WC-B-04Level 1 · Signal
Grants risky OAuth permissions
A risky Behavior signal from the SaaS security layer (SSE, oauth.grant.risky): this person consented to a third-party app that asked for broad scopes, such as full mailbox or drive access.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- GV.SC-07
- MITRE ATT&CK
-
- T1528
The definition, in detail
Definition
One consent screen gave a vendor standing access.
Example
A project manager approves a free meeting-notes app that requests read and write access to her whole mailbox and calendar; the grant appears in the next CASB review.
How it is measured
- Source
- Web, CASB & DLP
- Subject
- Person
- Event
- oauth.grant.risky
- Risk domain
- Web, cloud and SaaS
- Provenance
- Verizon DBIR, Framework research
How it is used
Programs count "Grants risky OAuth permissions" per person from Web, CASB & DLP and read it beside the other Web, cloud and SaaS signals; it feeds 1 cohort, 1 sequence and 1 breach scenario.
A "grants risky OAuth permissions" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0102Installs personal cloud backup tools on enterprise devices
- I.0109Shares cloud documents with public links
- I.0110Sets cloud file sharing to overly permissive levels
- I.0112Misconfigures cloud storage with public access
- I.0113Authorizes persistent access to third-party applications
- I.0114Grants OAuth access to untrusted vendors
- I.0115Installs unvetted browser extensions
- I.0118Ignores browser warnings about insecure websites
- I.0119Uses non-encrypted HTTP for sensitive web access
- I.0120Uses unsupported browsers for sensitive enterprise tasks
- I.0121Uses outdated browsers to access enterprise web apps
- I.0122Accesses self-hosted tools with expired SSL certificates
- I.0123Accesses enterprise web apps from high-risk geolocations
- I.0124Uses anonymity tools to bypass security controls
- I.0156Accesses unapproved cloud storage services
- I.0157Uploads sensitive data to personal cloud storage
- I.0158Visits newly registered or suspicious domains
- I.0159Installs vulnerable browser extensions
- I.0160Circumvents corporate proxy or VPN
- I.0161Attempts to access blocked or blacklisted websites
- I.0162Visits confirmed malicious websites
- I.0163Visits websites that trigger policy warnings
- I.0165Spends excessive time on social media websites
- I.0166Visits websites in risky categories
- I.0167Attempts to visit restricted websites but is blocked
- I.0168Uses non-business SaaS platforms excessively
- I.0169Transfers high volumes of files to cloud applications
- I.0171Uses multiple cloud services with overlapping functionality
- I.0180Downloads documents from unrecognized cloud platforms
- I.0384Violates security contract clauses
- I.0386Grants excessive access privileges
- I.0387Uses unmonitored API integrations
- I.0388Uses unapproved cloud providers
- I.0389Disposes sensitive data improperly
- I.0390Employs unverified subcontractors
- I.0391Operates domain on watchlist
- I.0394Supplies or operates vulnerable software or platforms
- I.0396Faces financial or legal instability
- I.0397Skips insider background screening
- I.0398Exhibits unusual access patterns
- I.0399Uses shared or generic credentials
- I.0402Delays breach notification
- I.0403Transfers data without logging
- I.0404Uses weak encryption standards
- I.0405Shares data with unapproved subprocessors
Continue exploring
"Grants risky OAuth permissions" (WC-B-04), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/wc-b-04-grants-risky-oauth-permissions
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.