> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage.md). # Threat model coverage Modern businesses increasingly rely on SaaS apps like Google Drive, Box, Dropbox, and Slack to exchange sensitive data. Although these tools allow for real-time collaboration that drives business enablement, their lack of granular access and security controls presents serious material risks for the organizations that use them. DoControl addresses and handles the most significant SaaS security risks associated with organizational data access. For each of the following threat models, DoControl provides tools to monitor, mitigate, and remediate the associated risks: ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FhezkfRh8PCpXHX6kA7J4%2Fthreat%20categories.png?alt=media\&token=8cdfb333-570f-4275-ac3a-e7111bbb51c2) ## How DoControl addresses each threat model For each [threat model](#what-are-the-threat-models) in this section, we describe the full picture of the SaaS security challenges, and the functionality that DoControl provides to monitor and remediate the associated risks: * **SaaS security problem** - The current issue that organizations have to deal with as a result of unauthorized data access or data exfiltration, depending on the specific threat. * **DoControl solution** - In a nutshell, the tools DoControl provides to remediate the specific threat. * **Risk** - What's the risk this threat poses to your organization if left unremediated? * **DoControl inventory** - DoControl provides a consolidated view of data access exposure across all your SaaS apps. Learn how to filter assets according to a specific threat model, and apply inventory actions to remediate assets. * **DoControl events** - DoControl monitors real-time events of user activities. Learn how to filter events for a specific threat model, giving your organization full visibility into user and asset activity. * **File scanning** - DoControl supports regex scanning to detect expressions or strings in a file, and PII scanning to detect sensitive or personal information. Learn how to leverage file scanning to combat the risk associated with specific threat models, such as encryption key sharing, and sensitive data movement. * **DoControl alerts** - DoControl automatically notifies your organization when anomalous user behavior occurs. Alert types for each specific threat model are exposed, together with recommended actions to remediate alerts. * **DoControl playbooks** - DoControl provides you with pre-populated automated workflows to address various use cases for each specific threat model. You can easily and automatically remediate any risk associated with a specific threat, before it impacts your organization. ## What are the threat models? * [Asset monitoring and isolation](/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation.md) - Specific assets such as financial and HR documents contain highly-sensitive company information, and consequently, could be potentially targeted. By identifying these assets within your SaaS ecosystem, you can easily track their digital footprint and if necessary, isolate them from excessive exposure. * [Encryption key sharing](/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing.md) - Developers share encryption codes, such as AWS keys, via SaaS communication streams, and open the gate for unauthorized personnel to find them and access the production environment. * [External collaborator sharing](/docontrol-user-guide/risk-management/threat-model-coverage/external-collaborator-sharing.md) - Excess permission privileges are often granted to external users outside your organization. This significantly increases the amount of sensitive data vulnerable to exfiltration by malicious actors. * [4th party sharing](/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing.md) - An external party to your company shares your files or data with another party that is external to them. Such data access is an unfortunate and common side effect of SaaS collaboration. * [Identity risk management](/docontrol-user-guide/risk-management/threat-model-coverage/identity-risk-management.md) - Most attacks, breaches and security incidents are identity-initiated since they use the identities of internal users. * [Internal collaborator sharing ](/docontrol-user-guide/risk-management/threat-model-coverage/internal-collaborator-sharing.md)- Excess permission privileges were granted to cross-team users within your organization. Cross-team collaboration significantly increases the volume of sensitive data vulnerable to exfiltration. * [IT and security operations](/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations.md) - Organizations that rely solely on login credentials for secure authentication, without MFA (multi-factor authentication), are highly vulnerable to attack. * [Malware propagation prevention](/docontrol-user-guide/risk-management/threat-model-coverage/malware-propagation-prevention.md) - Assets were shared with or by a suspicious or malicious domain. If you share data with an infected URL, your organization's data could be exposed to ransomware, viruses, trojans, or other malware types that compromise your network. * [Personal account sharing](/docontrol-user-guide/risk-management/threat-model-coverage/personal-account-sharing.md) - When employees share data with their own personal email accounts, this opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. * [Private account sharing](/docontrol-user-guide/risk-management/threat-model-coverage/private-account-sharing.md) - Private sharing occurs when employees or third-party collaborators share data through personal email accounts, such as gmail or yahoo, which don't have the same level of security as company accounts. This opens the door to data exfiltration and increased risk of account takeover attacks, during and even after employees have left the company. * [Public sharing](/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing.md) - Sharing company assets publicly means they are now accessible to anyone on the web, since permissions are set to “anyone with a link” can view, edit or share. This is a convenient option for group collaboration, but publicly shared links can become overexposed entry points to sensitive data. * [Sensitive data movement](/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement.md) - When personally identifiable information (PII) is shared to publicly accessible locations, such as the Zoom cloud, or shared with many people, it remains exposed forever. This increases the risk of data breaches and unauthorized access to sensitive information. * [Shadow apps](/docontrol-user-guide/risk-management/threat-model-coverage/shadow-apps.md) - When employees add a third-party app, they effectively open the back door to a potential data leak. It's risky to grant data access to third-party apps that have not undergone security risk assessments, since too many interconnected apps can increase the risk of a supply-chain based attack. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.