S0182RS6-T21-S0182-Z · Full risk code

Insufficient Security in Inter-System Protocols

系統間通訊協定安全不足

Operation & Monitoring
Risk Description

When internal communication between systems is unencrypted; due to unmitigated control gaps, an attacker tampers with messages at the network layer and forges high-privilege instructions, triggering external stakeholder impacts and causing the receiving system executes them directly because the protocol has no verification, and later investigation cannot distinguish genuine from forged messages.

Framework Mappings

MITRE ATLASAML.T0051
NIST AI RMFMEASURE 2.7
ISO/IEC 23894§6.4
OWASP Top 10 for LLMLLM06
MAESTRO
ISO/IEC 5338運作與監控
MIT AI Risk RepositoryDomain 7

Risk Treatment & Implementation Guidance

Encrypt inter-system communication to prevent network-layer tampering and forgery; Authenticate between agents so receivers verify message origin and integrity before acting; Require signatures and anti-replay for high-privilege instructions