Sign in Subscribe
By Austin Songer in Risk —

Threat Catalogue

Threat Catalogue

THREAT CATALOG use case: What natural and man-made threats affect control execution? (e.g., if the threat materializes, will the control function as expected?)

Definition of Threat

noun A person or thing likely to cause damage or danger.

verb To indicate impending damage or danger.

Logical Threats

Category: Intentional

Sub-Category: Conflict

Struggle resulting from incompatible or opposing needs, drives, wishes, or external or internal demands.
ID Threat Description
LIC1 Sabotage Deliberate actions aimed to cause disruption or damage to information and/or IT assets for financial or personal gain.
LIC2 Terrorism The use of violence as a means to create terror among masses of people; or fear to achieve a financial, political, religious, or ideological aim.
LIC3 Vandalism Deliberate destruction or damage to information and/or IT assets, but not for personal gain.
LIC4 Warfare Damage to assets, facilities, and employees due to war or armed conflict.

Sub-Category: Misappropriation

Dishonestly or unfairly taking for one's own use.
ID Threat Description
LIM1 Embezzlement To appropriate something, such as property, entrusted to one's care fraudulently to one's own use. A form of theft through fraud.
LIM2 Extortion The act of obtaining money, property, or services from an organization through coercion. A form of theft through use of force or intimidation to obtain compliance.
LIM3 Fraud Deliberate deception to secure unfair or unlawful gain, or to deprive a victim of a legal right.
LIM4 Theft The act of logically stealing and/or removing property with intent to deprive the rightful owner of it.

Sub-Category: Nefarious

Flagrant breaching of time-honored laws and traditions of conduct.
ID Threat Description
LIN1 Abuse of Authorizations Using authorized access to perform illegitimate actions.
LIN2 Address Space Hijacking The illegitimate takeover of groups of IP addresses.
LIN3 Alteration of Software Unauthorized modifications to code or configuration data, attacking its integrity.
LIN4 Anonymous Proxies Access of websites through chains of HTTP proxies (obfuscation), bypassing the security mechanism(s).
LIN5 Autonomous System Hijacking Overtaking, by the attacker, the ownership of a whole autonomous system and its prefixes, despite origin validation.
LIN6 Brute Force Unauthorized access via systematically checking all possible keys or passwords until the correct one is found.
LIN7 Code Injections Exploiting bugs, design flaws, or configuration oversights in an operating system or software application to gain elevated access to resources.
LIN8 Command Injection Execution of arbitrary commands on the host operating system via a vulnerable application. This attack differs from Code Injection, in that code injection allows the attacker to add their own code that is then executed by the application. In Command Injection, the attacker extends the default functionality of the application, which executes system commands, without the necessity of injecting code. Also known as "Remote Command Execution."
LIN9 Compromised Credentials An account/ID/username has been used or accessed by an unauthorized means.
LIN10 Denial of Service Service unavailability due to a massive number of requests for services from a single point.
LIN11 Distributed Denial of Service Service unavailability due to a massive number of requests for access to network services from multiple malicious clients.
LIN12 DNS Spoofing Domain name server cache poisoning or spoofing to divert traffic to malicious servers.
LIN13 Drive By Download A compromised website that has a user unintentionally download malware.
LIN14 Elevated Privileges Roles or permissions with more than the normal level of access that, if compromised, could allow a person to exploit the systems for personal gain or illicit purpose.
LIN15 Emission Attacks Spying on information through capturing emanations from operational equipment.
LIN16 HTML Script Injection A type of injection in which malicious scripts are injected into otherwise benign and trusted websites.
LIN17 Information Sharing The deliberate sharing of information with unauthorized entities, such as emailing sensitive information or file transfers.
LIN18 IP Spoofing IP spoofing is a method of attack under which incorrect IP addresses are used to disguise the attackers’ identity to the system being attacked.
LIN19 LDAP Injection To exploit web-based applications that construct LDAP statements based on user input.
LIN20 MAC Spoofing An attacker can change the Media Access Control (MAC) address of their device and send Ethernet frames in the network segment with a different ID, which can result in the possible circumvention of security mechanisms which are based solely on the use of a MAC address.
LIN21 Malicious Code Execution Injection of malicious code to extend the functionality of an application or information system without having to execute commands.
LIN22 Man in the Middle A type of eavesdropping attack that occurs when a malicious actor inserts himself as a relay/proxy into a communication session between people or systems.
LIN23 Manipulation of an Encryption Module Modification of an encryption module in order to read secret keys, change keys, or change security parameters.
LIN24 Manipulation of Data The modification of data with the intent to cause loss of integrity.
LIN25 Masquerade/Pretexting Lying or deceiving to pretend to be someone one is not.
LIN26 Message Replay Threat in which a valid data transmission is maliciously or fraudulently repeated or delayed.
LIN27 Misuse of Audit Tools The malicious use of network scanning tools to discover open and possibly unused ports, protocols, and services as well as vulnerabilities.
LIN28 Network Intrusion Unauthorized access to a network.
LIN29 Network Sniffing Identifying information about a network to find security weaknesses.
LIN30 Phishing An email fraud method in which the perpetrator sends out legitimate-looking emails in an attempt to gather personal and financial information from recipients. Typically, the messages appear to come from well-known and trustworthy websites.
LIN31 Quid Pro Quo The attacker promises to provide a benefit or service in the return of vital access or details.
LIN32 Ransomware Infection of a computer system or device by malware that restricts access to the system and information while demanding that the user pays a ransom to remove the restriction.
LIN33 Remote Access Trojan (RAT) Remote administration capabilities, allowing an attacker to control the victim's computer.
LIN34 Repudiation of Actions Intentional data manipulation to repudiate action.
LIN35 Reverse Engineering (RE) The process by which a man-made object is deconstructed to reveal its design, architecture, or to extract knowledge from the object.
LIN36 Rogue Access Points Unauthorized access via unmanaged access points to an organization's managed network.
LIN37 Rogue Certificates Use of rogue certificates that are valid certificates, by a legitimate certificate authority, which are untrustworthy.
LIN38 Rogue Security Software Malicious software that misleads users about their computer's security in order to manipulate them.
LIN39 Rootkits A set of software tools that enable an unauthorized user to gain control of a computer system without being detected.
LIN40 Routing Table Manipulation Routing network packets to IP addresses not intended by sender via unauthorized manipulation of routing table.
LIN41 Search Engine Poisoning Deliberate manipulation of search engine indexes to direct a user to malicious content on falsified sites.
LIN42 Server-Side Includes (SSI) Injection Allows the exploitation of a web application by injecting scripts into HTML pages or executing arbitrary codes remotely.
LIN43 SPAM Receiving unsolicited, undesired, or illegal email messages.
LIN44 Spear Phishing Phishing while tailoring the email to a specific audience.
LIN45 Spyware Software that aims to gather information about a person or organization without their knowledge.
LIN46 SQL Injection Takes advantage of the syntax of SQL to inject commands that can read or modify a database, or compromise the meaning of the original query.
LIN47 Trojan Any malicious computer program which misleads users of its true intent.
LIN48 Unacceptable Use Not abiding by the rules defined as acceptable by the governing or owning entity.
LIN49 Unauthorized Access Attaining logical access without permission or approval.
LIN50 Unauthorized Encryption Use of an unauthorized (insecure) encryption module that can lead to a false sense of protection for the data that the encryption was meant to provide.
LIN51 Unauthorized Software Installation The intentional installation of unmanaged or unauthorized software.
LIN52 Virus A computer program that can copy itself and infect a computer without permission or knowledge of the user. A virus might corrupt or delete data on a computer, use email programs to spread itself to other computers, or even erase everything on a hard disk.
LIN53 Vishing A form of fraud using voice over internet protocol in which individuals are tricked into revealing unauthorized access to sensitive information.
LIN54 War Driving The act of locating and possibly exploiting wireless networks. Example: Access Point Mapping.
LIN55 Watering Holes Malware residing on the websites which a group often uses.
LIN56 Web Spoofing Web spoofing occurs when an attacker forges an existing website (i.e., an attacker designs a fake website in such a way that it looks like the website of a known organization). The attacker attempts to draw users to the website with the objective of launching further attacks.
LIN57 Whaling A form of spear phishing that targets senior management, executives, or prominent individuals in order to gain access to sensitive information.
LIN58 Wire Tapping The surreptitious electronic monitoring of Internet-based communications.
LIN59 Worms Self-propagating, standalone malicious software.

Category: Unintentional

Sub-Category: Failure

Unexpected system degradation or failure.
ID Threat Description
LUF1 Third-Party Services Failure or disruption of third-party services required for proper operation of information systems. Example: Resources or Supporting Systems.
LUF2 Database Systems A database failure that may result in systems or applications not being available, which can have a significant impact on business operations, resulting in financial loss or potential brand damage.
LUF3 Network Bandwidth When the bandwidth of the network is insufficient, the transmission rate in the network (and eventually the availability in the network) will be severely limited to the organization's users, resulting in potential business disruptions.
LUF4 Network Routing The process of selecting a path for traffic in a network, or between or across multiple networks.
LUF5 Software/Code The failure of programs and other operations used by a computer.
LUF6 Storage The retention of retrievable data on a computer or other electronic system; memory.
LUF7 Virtual Parts & Components The failure/malfunction of virtual parts and components of IT hardware (e.g. motherboard, CPU, RAM, video card, hard drive, power supply). Failure of Virtual IT.

Sub-Category: Human

Human oriented errors or mistakes.
ID Threat Description
LUH1 Data Sharing/Leakage Unintentional distribution of covered information to an unauthorized entity by an employee or employees.
LUH2 Improper Data Modification Changing of data and records (information) stored in devices and storage media.
LUH3 Misclassifying of Data Inappropriate/inadequate labeling or classifying of Data media.
LUH4 Mishandling of Passwords Unintentional mishandling of passwords, leading to leakage of covered information.

Sub-Category: Misuse

Use in the wrong way or for the wrong purpose.
ID Threat Description
1 LUM1 Certificate Integrity Loss Loss of integrity of certificates used for authorization services.
2 LUM2 Compromised Credentials An account/ID/username has been used or accessed by an unauthorized means.
3 LUM3 Data Remanence Storage media that retains stored information in a retrievable/intact manner longer than desired (failure to totally erase).
4 LUM4 Data Storage Media Loss The loss of data via the loss of a data storage medium
5 LUM5 Database Integrity Loss Loss of the integrity or consistency of a database that may result in the data being incorrect or in a corrupt state and, as a result, may not be accessed or processed correctly.
6 LUM6 Elevated Privileges Roles or permissions thaty, if misused, could allow a person to exploit the systems for his or her own gain or purpose.
7 LUM7 Improperly Designing Information Systems Loss due to improper IT asset or business processes design (inadequate specifications of IT products, inadequate usability, insecure interfaces, policy/procedure flows, design errors, and changes).
8 LUM8 Improperly Designing Network Infrastructure Depending on the requirements defined by the organization, a poorly-planned network infrastructure may impact the confidentiality of data and the integrity of the network, which may lead to unauthorized disclosure of sensitive information to unauthorized users.
9 LUM9 Inappropriate/Inadequate Key Management Management of cryptographic keys in a cryptosystem. This includes dealing with the generation, exchange, storage, use, crypto shredding (destruction), and replacement of keys.
10 LUM10 Insufficiently or Inadequately Following Release Procedures Inadequate testing of new systems may result in possible errors in the hardware or software undetected, may remain undetected, or may result in significant disruption to IT operations or systems.
11 LUM11 Lack of (or Insufficient) Logging Lack of or insufficient logging may prevent the organization from determining whether security specifications were violated or whether attacks were attempted. Additionally, organizations may not be able to assess whether logged information can be used for error analysis in the event of damage, and for determining the causes of the damge, or for integrity tests.
12 LUM12 Loss Due to Unauthorized Storage Loss of records by improper/unauthorized use of storage devices.
13 LUM13 Misuse of Audit Tools The malicious use of network scanning tools to discover open and possibly unused ports, protocols, and services, as well as vulnerabilities.
14 LUM14 Mobile Device Applications Data Leakage Leaking covered information as a result of using mobile device applications.
15 LUM15 System Configuration Errors Information leak/sharing/damage caused by misuse of information assets (lack of awareness of application features) or wrong/improper information assets configuration or management.
16 LUM16 Unacceptable Use A violation of the set of rules applied by senior management or the asset/resource owner of a network, website, or service, that restrict the ways in which the network, website, or system may be used and sets guidelines as to how it should be used.
17 LUM17 Unmanaged Data Does not allow for prescription of information protection.
18 LUM18 Web Applications Data Leakage Leakage of covered information when using web applications.

Organizational Threats

Category:  Compliance

Sub-Category: Contractual

Entities or individuals seeking money or another specific performance rather than criminal sanctions due to non-compliance of a legal contract.
ID Threat Description
OCC1 Civil The process of resolving a legal dispute between two or more parties (individuals or business entities) who seek compensation for damages incurred or specific performances that were not delivered.

Sub-Category: Regulatory

Laws that govern the conduct of an entity, individual, or organization and often include penalties for violations.
ID Threat Description
OCR1 Administrative Specifically deals with the administrative agency's decision-making capabilities, as they carry out laws passed by state and federal legislatures. Differs from regular civil and criminal courts, and their authority is limited to making administrative decisions.
OCR2 Civil The process of resolving a legal dispute between two or more parties (individuals or business entities) who seek compensation for damages incurred or specific performances that were not delivered.
OCR3 Criminal Going to trial in a criminal court to either prosecute or defend oneself in a criminal matter.

Sub-Category: Statutory

Law enacted by legislation to govern entities.
ID Threat Description
OCS1 Civil The process of resolving a legal dispute between two or more parties (individuals or business entities) who seek compensation for damages incurred or specific performances that were not delivered.
OCS2 Criminal Going to trial in a criminal court to either prosecute or defend oneself in a criminal matter.

Physical Threats

Category:  Force Majeure

Sub-Category: Climatological

A major adverse event resulting from natural processes of the climate/temperature (e.g., extreme temperature, drought).
ID Threat Description
PFC1 Drought Prolonged period of abnormally low rainfall and a shortage of water, causing damage to assets.

Sub-Category: Environmental

Local conditions relating to the natural world.
ID Threat Description
PFE1 Humidity Water vapor in the air that can collect as condensation, causing water damage to assets.
PFE2 Contaminants The collection of tiny foreign particles that can have an adverse effect on assets.
PFE3 Corrosion Chemical (i.e., gaseous or liquid) contaminants, causing corrosion of assets.

Sub-Category: Geological

A major adverse event resulting from natural processes of the Earth (e.g., earthquake).
ID Threat Description
PFG1 Avalanche A mass of snow, ice, and rocks falling rapidly down a mountainside, damaging structures or assets in its path.
PFG2 Earthquake Sudden movement of a block of the Earth’s crust along a geological fault and associated ground shaking with the potential to damage assets.
PFG3 Landslide The sliding down of a mass of earth or rock from a mountain or cliff, damaging structures or assets in its path.
PFG4 Sinkhole A large hole that suddenly appears in the ground when the surface of the ground is no longer supported, causing damage to anything resting on that surface.
PFG5 Volcano Damage of assets caused by eruption and lava.
PFG6 Wildfires An uncontrolled or non-prescribed combustion of burning vegetation in a natural setting with the potential to damage or disrupt.

Sub-Category: Hydrological

A major adverse event resulting from natural processes of the water (e.g., flooding).
ID Threat Description
PFH1 Erosion Eroding of a surface by water, causing damage to structures and assets on the surface.
PFH2 Flood An overflowing of a large amount of water beyond its normal confines, especially over what is normally dry land causing damage to assets in the flood path.
PFH3 Tsunami Damage from a long, high sea wave caused by a underwater earthquake, landslide, or other disturbance.

Sub-Category: Meteorological

A major adverse event resulting from natural processes of the weather (e.g., tornado, hurricane).
ID Threat Description
PFM1 Blizzard Severe snowstorm with high winds and low visibility that can cause damage or accessibility issues.
PFM2 Cyclonic Storms Rapid circulation of air around a low pressure center with destructive surrounding weather, causing damage and accessibility issues.
PFM3 Hailstorm A storm that produces hail which reaches the surface, causing damage.
PFM4 Heat Waves A prolonged period of abnormally hot weather that can impact people and electronic systems.
PFM5 Ice Storm A storm of freezing rain which can damage assets.
PFM6 Lightning Damage of assets caused by a lightning strike (electrical overvoltage).

Category:  Intentional

Sub-Category: Conflict

Struggle resulting from incompatible or opposing needs, drives, wishes, or external or internal demands.
ID Threat Description
PIC1 Arson Intentionally setting fire to assets, causing damage.
PIC2 Large Events Disruption leading to adverse operations (i.e., demonstrations, riots, strikes, and protests).
PIC3 Sabotage Deliberately destroy, damage, or obstruct (something), especially for political or military advantage.
PIC4 Terrorism The use of intentionally indiscriminate violence as a means to create terror among masses of people; or fear to achieve a financial, political, religiousy, or ideological aim through physical violence.
PIC5 Vandalism Action involving deliberate destruction of or damage to property.
PIC6 Warfare Damage to assets, facilities, and employees due to physical war or armed conflict (e.g., bombing).

Sub-Category: Misappropriation

Dishonestly or unfairly taking for one's own use.
ID Threat Description
PIM1 Embezzlement To appropriate something, such as property entrusted to one's care, fraudulently to one's own use. A form of theft through fraud.
PIM2 Extortion The act of obtaining money, property, or services from an organization through coercion. A form of theft through use of force or intimidation to obtain compliance.
PIM3 Fraud Deliberate deception to secure unfair or unlawful gain, or to deprive a victim of a legal right. A form of theft through deception.
PIM4 Theft The act of physically stealing, taking, and removing property with intent to deprive the rightful owner of it.

Sub-Category: Nefarious

Flagrant breaching of time-honored laws and traditions of conduct.
ID Threat Description
PIN1 Abuse of Authority An employee that applies their authority incorrectly, or oversteps their level of authority.
PIN2 Dumpster Diving Searching through discarded assets with the intent of personal gain and/or damage.
PIN3 Information Sharing The deliberate sharing of non-public information with unauthorized entities, such as physically giving sensitive documents.
PIN4 Manipulation of Hardware Unauthorized changes to hardware devices, such as removing memory or hard drive.
PIN5 Masquerade/Pretexting Lying or deceiving to pretend to be someone one is not.
PIN6 Quid Pro Quo The attacker promises to provide a benefit or service in the return of vital access or details.
PIN7 Reverse Engineering (RE) The process by which a man-made object is deconstructed to reveal its design, architecture, or to extract knowledge from the object.
PIN8 Rogue Hardware Manipulation due to unauthorized hardware.
PIN9 Tailgating Unauthorized access by someone else's means of access at their time of entry.
PIN10 Unacceptable Use Not abiding by the rules defined as acceptable by the governing or owning entity.
PIN11 Unauthorized Access Attaining physical access without permission or approval.

Category:  Unintentional

Sub-Category: Failure

Unexpected system degradation or failure.
ID Threat Description
1 PUF1 Third-Party Services Failure or disruption of third-party services required for proper operation of information systems. Example: Supplies or resources.
2 PUF2 Cable Failure of communications links due to problems with cable networks (e.g., Copper & Fiber).
3 PUF3 Cross-talk A special form of line impairment, caused by currents and voltages of signals transmitted over adjacent lines. This may result in the disclosure of sensitive information.
4 PUF4 Electric Power Power failure with the potential to cause asset damage or unavailability.
5 PUF5 Equipment Fire Unexpected combustion of electronic equipment.
6 PUF6 Heating, Ventilation, and Air Conditioning (HVAC) Failure to maintain atmospheric conditions for assets.
7 PUF7 IT Hardware Failure or malfunction of parts and components of IT hardware (e.g., motherboard, CPU, RAM, video card, hard drive, power supply).
8 PUF8 Plumbing Failure of facility plumbing, including gas and water systems.
9 PUF9 Voltage Fluctuations in the supply voltage that can result in malfunctions and damage to IT systems.
10 PUF10 Wireless Failure of communications links due to problems with wireless networks (e.g., radio and RF).

Sub-Category: Human

Human oriented errors or mistakes.
ID Threat Description
1 PUH1 Absence of Personnel Unavailability of key personnel, their competencies/skills, and knowledge.
2 PUH2 Accidental Damage Sudden damage as a result of an unexpected and non-deliberate action.
3 PUH3 Accidental Fire Fire unintentionally set by a human.
4 PUH4 Loss of IT Assets Accidently or unintentionally losing any physical IT asset.
5 PUH5 Mishandling of Passwords Unintentional mishandling of passwords, leading to leakage of covered information.
6 PUH6 Unintentional Information Sharing Accidental verbal disclosure of sensitive information by unauthorized individuals overhearing.

Sub-Category: Misuse

Use in the wrong way or for the wrong purpose.
ID Threat Description
1 PUM1 Configuration Errors Loss of information due to errors in installation or system configuration.
2 PUM2 Improperly Designing Information Systems Loss due to improper IT asset or business processes design (inadequate specifications of IT products, inadequate usability, insecure interfaces, policy/procedure flows, design errors, and changes).
3 PUM3 Improperly Designing Network Infrastructure Depending on the requirements defined by the organization, a poorly planned network infrastructure may impact the confidentiality of data and the integrity of the network, which may lead to unauthorized disclosure of sensitive information to unauthorized users.
4 PUM4 Manipulation of Hardware Unauthorized changes to hardware devices such as removing memory or hard drive.
5 PUM5 Rogue Hardware Manipulation due to unauthorized hardware.
6 PUM6 Tailgating Unauthorized access by convenience or courtesy.
7 PUM7 Unacceptable Use A set of rules applied by senior management and/or the owner of the equipment, information, and etc. may be used and sets guidelines as to how it should be used.
Previous

SOC2 Code of Conduct Policy

 Next

Risk Catalogue

You might also like...