When agencies give inverse split-tunnelled access to services on the internet (termed 'directly accessed services'), the threat and risk assessment should address: how those services authenticate agency device identities before granting access; how agency devices resolve internet addresses for those services securely; how communications between devices and those services are protected; how the agency monitors and records access to those services; how devices are protected from compromise given they can reach internet resources directly or be reached from the internet; how those services authenticate the user of the agency device before granting access, as distinct from authenticating the device; how the agency enforces multi-factor authentication with those services; how the agency authorises access to those services, including whether devices not authorised for agency remote access services can connect, noting that authorisation and authentication are separate activities; and how access to directly accessed cloud services is withdrawn when staff no longer need it or leave the agency.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.