encryption.json

{
  "nodes": [
    {
      "id": "surface-endpoint-at-rest",
      "type": "attack-surface",
      "title": "Endpoint storage at rest",
      "summary": "Disks on laptops, desktops, and phones. A lost or stolen powered-off device exposes plaintext unless the volume is encrypted.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["fde", "endpoint", "at-rest"],
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "surface-data-in-transit",
      "type": "attack-surface",
      "title": "Data in transit",
      "summary": "Traffic across the internet, public Wi-Fi, and remote-admin paths. An on-path observer can read or alter cleartext.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["tls", "ssh", "transit"],
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "surface-cloud-data-at-rest",
      "type": "attack-surface",
      "title": "Cloud data at rest",
      "summary": "Object stores, managed disks, and backups. Default storage encryption without separate key custody still fails with the account.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["cloud", "kms", "at-rest"],
      "roles": ["infrastructure-operator"],
      "lifecycle": ["normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "threat-plaintext-lost-device",
      "type": "threat",
      "title": "Plaintext on a lost device",
      "summary": "A lost or stolen endpoint yields work data, secrets, or key-adjacent files because the disk was unencrypted or the recovery key sat beside the device.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["fde", "theft", "endpoint"],
      "severity": "high",
      "severityBasis": "Default triage is high because a stolen laptop is common and the disk holds whatever the operator used. FDE does not stop a logged-in malware session.",
      "framework": "encryption"
    },
    {
      "id": "threat-on-path-interception",
      "type": "threat",
      "title": "On-path interception",
      "summary": "An observer on the network path reads or alters traffic that used HTTP, cleartext admin, or a broken TLS setup.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["mitm", "tls", "transit"],
      "severity": "high",
      "severityBasis": "Default triage is high because cleartext remote admin and bulk HTTP expose credentials and change commands. Impact tracks what the channel carries.",
      "framework": "encryption"
    },
    {
      "id": "threat-cloud-plaintext-at-rest",
      "type": "threat",
      "title": "Cloud plaintext at rest",
      "summary": "Object stores, disks, or backups keep data readable, or encryption keys sit in the same account as the ciphertext, so a stolen volume or hijacked role yields the data.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["cloud", "kms", "at-rest"],
      "severity": "high",
      "severityBasis": "Default triage is high because cloud disks and buckets outlive any one server. Blast radius is the classified data in that store, not the compute instance.",
      "framework": "encryption"
    },
    {
      "id": "control-full-disk-encryption",
      "type": "control",
      "title": "Full-disk encryption",
      "summary": "Confirm FDE is on for every work endpoint, with a strong algorithm and recovery keys stored off the device.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["fde", "endpoint"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "multisig-signer"],
      "lifecycle": ["normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "control-tls-ssh-transit",
      "type": "control",
      "title": "TLS and SSH in transit",
      "summary": "Use modern TLS for internet traffic and SSH for remote admin. Cleartext HTTP and unencrypted remote shells are not acceptable on sensitive systems.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["tls", "ssh", "transit"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["design", "normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "control-cloud-kms-custody",
      "type": "control",
      "title": "Cloud KMS key custody",
      "summary": "Encrypt cloud data at rest with a KMS or BYOK design. Do not leave keys in the same breach domain as the ciphertext.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["kms", "cloud", "at-rest"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["infrastructure-operator"],
      "lifecycle": ["design", "normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "control-hardware-backed-encryption",
      "type": "control",
      "title": "Hardware-backed encryption keys",
      "summary": "Keep encryption keys in TPM, a self-encrypting drive, or an HSM so host memory and malware see less key material. This is not a hardware wallet.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["tpm", "hsm", "hardware"],
      "controlClass": "preventive",
      "assessmentEligible": true,
      "roles": ["engineer-developer", "infrastructure-operator"],
      "lifecycle": ["design", "normal-operations"],
      "framework": "encryption"
    },
    {
      "id": "guidance-encryption",
      "type": "guidance",
      "title": "Encryption",
      "summary": "Protect confidentiality when keys are managed on purpose across data at rest and in transit. Algorithms do not fix weak custody or cleartext channels.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["encryption"],
      "href": "/encryption/overview",
      "framework": "encryption"
    },
    {
      "id": "guidance-full-disk-encryption",
      "type": "guidance",
      "title": "Full-disk encryption",
      "summary": "Enable FDE on endpoints that store work data so lost or stolen devices do not expose plaintext at rest.",
      "domains": ["devices-identity"],
      "status": "proposed",
      "tags": ["fde"],
      "href": "/encryption/full-disk-encryption",
      "framework": "encryption"
    },
    {
      "id": "guidance-hardware-encryption",
      "type": "guidance",
      "title": "Hardware encryption",
      "summary": "TPM, self-encrypting drives, and HSMs keep encryption keys out of host memory when they are deployed and managed correctly.",
      "domains": ["devices-identity", "infrastructure"],
      "status": "proposed",
      "tags": ["tpm", "hsm"],
      "href": "/encryption/hardware-encryption",
      "framework": "encryption"
    },
    {
      "id": "guidance-encryption-in-transit",
      "type": "guidance",
      "title": "Encryption in transit",
      "summary": "Data crossing networks uses TLS, SSH, or a VPN as appropriate. Cleartext remote admin and bulk HTTP are unacceptable for sensitive systems.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["tls", "transit"],
      "href": "/encryption/encryption-in-transit",
      "framework": "encryption"
    },
    {
      "id": "guidance-cloud-data-encryption",
      "type": "guidance",
      "title": "Cloud data encryption",
      "summary": "Encrypt cloud data in transit and at rest, with keys in a KMS or BYOK design, not default storage alone.",
      "domains": ["infrastructure"],
      "status": "proposed",
      "tags": ["cloud", "kms"],
      "href": "/encryption/cloud-data-encryption",
      "framework": "encryption"
    }
  ]
}