Spoofing
What is Spoofing?
A technique where an attacker disguises their identity or the source of communication by falsifying data such as IP addresses, email headers, or caller IDs.
Terms that appear alongside spoofing
Each of these is named in at least one of the same controls as spoofing. The number is how many controls name both.
- resilience 4 shared controls
- enisa 4 shared controls
- nist 4 shared controls
- cybersecurity 4 shared controls
- risk assessment 3 shared controls
- cyber resilience 3 shared controls
- ransomware 3 shared controls
- audit 3 shared controls
Frameworks that govern spoofing
What the standards actually require on spoofing
Requirements naming spoofing across 6 standards, quoted from the control text.
Global Navigation Satellite System spoofing threats affecting positioning and timing must be shared.
CT-2 · GNSS Spoofing →When an originating C/CSP sees a material spoofing problem in its own customers' calls it investigates and acts to stop it, and if spoofing is confirmed sends the Appendix B details (the A-Party CLI where possible) to the ACMA by the agreed electronic channel....
australia-reducing-scam-calls-and-scam-sms-industry-code-c661-2022::4.2c · Counter CLI Spoofing: investigate, pass notifications up the chain, and report confirmed cases to the ACMA →The entity must implement anti-spoofing measures that detect forged source IP addresses and stop them getting into the trusted network.
1.4.3 · 1.4.3 Anti-spoofing measures at trusted boundary →The bank implements secure mail and messaging with measures against spoofing and look-alike domain abuse, malicious attachments and links, and spam, and requires partners and vendors to do likewise.
rbi-cybersecurity-framework-for-banks::117 · Para 117: secure mail and messaging: anti-spoofing, look-alike domains, malicious content, spam; partners too →Gateways perform ingress traffic filtering to detect and prevent IP source address spoofing.
ISM-1427 · Ingress filtering against IP spoofing →The authentication mechanism for IEC 60870-5 and its derivatives (DNP3 among them) addresses only spoofing, tampering, replay and, with the 2023 edition's encryption option, eavesdropping, as defined in part 2;
iec-62351-power-systems-communication-security::5:5.2 · Part 5, 5.2: threats addressed (spoofing, tampering, replay, eavesdropping) →Questions people ask about spoofing
What is Spoofing?
Why is Spoofing important for compliance?
Which compliance frameworks address Spoofing?
Where can I learn more about Spoofing?
See how Spoofing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.