Insufficient Security in Inter-System Protocols
系統間通訊協定安全不足
Operation & Monitoring
Risk Description
When internal communication between systems is unencrypted; due to unmitigated control gaps, an attacker tampers with messages at the network layer and forges high-privilege instructions, triggering external stakeholder impacts and causing the receiving system executes them directly because the protocol has no verification, and later investigation cannot distinguish genuine from forged messages.
Framework Mappings
MITRE ATLASAML.T0051
NIST AI RMFMEASURE 2.7
ISO/IEC 23894§6.4
OWASP Top 10 for LLMLLM06
MAESTRO
ISO/IEC 5338運作與監控
MIT AI Risk RepositoryDomain 7
Risk Treatment & Implementation Guidance
Encrypt inter-system communication to prevent network-layer tampering and forgery; Authenticate between agents so receivers verify message origin and integrity before acting; Require signatures and anti-replay for high-privilege instructions