Cloud Controls

Resource Management

The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.

  1. CCC.LB.TH01 Unrestricted Request Traffic Overwhelms Downstream Services

    Absence of filtering or rate limiting permits malicious traffic to overload downstream services and facilitates brute-force activity.

    Capabilities
    • CCC.Core.Capabilities
      • CCC.Core.CP04 — Transaction Rate Limits
    • CCC.LB.Capabilities
      • CCC.LB.CP22 — Rate Limiting / Throttling

  2. CCC.LB.TH05 Health Checks Are Exploited to Take Services Offline

    Manipulating health-check endpoints or responses can cause healthy targets to be marked unavailable, leading to denial of service.

    Capabilities
    • CCC.LB.Capabilities
      • CCC.LB.CP12 — Health Checks
      • CCC.LB.CP13 — Target Removal

Networking

The Networking group covers entries related to network infrastructure, connectivity, and traffic management. This includes virtual networks, subnets, load balancing, DNS, routing, peering, and network-level access controls.

  1. CCC.LB.TH03 Traffic Distribution Is Manipulated

    Adjusting distribution policies can concentrate traffic on specific nodes causing DoS or redirect flows through unwanted paths.

    Capabilities
    • CCC.LB.Capabilities
      • CCC.LB.CP02 — Dynamic LB
      • CCC.LB.CP20 — Traffic Splitting

Access Control

The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.

  1. CCC.LB.TH04 Session Persistence Is Exploited

    Improper session-affinity settings can enable session fixation or hijacking across backend targets.

    Capabilities
    • CCC.LB.Capabilities
      • CCC.LB.CP15 — Session Affinity

Data Resilience

The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.

  1. CCC.LB.TH06 Sensitive Metadata Exposure via HTTP Headers

    Response headers may reveal software versions, internal IPs, or other metadata useful for reconnaissance.

    Capabilities
    • CCC.LB.Capabilities
      • CCC.LB.CP19

Encryption

The Encryption group covers entries related to protecting data confidentiality and integrity through cryptographic mechanisms. This includes encryption in transit and at rest, key management, and certificate lifecycle management.

  1. CCC.LB.TH07 TLS Certificates Are Expired or Invalid

    Stale or untrusted certificates weaken encrypted-traffic protection.

    Capabilities
    • CCC.LB.Capabilities
      • CCC.LB.CP11 — SSL/TLS Termination