Threat Patterns

P.E.PpD+noDU.9

Process Process should not process data Data: process Process is in one of the restricted classes that may not process data, i.e. an authentication client or service, a specialised reverse proxy service or a remote access client or service. If the relationship between Process and Data is not an error, then the type of Process should be changed to a less restricted class.
P.E.HuirPsD.9

Data Data is both served by interactive process Process used by Human: this is not supported by the domain model as it leads to ambiguous dependencies. Please replace Process by two distinct processes, one used by Human and the other that serves Data, then specify which uses the other (usually the interactive process would use the data service, but this cannot be inferred automatically since it may not always be the case).
P.E.HuirIPp-xD.9

User Human of interactive process InteractiveProcess has no interaction with data Data used by InteractiveProcess: process InteractiveProcess is specialised to support user interaction with data, and cannot process data without inolving the user. The domain model infers the user interaction where possible, but in this case there is some ambiguity so you must specify whether Human enters, views or amends Data. If Human really does not interact with Data then either delete the relationship of InteractiveProcess to Data, or change the type of InteractiveProcess to a less specialised type of process.
P.E.HIP-Hu.9

Interactive process InteractiveProcess has no user: since InteractiveProcess is a specialised type of process designed to be user-driven, it cannot function without a user (a Human). This situation usually arises because either (a) the user of this process has been omitted, (b) the relationship of the user to InteractiveProcess has been omitted, whether direct or via a remote access client, or (c) access is remote but there is some inconsistency in the types of remote access clients and services used (which should be flagged as separate modelling errors).
D.E.Huv-iD-P.9

User Human cannot view data Data: the model specifies that Human is viewing Data, but Human is not using interacting with any process that processes Data and supports interactive output. To fix this, either (a) add a Process-receives-Data link from a process used by Human to view Data, (b) add an interaction (possibly via a remote access client) between Human and a process that is processing Data, or (c) remove the views relationship from Human to Data. The first two options may involve adding a suitable process if none has yet been included in the model.
H.W.HuHWES.3

Malware infection at Host due to execution of viral email attachment at WebBrowser on Host: the user Human runs a malicious file sent as an email attachment via webmail service MUA, infecting their client device Host.
D.E.HuaUD.9

Deprecated amends relationship between Human and Data: this relationship was asserted, but it is now an inferred relationship. The interaction between Human and Data should be expressed via an enablesUserUpdate relationship between a Process used by Human and the data Data.
D.E.HuaID.9

Deprecated enters relationship between Human and Data: this relationship was asserted, but it is now an inferred relationship. The interaction between Human and Data should be expressed via an enablesUserInput relationship between a Process used by Human and the data Data.
D.C.HuiRACHSPiD.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session in which Human enters Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.
D.C.HuiPiDCHS.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human enters Data via the user interface of Process on host device Host.
D.E.HuaVD.9

Deprecated views relationship between Human and Data: this relationship was asserted, but it is now an inferred relationship. The interaction between Human and Data should be expressed via an enablesUserOutput relationship between a Process used by Human and the data Data.

H.O.CVHHHoDC.0

Effect of overload at Host on SHost: if virtual host Host is overloaded, and allowed to scale up via elastic hosting on cluster SHost, the overload may propagate to SHost if not managed to prevent this by a Data Centre.
P.E.HuiHP.9

Cannot auto-provision interactive process Process: since process Process is used interactively by user Human, it does not make sense for it to be auto-provisioned. Deselect the control and use other measures instead, or remove the interaction between Human and Process .
Hu.E.Hum-iH-AC.9

User HostManager unable to manage device Host: since HostManager manages but does not interactWith Host, they must manage the device remotely. However this means they should connect to its login service from an authentication client on an interactive host, directly or via some other host. This is not the case, so HostManager may lack an interactive host device on which they can run a suitable client.
H.E.HCt.9

Host Host cannot be provisioned on container Container: Container is a simple host designed to host a packaged, stateless service, so cannot be used to provision host Host.
H.E.SHVH.9

Hosting error for virtual host VirtualHost: device SimpleHost is a specialised host that cannot provision virtual host VirtualHost. Either remove VirtualHost, or move its provisionedBy relationship to a more general purpose host.
H.E.CtDS.9

Data Data cannot be stored persistently in Container Container: host Container is a Container, which cannot retain persistent state internally.
H.A.CVHHDC.0

SLA constrained virtual host Host becomes unavailable: if clusterable virtual host Host running in data centre DataCentre becomes overloaded, and it is limited by an SLA from scaling up its use of resources at DataCentre, then it may become unavailable.
DF.A.PDF.6.2

Loss of availability from suspending the flow of unauthentic data Data from FlowsFrom to Process: if a contingency plan is used in which the flow of Data between FlowsFrom to Process is disabled if the data was subject to malicious tampering, then the flow of data Data from FlowsFrom to Process will become unavailable.
H.E.CtH-iP.9

Container Container cannot be provisioned on host Host: a Container can only be provisioned by a Pod, which Host is not.

DS.T.HPDFDAuDS.0

Data Data stored on Host cannot be updated by Process with input from FlowsFrom: process Process manages a stored copy of data Data on Host, so if a flows of updates from FlowsFrom is not available, then Process cannot update this copy of Data which will become out of date.
DS.T.HPDFDAuDS-V.6

Encrypted data Data stored on Host cannot be updated by Process with unencrypted input from FlowsFrom: process Process manages an encrypted stored copy of data Data on Host, so if the flows of updates from FlowsFrom is not encrypted, then Process cannot update this copy of Data without a key, so this copy will become out of date.
DS.T.HPDF-VDAuDS.6

Unencrypted data Data stored on Host cannot be updated by Process with encrypted input from FlowsFrom: process Process manages an unencrypted stored copy of data Data on Host, so if the flows of updates from FlowsFrom is encrypted, then Process cannot update this copy of Data without a key, so this copy will become out of date.
DS.T.HPDOuDS-V.6

Process Process cannot update encrypted data Data stored on Host: if the local copy of Data on Host is encrypted, then process Process that creates the data will be unable to save updates unless it has a key or can produce the data in the encrypted domain, so this copy of Data will become out of date.
DS.T.HP-iDOdDS.0

Output Data computed by Process from stale inputs is stored on Host: if process Process uses out of date inputs, then its output Data computed by Process (not obtained from a user) and saved locally on device Host will also be out of date.
DS.T.HuirPiDS.0

User Human interacting with Process provides stale input Data: user Human provides input Data which is stored by Process on Host, so if Human is working on outdated information, the stored copy will also be out of date.
DS.W.HPDFDADS.0

Flow of infected data Data from FlowsFrom is stored by data service Process: if the flow of data Data from FlowsFrom to Process is infected by malware, then so will be the copy saved locally on device Host by Process.
DS.X.HDS-V.6

Stored copy of Data on Host is encrypted: which means this copy is not available for unencrypted access.
DS.X.HDSV.6

Stored copy of Data on Host is encrypted: which means this copy is not available for unencrypted access.
DS.Y.HDS-V.8

Stored copy of Data on Host is unencrypted: which means this copy is not available for encrypted access.
Hu.T.HuirPvDF.0.1

User Human affected by out of date data Data from FlowsFrom received by Process: if the flow of data Data to Process is out of date, and this is displayed to user Human, they will start to make decisions based on the out of date information.
Hu.T.HuirPvDF.0.2

User Human affected by unavailable data Data from FlowsFrom received by Process: if the flow of data Data to Process is interrupted, that would have been displayed to user Human, they may make decisions based on the out of date information.
Hu.T.HuirPvDS.0.1

User Human affected by out of date data Data read by process Process: if a locally stored copy of Data is out of date, and this is loaded by process Process and displayed to user Human, they may make decisions based on the out of date information.
Hu.T.HuirPvDS.0.2

User Human affected by out of date data Data read by process Process: if a locally stored copy of Data is unavailable, and this would have been loaded by process Process and displayed to user Human, they may make decisions based on out of date information.
DS.W.HPsACDAdDS.7

Infected process Process infects data Data stored on host Host: the process having become infected by malware is able to insert itself into the stored copy of Data on its host device Host.
DS.T.HPDFDADS.0

Stale data Data from FlowsFrom is stored by data service Process on Host: if the flow of data Data from FlowsFrom to Process is out of date, then so will be the copy saved locally on device Host by Process.
DS.Auth.HsACDS-V.1.2

Use of admin privileges at Host to alter Data stored on Host: anyone with admin rights at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.
DS.I.HuirPiDS.0

User Human interacting with Process provides incorrect input Data: user Human provides incorrect input Data to Process, due to having previously received corrupt data from the system.
DS.A.PHHDS.3

Stored copy of Data on AHost lost due to theft or destruction of Host in Space : an attacker with access to Space can physically steal or destroy device Host, removing it from the system, rendering data stored on AHost unavailable. The threat to data is distinct from the threat to the host, as Host could be replaced if the loss is detected, but that would not restore the lost copy of Data.
DS.Auth.HPDFDADS.0

Flow of unauthentic data Data from FlowsFrom is stored by data service Process: if the flow of data Data from FlowsFrom to Process is unauthentic, then so will be the copy saved locally on device Host by Process.
DS.Auth.HPsACd-pDS-V.1

Use of Process to alter Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to serve and update the locally stored copy of Data.
DS.Auth.HPsACdpDS-V.1

Use of Process to alter Data on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to process and update the locally stored copy of Data.
DS.Auth.HPsACd-pDS-V.1.6

Use of compromised key at Process to alter Data stored on Host: someone with the rights of Process on its host device Host can alter the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
Hu.T.HuirPv-iD.0

User Human affected by out of date output Data from Process: if process Process is using out of date input, any output it provides for display to interactive user Human will be out of date, and will affect the user.
DS.T.HPDAuDS.0

Unavailable process Process cannot update stored copy of Data: if process Process is not available, then it cannot update a local stored copy of Data on Host, which will become out of date.
DS.Auth.HsACDS-V.1.3

Use of user privileges at Host to alter Data stored on Host: anyone with user privileges at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.
DS.C.HPsACrpDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and process the locally stored copy of Data.
DS.C.HPsACr-pDS-V.1.6

Use of compromised key at Process to access Data stored on Host: someone with the rights of Process on its host device Host can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
DS.C.HsACDS-V.1.2

Use of admin privileges at Host to access stored data Data: anyone with admin rights at Host can read (unencrypted) copies of Data stored on the Host.
DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.
DS.I.HPDFDADS.0

Flow of corrupt data Data from FlowsFrom is stored by data service Process: if the flow of data Data from FlowsFrom to Process is corrupt, then so will be the copy saved locally on device Host by Process.
DS.I.HP-iDS.0

Unreliable process Process corrupts locally stored copy of Data: if process Process is not reliable, it may accidentally corrupt a copy of Data stored on its host device Host, to which it has write access.
DS.C.HPsACr-pDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and serve the locally stored copy of Data.
Hu.U.HuirPvDF.0

User Human affected by corrupt data Data from FlowsFrom received by Process: if the flow of data Data to Process is corrupt, and this is displayed to user Human, they may make decisions based on the incorrect information.
P.E.HPDDR+DS-DFfo+foDF.9

Relay Process has no source for stored data Data: the model specifies that Process serves Data that is not stored on the process host Host. This means Process is acting as a data relay between a data producer process and a service providing access to a stored copy. However, while Process can send data to such a storage service, there are no flows of Data to Process, implying that Process cannot communicate wth any process that produces Data. This may mean such a process, or the relationshp from such a process to Data has been omitted, or that Process was meant to be a data storage service rather than a relay, i.e., that Data should be stored on Host.
Hu.U.HuirPvDS.0

User Human affected by corrupt data Data read by process Process: if a locally stored copy of Data is corrupt, and this is loaded by process Process and displayed to user Human, they may make decisions based on incorrect information.
P.O.DA-VPpDA.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.
P.O.PpDADA-V.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.
P.T.HP-iDSDI.0

Stale input Data stored at Host delays Process: since process Process uses the locally stored copy of data Data on Host, if that copy becomes out of date, Process will be processing out of date information.
P.T.HP-uDSDI.0

Lack of stored input Data at Host delays Process: since process Process uses the locally stored copy of data Data but does not depend on it, if that copy is unavailable, the process can continue but will be processing out of date information.
P.T.HP-uDS-VDI.6

Process Process cannot read encrypted input Data: the stored copy of input Data at Host is encrypted, so if the process lacks a key and cannot read updates of the data, it will be forced to work using outdated inputs.
P.T.HuirPiD-DF-DS.0

User Human provides out of date input Data affecting Process: user Human, working on the basis of outdated information, provides out of date input Data, which is consumed (not saved or forwarded) by and affects Process.
P.E.PDO+DS-S.9

Process Process cannot save data Data: process Process produces Data as output (or gets it from an interactive user), and Data is stored on at least one host. However, there is no way for Process to send new values for storage to a process on that host with access to the data, either directly or via other processes. You should add one or more process-process uses relationships (and possibly processes) to the model so a continuous path exists between such a process and Process.
P.T.PcPr-uDS-V.6

Process Client cannot access updates of Data from Service due to inconsistent encryption: processes Client and Service both access a copy of Data stored in encrypted form, so they need a secure way to also share the cryptographic keys used.
P.T.P-uDFDI.0

Loss of availability in flow of Data to Process caused a delay in processing: since process Process uses the incoming copy of data Data but does not depend on it, if that copy is unavailable, the process can continue but will be processing out of date information.
P.U.HP-iDSDI.0

Corrupt input Data stored at Host affects Process: since process Process uses the locally stored copy of data Data on Host, if that copy becomes corrupt Process will become unreliable.
P.U.HP-iDSDI.3

Loss of reliability at process Process due to forged input Data: process Process uses the copy of Data stored on Host as input so if this is forged by an attacker, Process may become unreliable.
P.U.HuirPiD-DF-DS.0

User Human provides incorrect input Data affecting Process: user Human provides incorrect input Data, which is consumed (not saved or forwarded) by and affects Process.
P.U.P-iDFDI.0

Loss of reliability at process Process due to corrupt input Data from FlowsFrom: process Process uses the copy of Data sent by FlowsFrom as input so if this is corrupt, Process may become unreliable.
P.U.P-iDFDI.3

Loss of reliability at process Process due to forged input Data: process Process uses the copy of Data sent by FlowsFrom as input so if this is forged by an attacker, Process may become unreliable.
P.T.P-iDFDI.0

Stale input Data from FlowsFrom delays Process: since process Process uses the copy of data Data arriving from FlowsFrom and not updated by an interactive user, if that copy becomes out of date, Process will be performing computation based on out of date information.
Hu.U.HuirPvDF.3

User Human affected by accessing forged Data from FlowsFrom via Process: user Human interacts via Process with data Data sent from FlowsFrom, so if the incoming data contains malicious alterations, then Human may make decisions based on false information.
P.E.PDIDDF-DA.9

Process Process cannot access data field DataField: process Process uses data Data as input, and does not ignore field DataField contained by Data (meaning it uses the field). However, Process does not deserialize any stored or exchanged copy of Data that includes the required field.
P.E.PDI+DO-DS-S.9

Process Process cannot access data Data: process Process uses Data as input or for display to an interactive user. In this case, Data is not stored anywhere, and there is no way for Process to be sent new values from a process that creates Data as output, either direct or via other processes. You should add one or more process-process uses relationships (and possibly more processes) to the model so a continuous path exists from such a process, via intermediaries if appropriate. Alternatively, add a stores relationship to Data from a host, and creates such a path to a process on that host with access to the stored data.
Hu.U.HuirPvDS.3

User Human affected by forged data Data read by process Process: if a locally stored copy of Data contains malicious alterations designed to deceive, and this is loaded by process Process and displayed to user Human, they may make decisions based on false information.
Hu.U.HuirPv-iD.0

User Human affected by output Data from unreliable process Process: if process Process is unreliable, any output it provides for display to interactive user Human is likely to be incorrect and may affect the user.
P.A.HPuDS-VDI.6

Process Process cannot read encrypted input Data stored on Host: the stored copy of input Data at Host is encrypted, and the process does not have a key.
P.A.PcPuDS-V.6

Process Client cannot access input Data from Service due to inconsistent encryption: processes Client and Service both access a copy of Data stored in encrypted form, so they need a secure way to also share the cryptographic keys used.
P.A.PuDFDI.0

Lack of incoming Data affects availability of Process: process Process depends on an incoming flow of Data from FlowsFrom, so if that is unavailable the availablity of the process will be affected.
P.E.DAVPDA.9

Process Process should not consume Databy using homomorphic encryption: the serialised form of Data is encrypted using a shared key controlled by Vault, so it makes no sense to process this data in the encrypted domain. The domain model does not support such an arrangement.
P.E.PDI+DS-S.9

Process Process cannot access data Data: process Process uses Data as input (or for display to an interactive user), and Data is stored on at least one host. However, there is no way for Process to receive new values from a process on that host with access to the data, either directly or via other processes. You should add one or more process-process uses relationships (and possibly processes) to the model so a continuous path exists between such a process and Process.
P.E.HPDDR+DS+DFfi-fiDF.9

Relay Process has no destination for stored data Data: the model specifies that Process serves Data that is not stored on the process host Host. This means Process is acting as a data relay between a service providing access to a stored copy, and a data consumer process. However, while Process can get data from such a service, there are no flows of Data from Process, implying that Process cannot communicate wth any process that consumes Data. This may mean such a process, or the relationshp from such a process to Data has been omitted, or that Process was meant to be a data storage service rather than a relay, i.e., that Data should be stored on Host.
DS.A.HsACDS.1.3

Use of user privileges at Host to control availability of Data: anyone with user privileges at Host can delete or otherwise prevent access to copies of Data stored on the Host.
P.E.HPDDR-DS+DFfi-fiDF.9

Disconnected relay Process for volatile data Data: the model specifies that Process serves Data that is not stored on the process host Host. This means Process is acting as a data relay between a data producer process and a data consumer process. However, although there is a flow of Data to Process, it is not forwarded, implying that Process cannot communicate wth any process that consumes Data. This may mean such a process, or the relationshp from such a process to Data has been omitted, or that Process was meant to be a data storage service rather than a relay, i.e., that Data should be stored on Host.
P.E.HPDDR-DS-DA2.9

Disconnected relay Process for volatile data Data: the model specifies that Process serves Data that is not stored on the process host Host. This means Process is acting as a data relay between a data producer process and a data consumer process. However, there is no flow of data Data through Process, implying either that it cannot communicate wth any process that produces Data. This may mean such a process, or the relationshp from such a process to Data has been omitted, or that Process was meant to be a data storage service rather than a relay, i.e., that Data should be stored on Host.
P.E.HuirPD.9

Inappropriate use of encrypted domain processing of Data at Process: Process is interactive, so user Human will need to work with data Data, which means the processing cannot be done in the encrypted domain. To fix this error, deselect encrypted processing controls.
P.E.PaD-DS.9

Process Process cannot amend volatile data Data: since Datais not stored on any host, it is not possible for Process to amend or update Data. For that to happen, Process would need to get a current value and then change it. This only makes sense if Data is persistent. If the relationship of Process to Data is correct, then there is a missing host 'stores' data relationship. If Data really is volatile, change the relationship of Process to Data to specify whether Process creates or uses Data (but not both).
P.E.PDADAV.9

Process Process should not produce Databy using homomorphic encryption: the serialised form of Data is encrypted using a shared key controlled by Vault, so it makes no sense to process this data in the encrypted domain. The domain model does not support such an arrangement.
P.E.HPDDR+DS-DA2.9

Disconnected relay Process for stored data Data: the model specifies that Process serves Data that is not stored on the process host Host. This means Process is acting as a data relay between a data store and other processes. However, there is no flow of data Data through Process, implying that it cannot communicate wth any process that produces Data or provides access to a local copy on its host. This may mean such a process, or the relationshp from such a process to Data has been omitted.
DS.A.HsACDS.1.2

Use of admin privileges at Host to control availability of Data: anyone with admin rights at Host can delete or otherwise prevent access to copies of Data stored on the Host.
P.A.HPuDSDI.0

Process Process cannot access copy of Data stored on Host: since process Process depends on having access to Data via a stored copy on its host device Host , if the stored copy is not available then the availability of Process will be affected.
DS.A.HPsACDAdDS.7

Infected process Process encrypts or deletes data Data: the process having become infected by malware is able to delete or otherwise disable access to the stored copy of Data on its host device Host.
DB.O.HDBsD-V.6

Database service Service overloaded by cryptographic overheads: the stored copy of Data on device Host is encrypted, so the database service Service has to decrypt entire tables to run queries, making query processing inefficient.
DF.A.CSDF-VdDA2.6

Inconsistent encryption of Data flowing from Service to Client: processes Client and Service exchange data Data in encrypted form but uses a key to encrypt or decrypt between transfer and processing, so they need a secure way to also share the cryptographic key used.
DF.A.HPDF-VDI.6

Process Process cannot consume encrypted data Data from FlowsFrom: the flow of Data from FlowsFrom to Process is encrypted, so it cannot be consumed without a key.
DF.A.HPDODF-V.6.1

Process Process cannot encrypt output Data for transmission to FlowsTo: the flow of output data Data from Process to FlowsTo should be encrypted, but Process has no means to encrypt the data before sending it.
DF.A.HPDODF-V.6.2

Process Process cannot decrypt output Data computed in the encrypted domain: the flow of output data Data from Process to FlowsTo should be decrypted, but process Process computed it in an encrypted domain (using a secure computation method such as homomorphic encryption) and has no means to decrypt the result before sending it.
DF.A.HPDSDADF.0

Service Process cannot serve unavailable data Data to FlowsTo: the locally stored copy of Data on Host used by Process is not available, so cannot be sent in a data flow to FlowsTo.
DB.O.HDBsDV.6

Database service Service overloaded by cryptographic overheads: the stored copy of Data on device Host is encrypted with keys from Vault, so the database service Service has to decrypt entire tables to run queries, making query processing inefficient.
DF.A.HPDS-VDADF.6

Service Process cannot decrypt data Data for transmission to FlowsTo: the stored copy of Data on Host is encrypted, but FlowsTo expects an unencrypted version, and Process has no means to decrypt the data before sending it.
DF.A.PDF.6.3

Loss of availability from suspending the flow of corrupt data Data from FlowsFrom to Process: if a contingency plan is used in which the flow of Data between FlowsFrom to Process is disabled if the data is corrupt, then the flow of data Data from FlowsFrom to Process will become unavailable.
DF.A.PDF.6.4

Loss of availability from suspending the flow of infected data Data from FlowsFrom to Process: if a contingency plan is used in which the flow of Data between FlowsFrom to Process is disabled if the data becomes infected with malware, then the flow of data Data from FlowsFrom to Process will become unavailable.
DF.A.PmDFIDADFI.0

Data Data cannot be forwarded by Process to FlowsTo because the incoming data flow is not available: if the flow of data Data to Process is unavailable, the flow of the same data from Process to FlowsTo will also be unavailable.
DF.A.PmDFIDADFI-k.6

Unencrypted data Data cannot be forwarded by Process to FlowsTo: if the flow of data Data to Process is not encrypted, it cannot be forwarded to FlowsTo which expects it to be encrypted.
DF.A.PmDFI-kDADFI.6

Encrypted data Data cannot be forwarded by Process to FlowsTo: if the flow of data Data to Process is encrypted, it cannot be forwarded to FlowsTo which expects it to be unencrypted.
DF.A.PmDFODADFO.0

Data Data cannot be forwarded by Process to FlowsTo because the incoming data flow is not available: if the flow of data Data to Process is unavailable, the flow of the same data from Process to FlowsTo will also be unavailable.
DF.A.PDF.6.1

Loss of availability in the disabled flow of data Data from FlowsFrom to Process: the flow of Data between FlowsFrom to Process has been disabled to maintain security or prevent a breach of regulations, but as a result the data flow is now unavailable.
DF.A.PmDFODADFO-k.6

Unencrypted data Data cannot be forwarded by Process to FlowsTo: if the flow of data Data to Process is not encrypted, it cannot be forwarded to FlowsTo which expects it to be encrypted.
DB.O.DSPDF-VDB.6.2

Data service Process overloaded by decryption of data Data for Service: since data Data stored on Host is encrypted, query processing by Service will require decryption of a large volume of data. The resulting computational overhead may overload the data server Process.
DB.O.DSPDF-VDB.6.1

Database service Service overloaded by decryption of data Data from Process: since data Data stored on Host is encrypted, query processing by Service will require retrieval and decryption of a large volume of data. The resulting computational overhead may overload database service Service.
DS.A.HPsACDOdDS-V.6

Process Process cannot create decrypted output data Data: if the local copy of Data is sypposed to be decrypted, then process Process creating the data in the encrypted domain will be unable to store the output.
D.A.DallDS.0

Loss of availability in all copies of Data: the system is supposed to store the data Data, so if there are no available stored copies, the system-level availability of Data is affected.
D.C.HuiPv-iDFCHS.3

Data Data sent from FlowsFrom to Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.
D.C.HuiPv-iD-FCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.
D.C.HuiRACv-iDFCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.
D.E.D+DS-cP-iHu.9

Stored data Data is not created by any process: this may mean it is static data inserted into the system during deployment on at least one system host. If so, use controls to specify that this is the case. If it is not static data then there should be at least one process that creates, amends, updates or appends the data.
DB.O.DSPDFVDB.6.2

Data service Process overloaded by decryption of data Data for Service: since data Data stored on Host is encrypted with keys from Vault, query processing by Service will require decryption of a large volume of data. The resulting computational overhead may overload the data server Process.
D.E.D-DS-cP-iHu.9

Data Data is not created by any process or user nor stored on any host: this means the data is neither dynamic data created or updated in the system, nor static data stored in the system. Since Data must be one or the other, there must be an error in the model. If Data is static, initialised when the system is deployed, then specify on which host it is stored. Otherwise, specify a process that creates, amends, updates or appends the data, or a user that inputs the data.
D.I.D.0

Corruption of data Data: if an attacker can inject forged (unauthentic) content into data Data somewhere within the system, then there is also a loss of integrity in data Data.
DB.A.DBsDRDF-V.6

Database Service cannot process queries on encrypted data Data accessed via FlowsFrom: the flow of data Data supplied by FlowsFrom is encrypted. While a database can serve encrypted data, it cannot process a query based on data values without some means of access.
DB.A.HDBsD-V.6

Database Service cannot process queries on encrypted data Data stored on Host: the stored copy of input Data at Host is encrypted. While a database can serve encrypted data, it cannot process a query based on data values without some means of access.
DB.O.DA-VDBs-pDA.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.
DB.O.DBs-pDADA-V.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.
DB.O.DSPDFVDB.6.1

Database service Service overloaded by decryption of data Data from Process: since data Data stored on Host is encrypted with keys from Vault, query processing by Service will require retrieval and decryption of a large volume of data. The resulting computational overhead may overload database service Service.
D.E.HuaD-DS.9

User Human cannot amend volatile data Data: since Datais not stored on any host, it is not possible for Human to amend (or view and input) Data. For that to happen, Human (via some interactive process) would need to load the data from local or remote storage, then apply changes. If the relationship from Human to Data is not an error, add a 'stores' relationship to Data from a host where it is stored.
DF.A.PmDFO-kDADFO.6

Encrypted data Data cannot be forwarded by Process to FlowsTo: if the flow of data Data to Process is encrypted, it cannot be forwarded to FlowsTo which expects it to be unencrypted.
DF.A.HPDSDADF-V.6

Service Process cannot send unencrypted data Data to FlowsTo: because the stored copy of Data on Host is not encrypted, and FlowsTo expects an encrypted version, it is not possible for Process to send it without a key.
DF.Auth.HPDSDADF.0

Service Process serves an unauthentic stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is unauthentic, so will the flow of Data served to FlowsTo.
DF.W.HDCDF.0

Cached flow of data Data from FlowsFrom to FlowsTo infected on Host: if the flow of Data from FlowsFrom to FlowsTo is cached on Host, and the cache gets infected by malware, the data flow will be affected. This is a secondary threat whereby changes to the cache propagate to the data flow - the cause is whatever infected the cache.
DF.W.HPDADF.7

Malware insertion in flow of Data to FlowsTo by Process to : if process Process is infected by self-propagating malware, it may insert the malware into the copy of Data sent to process FlowsTo.
DF.W.HPDSDADF.0

Service Process serves an infected stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is infected by malware, so will the flow of Data served to FlowsTo.
DF.W.PDFIDADFI.0

Infected data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is infected by malware, so is the forwarded flow to FlowsTo.
DF.W.PDFODADFO.0

Infected data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is infected by malware, so is the forwarded flow to FlowsTo.
DF.X.PDFV.6

Flow of Data from FlowsFrom to Process is encrypted: which means the inflowing copy of the data is not available for unencrypted access.
DF.X.PDF-V.6

Flow of Data from FlowsFrom to Process is encrypted: which means the inflowing copy of the data is not available for unencrypted access.
DF.Y.PDF-V.8

Flow of Data from FlowsFrom to Process is unencrypted: which means the inflowing copy of the data is not available for encrypted access.
DF.Auth.HDCDF.0

Cached flow of data Data from FlowsFrom to FlowsTo altered on Host: if the flow of Data from FlowsFrom to FlowsTo is cached on Host, and an attacker is able to tamper with the cache, the data flow will be affected. This is a secondary threat whereby changes to the cache propagate to the data flow - the attack will be what caused the cache to lose authenticity.
DS.A.HPDAcDS.0

Unavailable process Process cannot create stored copy of Data on Host: if process Process is not available, then it cannot create a local stored copy of Data on Host, so that copy will not be available.
DS.A.HPDOcDS-V.6

Process Process cannot create encrypted data Data: if the local copy of Data is encrypted, then process Process that creates the data will be unable to store that copy unless it has a key or can produce the data in the encrypted domain.
DS.A.HPmDFDAcDS.0

Data Data cannot be stored on Host by Process due to lack of incoming data flows: service Process manages storage of data Data, but if no flows of Data to Process are available, it cannot save a copy of Data on its host Host, which will therefore be unavailable.
DS.A.HPmDFDAcDS-k.6

Decrypted data Data cannot be stored on Host by Process: service Process manages storage of an encrypted copy of data Data, so if all flows of Data to Process are decrypted the stored copy cannot be created unless Process has an encryption key.
DS.A.HPmDF-kDAcDS.6

Encrypted data Data cannot be stored on Host by Process: service Process manages storage of an unencrypted copy of data Data, so if all flows of Data to Process are encrypted the stored copy cannot be created unless Process has a decryption key.
DS.A.HPsACDAdDS.1

Use of Process to prevent access to Data: someone with the rights of Process on its host device Host can exploit the rights of Process to delete the locally stored copy of Data.
DF.T.PDFODADFO.0

Out of date data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is out of date, the forwarded flow to FlowsTo will also be out of date.
DF.T.PDFIDADFI.0

Out of date data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is out of date, the forwarded flow to FlowsTo will also be out of date.
DS.A.HDS.7

Infected host Host encrypts or deletes data Data: an attacker having infected device Host with malware exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.
DF.T.HP-iDODF.0

Output Data produced by Process based on out of date inputs: if process Process is unable to access inputs in a timely manner, then the output Data it sends to FlowsTo will also be out of date.
DF.T.HuirPiDF.0

User Human interacting with Process provides out of date input Data: user Human provides out of date input Data to Process, due to having not previously received data in a timely fashion from the system.
DF.Auth.HuWESDF.3

Phishing attack fools Human feeding malicious URL to WebBrowser: user Human viewing email via webmail service MUA clicks on a malicious link, sending it to their web browser WebBrowser.
DF.Auth.HuWSMSDF.3

Smishing attack fools Human feeding malicious URL to WebBrowser: user Human clicks on a malicious link in a text message on their phone Host, sending it to their web browser WebBrowser.
DF.Auth.PDFIDADFI.0

Unauthentic data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is unauthentic, so is the forwarded flow to FlowsTo.
DF.I.HDBDRDF.0

Loss of reliability at DB corrupts outbound flow of data Data to FlowsTo: if there is a loss of reliability at process DB it may send corrupt output Data to FlowsTo. Normally, this is not considered likely when DB is acting only as a data relay, but DB is a DB process which processes incoming queries before requesting or forwarding data, so a loss of reliability may lead to the wrong data being retrieved or updated.
DF.I.HDBDSDF.0

Loss of reliability at DB corrupts outbound flow of data Data to FlowsTo: if there is a loss of reliability at process DB it may send corrupt output Data to FlowsTo. Normally, this is not considered likely when DB is serving stored data, but DB is a DB process, so it selects data by processes incoming queries, so a loss of reliability may lead to retrieval or update of the wrong data.
DF.I.HDCDF.0

Cached flow of data Data from FlowsFrom to FlowsTo corrupted on Host: if the flow of Data from FlowsFrom to FlowsTo is cached on Host, and the cache is corrupt, the data flow will be affected. This is a secondary threat whereby changes to the cache propagate to the data flow - the cause is whatever caused the cache to lose integrity.
DF.Auth.PDFODADFO.0

Unauthentic data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is unauthentic, so is the forwarded flow to FlowsTo.
DF.Auth.HuWEDF.3

Phishing attack fools Human into loading malicious URL to WebBrowser: user Human viewing email in their mail client MUA clicks on a malicious link, sending it to their web browser WebBrowser.
DF.I.HP-iDODF.0

Loss of reliability at Process corrupts outbound flow of data Data to FlowsTo: if there is a loss of reliability at process Process it may send corrupt output Data to FlowsTo.
DF.I.HuirPiDF.0

User Human interacting with Process provides incorrect input Data: user Human provides incorrect input Data to Process, due to having previously received corrupt data from the system.
DF.I.PDFIDADFI.0

Corrupt data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is corrupt, so is the forwarded flow to FlowsTo.
DF.I.PDFODADFO.0

Corrupt data Data from FlowsFrom forwarded by Process to FlowsTo: if the flow of data Data from process FlowsFrom to process Process is corrupt, so is the forwarded flow to FlowsTo.
DF.T.HPDSDADF.0

Service Process serves an out of date stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is out of date, so will the flow of Data served to FlowsTo.
DF.I.HPDSDADF.0

Service Process serves a corrupt stored copy of data Data to FlowsTo: if the locally stored copy of Data on Host served by Process is corrupt, so will the flow of Data served to FlowsTo.

P.GDPR.HuDoPS-o.6

Lack of legal basis to store Data related to DataSubject at Service: since data Data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to collect and process their data. In this case the subject controls a process that is using the data, but not the service where it is stored, so consent is still needed to manage the data on their behalf.
P.GDPR.HuSDPS-io.9

Condition for processing special category Data related to DataSubject: since the data Data being processed is special category data, it may be necessary to obtain consent from the data subject DataSubject even if the legal basis for processing is not based on consent.
P.GDPR.HuSDPoS-i.9

Condition for processing special category data Data related to DataSubject: since the data Data being processed is special category data, it may be necessary to obtain consent from the data subject DataSubject even if the legal basis for processing is not based on consent.
P.GDPR.HuDPS-io.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data.
P.GDPR.HuDPoS-i.6

Lack of legal basis for use of Data related to DataSubject by Process: since the data is related to a person DataSubject who is a citizen or resident in a state where the GDPR applies, a legal basis is required to process the data. Since DataSubject controls the device where the data is stored, this can only be by consent or to protect vital interests if incapacitated.
P.GDPR.HuDPoJoSt.1

Personal data Data related to DataSubject should be processed in a suitable location: since Data relating to DataSubject is subject to the GDPR, it should be processed in a GDPR-compliant jurisdiction or by a Privacy Shield approved operator. If neither of these regulatory/contractual solutions are available, you need to move the process to a different host, or move the host.
P.GDPR.Hu-aDPS-io.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.
D.GDPR.HuDSH-St.1

Personal data Data has no data controller: under the GDPR, a data controller (a person or in most cases, an organisation) who alone or jointly with others, determines the purposes and means of the processing of personal data, and has certain responsibilities defined by Article 24. Data Data relates to the data subject DataSubject and is subject to the GDPR, so there should be a controller. Add an organisation or user if not already included, and a hasController relationship from Data to its data controller.
P.GDPR.Hu-aDoPS-o.8

Extra measures are needed for Service to store Data related to DataSubject who may be a child: the legal basis for this data processing Data relating to DataSubject under the GDPR is consent, but DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.
H.GDPR.HuDSHoJoSt.1

Personal data Data should be stored in a suitable location: since Data relating to DataSubject is subject to the GDPR, it should be stored in a device in a GDPR-compliant jurisdiction or run by a Privacy Shield approved operator. If neither of these regulatory/contractual solutions are available, you need to store the data on a different device.
D.GDPR.NDFHuoO.1

Nationally regulated personal data Data is transferred across borders: since Data related to DataSubject is subject to national regulations even under the GDPR, it should not be transferred by process FlowsFrom in jurisdiction Jurisdiction to process Process operating in jurisdiction RemoteJurisdiction without suitable analysis of the national regulations in both jurisdictions.
D.GDPR.HuDP-St.1

Personal data Data has no data controller: under the GDPR, a data controller (a person or in most cases, an organisation) who alone or jointly with others, determines the purposes and means of the processing of personal data, and has certain responsibilities defined by Article 24. Data Data relates to the data subject DataSubject and is subject to the GDPR so there should be a controller. Add an organisation or user if not already included, and a hasController relationship from Data to its data controller.
D.GDPR.DSHuoO.1

Personal data Data related to DataSubject is communicated across borders: since the data subject DataSubject is subject to the GDPR, their data Data it should not be communicated via process Process in jurisdiction RemoteJurisdiction that does not enforce the GDPR or equivalent protection, without suitable protection measures.
D.GDPR.DFHuoO.1

Personal data Data related to DataSubject transferred across borders: since the data subject DataSubject is subject to the GDPR, their data Data should not be communicated by process FlowsFrom across a border to process Process in jurisdiction RemoteJurisdiction unless the GDPR is in force or equivalent protection is provided.
P.GDPR.Hu-aDPoS-i.8

Extra measures are needed for Process to use Data related to DataSubject who may be a child: the legal basis for this data processing under the GDPR is consent, but the subject DataSubject may be a child, so additional measures are necessary for their consent to be valid. If DataSubject cannot be a child, then change them from type Human to type Adult to eliminate this threat.

Se.T.SePDsFF.0

Loss of timeliness at sensor Sensor: if the onboard data received from a sensor by any client is out of date, it is modelled as a loss of timeliness at the sensor.
Se.I.SePDsFF.0

Loss of integrity at sensor Sensor: if the onboard data received from a sensor by any client is corrupt, it is modelled as a loss of integrity at the sensor.
DF.I.DScSePDmFF.0.2

Out of date control input causes loss of integrity in output Data from Sensor: if the control input to Sensor is out of date, and Sensor depends on real-time updating of this input, then measurement of the environment by Sensor will be affected, leading to faulty or corrupt sensor output Data.
Se.E.Se-sD-sD.9

Sensor Sensor is sensing inferred general data: Sensor Sensor is sensing inferred general data, is this ok to you? If not then add the desired data type and the senses relationship between the sensor and it.
Se.E.Se-cD-cD.9

Sensor Sensor is being controlled by inferred general data: Sensor Sensor is being controlled by inferred general data, is this ok to you? If not then add the desired data type and the controlsThing relationship between the sensor and it.
Se.C.SePD.0

Data leakage at sensor Sensor: if the onboard data at a sensor leaks, it is modelled as a loss of confidentiality at the sensor.
Se.Auth.SePDsFF.0

Loss of authenticity at sensor Sensor: if the onboard data received from a sensor by any client is altered by an attacker, it is modelled as a loss of authenticity at the sensor.
Se.A.SePDmFF.0

Loss of availability at sensor Sensor: if the onboard data from a sensor is not available to any client, it is modelled as a loss of availability at the sensor.
DF.I.DScSePDmFF.0.1

Corrupt control input causes loss of integrity in output Data from Sensor: if the control input to Sensor is faulty or corrupt, then measurement of the environment by Sensor will be affected, leading to faulty or corrupt sensor output Data.
Co.C.CoPD.0

Data leakage at controller Controller: if the control input data for a controller leaks, it is modelled as a loss of confidentiality for the controller.
DF.A.DScSePDmFF.3

Malicious control of Sensor prevents generation of sensed output Data: if an attacker can tamper with the stored control inputs to sensor Sensor, they may be able to prevent measurement of the environment by Sensor.
Co.U.CoPDS.0.2

Loss of reliability due to out of date input at Controller: if the onboard data at a controller is out of date, it means the controller will not be reliable unless it does not require real-time updates to operate safely.
Co.U.CoPDS.0.1

Loss of control process reliability at Controller: if the onboard control input at a controller is faulty or corrupt, it means the controller will not be reliable.
Co.U.Co.0

Loss of reliability due to unavailable controller Controller: if controller Controller is unable to run processes, the associated physical process will continue in an uncontrolled fashion, making it unreliable.
Co.M.CoPDS.0

Loss of control due to compromised input at controller Controller: if the onboard data received by the onboard control process at a controller is not authentic, the attacker can assume control, which is represented as loss of control over the controller.
Co.E.Co-cD-cD.9

Actuator Controller is being controlled by inferred general data: Actuator Controller is being controlled by inferred general data, is this ok to you? If not then add the desired data type and the controlsThing relationship between the actuator and it.
Co.A.Co.6

Shutdown of physical process controlled by Controller: if IoT device Controller cannot get appropriate control inputs, it may be suspended to prevent loss of reliability, but this means shutting down the process it controls by physical means.
DF.Auth.DScSePDmFF.3

Malicious control of Sensor alters generation of sensed output Data: if an attacker can tamper with the stored control inputs to sensor Sensor, they may be able to alter measurement of the environment by Sensor so as to deceive recipients of the data.

Sg.TA.LTRevSg2.8

Routing from Host and LogicalSubnet via Gateway is enabled: if this route is enabled by reverse tethering between the IP and non-IP connections, it could be exploited by an attacker.
Sg.TA.LTethSg2AC.1

Tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is paired with Host and connected to LogicalSubnet, then they can tether Gateway and connect Host to LogicalSubnet.
Sg.TA.LTethSg2.8

Routing between Host and LogicalSubnet via Gateway is enabled: if this route is enabled by tethering between the IP and non-IP connections, it could be exploited by an attacker.
Sg.TA.L1SSg2.8

Mesh routing between FromHost and ToHost via Gateway is enabled: if this route is enabled by mesh routing via non-IP connections, it could be exploited by an attacker.
Sg.DA.L1SSg2AC.1

Mesh routing between FromHost and ToHost not disabled at reenabled at Gateway: if an attacker has admin rights on host Gateway, they can override a policy not to enable mesh routing between paired hosts.
Sg.A.LTRevSg2.6.1

Connections between Host via Gateway and LogicalSubnet are disabled: if reverse tethering is disabled between Host and Gateway, the route from Host to LogicalSubnet will be unavailable to legitimate users.
Sg.A.LTethSg2.6.1

Connections between Host via Gateway and LogicalSubnet are disabled: if tethering is disabled between Host and Gateway, routes between Host and LogicalSubnet will be unavailable to legitimate users.
Sg.TA.LTRevSg2AC.1

Reverse tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is connected to LogicalSubnet and Host is paired with it, then they can reverse tether Host and connect Host to LogicalSubnet.
LS.L.HL1HS.1

Access to RemoteHost in Space allows communication via USB or Bluetooth with Host: someone with access to device RemoteHost in location Space where it is paired with device Host can use the pairing connection to communicate with Host.
I.Auth.HUISG.3

Spoofing a device RemoteHost in a USB pair with device Host in location Space: an attacker with access to the location Space of Host can connect a fake version of device RemoteHost to Host.
I.Auth.HBISG.3

Spoofing a device RemoteHost in a Bluetooth pair with device Host in Space: an attacker with access to a location where Host is paired with RemoteHost, they can physically spoof the connection. This threat covers the case where the connection is freshly established in each location where it is needed.
I.Auth.HBImSG.6

Spoofing a device RemoteHost in a Bluetooth pair with device Host in Space: an attacker with access to a location where Host is paired with RemoteHost can spoof the latter to the former. This threat captures the case where SSP is used with a one-sided user confirmation. In principle this can still be spoofed, but it would have to be done where the pair is established, which can be the most secure location they are used (not necessarily in Space where the attacker is present).
H.W.UHS.3

Physical insertion of malware via USB at Host in Space: at attacker with physical access to space Space is able to insert self-replicating malware on USB Host Host in situ, using physical means (such as power cycling) to reboot and avoid anti-malware software, if installed.
H.W.HL1H.3

Malware infection of device Host from paired device RemoteHost in Space: if RemoteHost is infected by malware, and RemoteHost connects via USB or Bluetooth with device Host then the malware may be automatically transferred to or ingested by Host.
H.J.UHS.3

Tampering with software via USB at Host in Space: at attacker with physical access to Host in space Space reboots from a USB device and introduces software changes, introducing a means for the attacker to get remote access to admin privileges on Host.
Sg.A.L1SSg2.6.1

Mesh routing between FromHost and ToHost via Gateway is disabled: if this route is disabled by switching off mesh routing via non-IP connections at Gateway, the route will be unavailable to legitimate users.

P.A.HP-iT.5

Software bug crashes Process: a software bug in process Process causes it to crash, compromising availability.
P.A.HP-iT.6

Effect of overload at low priority process Process: the priority of process Process may be reduced to prevent it from overloading its host Host, but in that case Process may become unavailable even if Host is not.
P.A.HsACP.1.2

Use of rights at Host to control availability of Process : anyone with admin rights on device Host can shut down process Process. For mobile hosts, we assume the process can be permanently disabled, so access in any context is sufficient, causing Process to become unavailable in any context unless there are instances running on independent instances of class Host.
P.A.HuiHP.6

User Human cannot access device Host to operate Process: if access to device Host is restricted, and user Human lacks the means to gain access, they will be unable to log in and hence unable to interact with process Process.
P.A.HuirRACP.0

Unavailable remote access client RemoteAccessClient affects Process: because user Human accesses process Process via RemoteAccessClient, if RemoteAccessClient becomes unavailable then Human will be unable to interact with Process, rendering it non-operational.
P.A.HuirP.0

Unavailable Human affects Process: if user Human is unable to make decisions in their system role and interact with process Process, then it also will become unavailable.
LS.IS.LS-prH.8

Subnet LogicalSubnet in service: subnet LogicalSubnet is not disabled, so is potentially subject to threats and can be exploited by an attacker.
P.A.HumHP-iT.6.2

Loss of availability through disabling vulnerable process Process: if process Process may be vulnerable to attack, and the contingency plan is that its host manager HostManager will disable Process to prevent adverse consequences, this may lead to a loss of availability.
P.A.HumHP-iT.6.4

Loss of availability through disabling infected process Process: if process Process may be infected by malware, and the contingency plan is that its host manager HostManager will disable Process to prevent adverse consequences, this may lead to a loss of availability.
P.A.HuiHPSP.6

User Human cannot access private space Space to operate Process: if access to space Space is restricted, and user Human lacks the means to gain access, they will be unable to log in to device Host and hence unable to interact with process Process.
P.A.HP-iT.1.3

Use of privileges at Process to control availability: anyone with local user rights (i.e. local control) of a process Process can shut it down. However, this does not prevent access where there are other instances of Process running on independent instances of Host.
LS.M.HprL3SAC.1

Use of admin privilege at Gateway to control LogicalSubnet: someone with admin rights at device Gateway can control the subnet LogicalSubnet provided by device Gateway.
P.A.HP.1.1

Use of privileges at Host to control provisioning of Process: anyone who controls resource allocation for Host instances can do the same for instances of Process hosted by Host instances.
P.A.HP.0

Loss of availability at Host affects Process: if device Host becomes unavailable, so will the process Process hosted there.
LS.L.WSSH-P.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.
LS.L.WSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.
LS.L.WSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing wired subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device to the subnet.
LS.L.RSSH-P.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where radio subnet LogicalSubnet is accessible can connect their own device unless access is restricted by security measures. Note that access only to the local subnet serving Space.
LS.L.RSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where radio subnet LogicalSubnet is accessible can connect their own device unless access is restricted by security measures. Note that access only to the local subnet serving Space.
LS.L.RSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing radio subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device wirelessly to the subnet.
LS.L.HL3S.1

Access to Host allows local communication on subnet LogicalSubnet: someone with access to Host can send messages on LogicalSubnet to which Host is connected.
LS.IS.WHmWS.8

Wireless hotspot Hotspot is in service: hotspot Hotspot is up and running in at least one of the spaces where the providing host may be present.
P.E.CcuS.9

Client Client should not control access to its own service Service: the domain model does not support situations where a client makes authN/authZ decisions for itself. This would create ambiguous dependencies that cannot be resolved in the current models of client credential sharing, forwarding and exchange. Delete the 'controls' relationship from Client to Service, and have some other process control access (or leave the service to handle authentication and authorization decisions for itself).
P.A.HP.6.1

Loss of availability in disabled process Process: if process Process has been disabled to prevent it being attacked, this will mean Process is no longer available.
P.E.HLnSP-hCLI.9

Login service RemoteAccessService cannot be used to access process Process: since Process may be a graphical process with no command line interface, it cannot be launched on its host Host via the terminal login service RemoteAccessService. If Process is meant to be remotely accessible to an interactive user, then either Process must be a more restricted process subclass, or RemoteAccessService must be a remote Desktop Service.
P.L.HPmAC.1

Access to Process by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host with the rights of Process, then they could exploit those rights in any context.
P.E.LnSuP-H.9

Remote access service LoginService cannot use remote service Process: a remote access service provides access to the shell on its host. It allows its user to run (use) processes running on the same host, but it cannot send requests to services on other hosts, so a direct relationship to Process is an error, causing inconsistency with the domain model. To make such a request, the user should launch a client process which sends the request. This can be modelled by adding such a client running on the same host as LoginService, with uses relationships from LoginService and to Process.
LS.IS.HprLSAC.1

Provision of subnet LogicalSubnet by Gateway not disabled: if an attacker has admin rights on host Gateway, they can override a policy to disable provision by Gateway of network LogicalSubnet.
W.E.WmPH.9

Inconsistent resolution for omitted physical host locations: any host with no location is inferred to be in the inferred global public space Space, so physical attacks are not overlooked. If the location of some hosts was deliberately omitted, controls can be used to indicate whether this is because those hosts are indeed not in a secure location, or because physical attacks on those hosts are out of scope in this system model. However, both options cannot be specified as this would mean such attacks should be both included and excluded from the analysis.
P.W.HP-iT.7

Process Process infected via its host: device Host having been infected with malware, the software installed on the host for running process Process may also become infected.
P.U.HP-iT.5

Software bug causes Process to become unreliable: a software bug in process Process causes it to become unreliable.
P.U.HP.0

Unreliable host Host affects Process: if there is a loss of reliability at device Host, it causes a loss of reliability in process Process running on that device.
P.O.HP-iT.5

Software bug overloads Process: a software bug in process Process causes it to become overlaoded.
P.L.SHLnSACPmAC.1

Use of login via RemoteAccessService to control Process on Host in Space: anyone with local rights (i.e. at command shell level) for remote access service RemoteAccessService controlling the collocated process Process on Host when it is in location Space also has control of Process in that context.
P.L.HuiPSt.1

Insider attack by employee of Employer abusing their control of Process: the legitimate user Human of process Process may be persuaded by an untrustworthy employer Employer to abuse the privileges assigned to Process.
P.L.HuiPoSt.1

Insider attack by Human abusing their control of Process: if the legitimate user Human of process Process is malicious, they can abuse the privileges assigned to Process.
P.L.HuiPCHS-iP.3.3

Unattended console access to interactive process Process on device host Host in Space: an attacker with physical access to device Host in location Space is able to access process Process via the console while the legitimate user is away from the desk.
P.L.HuiPCHS-iP.3.2

Unauthorised console access to interactive process Process on device Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to interact via the console with process Process.
P.E.IcP.9

Public network LogicalSubnet cannot be controlled by Process: since LogicalSubnet is a public network, it is an abstract representation of multiple linked subnets that cannot be controlled by a specific process. To fix this error, remove the controls relationship between Process and LogicalSubnet.
P.L.HuiPCHS.3.1

Console access to unprotected account running Process on device Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get access via an unprotected user account with the rights of process Process.
P.L.HPsAC.0

Access to the rights of Process by unauthorized agents in any context: if an untrustworthy actor gains access to Host with the rights of Process in any context, the worst case trustworthiness of its users in any context is degraded.
P.L.HPmAC.0

Access to the rights of Process by unauthorized agents in all contexts : if untrustworthy actors gain access to Host with the rights of Process, the best case trustworthiness of its users in any context is degraded.
P.J.SHP-iT.7

Malware infection installs back door in process Process: if Process is infected by malware, it may install a back door in Process, which could be accessed remotely at a later time.
P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.
P.IS.HP.8

Process Process in service: if host Host is in service, then Process running on Host will also be in service and subject to attack, unless explicitly disabled.
P.E-D.HP.8

Vulnerabilities discovered in process Process: one or more software vulnerabilities in process Process become known to attackers. This is a pre-requisite for exploitation of more specific types of vulnerabilities.
P.E.THGP.9

Hosting error for process GeneralProcess: Device TrivialHost is a specialised host class that cannot host a general (complex) process like GeneralProcess. Either remove GeneralProcess, or move the hosts relationship to a more general purpose host.
P.E.SHGP.9

Hosting error for process GeneralProcess: Device SimpleHost is a specialised host class that cannot host a general (complex) process like GeneralProcess. Either remove GeneralProcess, or move the hosts relationship to a more general purpose host.
P.E.PnH.9

Process Process has no host: every process should be running on a host. If the host for this process is missing from the model, add it. Then create a hosts relationship between the host and Process.
P.E.PH2.9

Process Process has two hosts: hosts Host and OtherHost both have relationships saying that they host process Process. A process can only run on one host. Please break one of the relationships, and if necessary create a distinct process to run on that host.
P.E.PccP.9

Processes Client and Service cannot authenticate for each other: this forms a cyclic authentication dependency, which is a logical impossibility in a functioning system. This threat detects the presence of the simplest case (with two interdependent processes), but loops composed of more processes should also be avoided. This threat will appear twice per pair of processes as each processes will be matched to both roles in the threat.
P.L.HuHE2AC.3

Execution of malicious email attachment by MUA on Host in Space: the user Human runs a malicious file sent as an email attachment while the host device is located in Space, allowing the attacker to exploit the privileges using connections accessible to their email client MUA via Host from Space.
LS.IS.HprLS.8

Subnet LogicalSubnet in service: if device Gateway is in service, it will provide subnet LogicalSubnet, unless network provision is explicitly disabled.
P.L.SHACPmAC.1

Use of admin privilege at Host via Space to control Process: someone with admin rights at device Host in location Space can control process Process hosted by that device in that context.
LS.A.HprLSAC.1.2

Provisioning of LogicalSubnet prevented at Gateway: someone with admin rights for device Gateway can prevent access to subnet LogicalSubnet provided by Gateway, unless other independent instances are available.
H.IS.PHS-iP.1

Switching on device Host in Space: an attacker with access to Space can physically access disabled device Host and switch it back on.
H.IS.PH.8

Host Host in service: device Host is not disabled, so is potentially subject to threats.
H.E-D.H.8

Vulnerabilities discovered in device Host: one or more software vulnerabilities in device Host become known to attackers. This is a pre-requisite for exploitation of more specific types of vulnerabilities.
H.E.WmPH.9

Physical hosts exist that have no specified or inferrable location: any host with no location is inferred to be in the inferred global public space Space, so physical attacks are not overlooked. If the location of some hosts was deliberately omitted, select controls to indicate whether this is because those hosts are indeed not in a secure location, or because physical attacks on those hosts are out of scope in this system model. If the host locations was an oversight, please add space assets representing their location (if not already included) and add relationships to specify in which space each host is located.
H.E.SH-mHu.9

Host Host has no manager: in principle, every non-trivial host should have a manager, defined explicitly in the system model or implied by other factors such as its physical location or whether it is a personal device. If you mean this host to have no manager, e.g. because it is not dedicated to the modelled system and its management handled by some external process or agency, select the control strategy to negate this error threat. If not, please add a manager or change the class or relationships of Host so one can be inferred.
H.E.HuiDH.9

User Human cannot interact directly with dumb host Host: host Host is of a type that does not have a user interface, yet user Human is interactively using the host or a process running on it, which is not possible. Either change the type of Host, move the interactive user or process, or convert the process into a service accessed via an interactive client on a different host.
H.E.HPHLS-S.9

Host Host cannot be connected to subnet LogicalSubnet: the model says host Host is connected to subnet LogicalSubnet, but Host is not located in any physical space from which LogicalSubnet is accessible. Note that this error will probably cause other errors in communication with this host or processes hosted there.
H.E.Hm2dHu.9

Host Host has two managers: device Host has two distinct managers (Human1 and Human2). Normally management of a device should be assigned to one type of user, so this may be a modelling error. If not, it may represent a weakness in organisational security.
H.E.H-iR-iMCHIUS.9

Host Host should not be connected directly to the Internet: device Host in Space is connected to an Internet-class subnet LogicalSubnet, but the Internet connection from Space should be mediated by a Router or (as an abstraction) a mobile user device, and Host is neither of these. Either insert some network infrastructure (a router or a cellular network) in Space to handle the connection, or remove Space and treat Host as not having any specific location.
H.E.HHu2d.9

Inappropriate control at device Host: the model specifies that this is a personal device protected by its user, but it is being used by multiple users. Deselect the Personal Device control, or remove relationships with all but one user.
H.A.PHS.3

Destruction of Host in Space: an attacker with access to Space can physically remove or destroy device Host, removing it from the system and making it unavailable.
H.A.HumH.6.4

Loss of availability through disabling infected device Host: if device Host is vulnerable to malware infection, and the security control strategy is for its manager HostManager to disable Host if it becomes infected, this will cause a loss of availability.
H.A.HumH.6.2

Loss of availability through disabling vulnerable device Host: if device Host is vulnerable to attack, and the security control strategy is for its manager HostManager to disable Host to prevent the attack, this will cause a loss of availability.
H.A.HsAC.1.2

Use of privilege to control Host availability: an attacker who has gained admin rights for a device Host can crash or deny access to it. For mobile hosts, we assume the host can be permanently locked down, so access in any context is sufficient, causing loss of availablity unless independent instances of class Host are available.
H.A.H.6.1

Loss of availability through disabled device Host: device Host is vulnerable, and the security control strategy was to disable Host, causing a loss of availability.
H.A.H.5

Software bug crashes Host: a software bug in the operating system of device Host causes it to crash, compromising availability.
LS.A.LS.0

Effect of overload at logical subnet LogicalSubnet: if the subnet LogicalSubnet is overloaded it may become unavailable.
H.A.H.1.1

Use of privilege to control Host availability: anyone who controls resource allocation for Host can control the availability of Host instances.
H.A.H.0

Loss of availability at overloaded host Host: if Host is overloaded, then it will be unable to fulfil its function and become effectively unavailable.
H.A.DCH.0

Loss of availability at DataCentre affects Host: if data centre DataCentre becomes unavailable, so will the host Host provisioned at DataCentre.
DC.RTW.StDC.1

Operator Operator compromises resource management at DataCentre: since Operator cis the operator of the data centre DataCentre, if they have adverse motives, they can misallocate resources within the data centre.
DC.O.DCH.0

Effect of overload at Host on DataCentre: if physical host Host at DataCentre is overloaded, then DataCentre as a whole may become subject to high total load.
DC.A.DC.0

Effect of overload at DataCentre: if data centre DataCentre is overloaded, then it may become unavailable. Formulated as a primary threat so the level of confidence in the Data Centre can be a user-specified trustworthiness level.
H.J.PHS-iC.3

Physical tampering with Host in Space: at attacker with physical access to space Space physically alters device Host located there, introducing a means for the attacker to get remote access to admin privileges on Host.
H.L.CHS-iP.3.1

Console access to unprotected guest account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to log in to a guest account.
H.E.IpH.9

Public network LogicalSubnet cannot be provided by Host: LogicalSubnet is a public network, providing an abstract representation of multiple linked subnets over a wide area. This cannot be provided by a host within the system. To fix this , change the relationship to a simple connection between Host and LogicalSubnet, or make LogicalSubnet a local, concrete network class.
H.L.HmAC.1

Access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host, it must be assumed they can use Host in any context.
LS.A.HprLS.6.1

Disabled subnet LogicalSubnet is not available: if provisioning by host Gateway of subnet LogicalSubnet has been disabled, then LogicalSubnet will be unavailable.
LS.A.HprLS.1.1

No provisioning for LogicalSubnet: whoeever controls resource allocation for devices of class Gateway can prevent provisioning of instances of subnet LogicalSubnet provided by Gateway.
LS.A.HprLS.0

Loss of availability at Gateway affects LogicalSubnet: if device Gateway becomes unavailable, so will the subnet LogicalSubnet routed by Gateway.
Hu.E.HummH-e.9

User Human has no access to email: users with the role Human do not have access to email via either a local client or via webmail. Since email is a source of risk, through which attackers could attack devices connected to the system, this should be added to the model. If users in role Human really do not use email on any device (i.e. that is a policy and not an oversight), then select the control strategy to indicate this.
H.L.HmAC.0

Access to Host in all contexts by unauthorized agents: if untrustworthy actors gain access to a host, the best case trustworthiness of its users in any context is degraded.
H.W.HuHE.3

Malware infection at Host due to execution of viral attachment in email client MUA on Host: the user Human runs a malicious file sent as an email attachment via their email client MUA, infecting their client device Host.
H.U.H.5

Software bug at Host: a software bug in the operating system of device Host causes it to become unreliable.
H.RTW.StH.1

Operator Operator compromises resource management at Host: Operator is the operator of (the class of devices) Host, so if they have adverse motives, they can misallocate instances or refuse to allocate instances.
H.RTW.DCH.1

Use of privilege at DataCentre to control resourcing of Host: anyone who controls resource allocation at DataCentre can control the provision of instances of Host, resourced by DataCentre.
H.O.HP-iT.0

Effect of overload at process Process on Host: if the process Process is overloaded, it may cause an overload on its host Host.
H.M.SHmACRLnSAC.1

Use of login via RemoteAccessService to control Host in Space: anyone with local rights (i.e. at command shell level) for root remote access service RemoteAccessService controlling Host when it is in location Space also has admin rights on Host in the same context.
H.M.HumHSt.1

Insider attack by employee HostManager of Employer abusing admin rights on Host: the manager HostManager of device Host may be persuaded by an untrustworthy employer Employer to abuse their rights and enable attacks involving Host.
Hu.E.HuimH-e.9

User Human has no access to email: users with the role Human do not have access to email via either a local client or via webmail. Since email is a source of risk, through which attackers could attack devices connected to the system, this should be added to the model. If users in role Human really do not use email on any device (i.e. that is a policy and not an oversight), then select the control strategy to indicate this.
H.M.HumCHS-iP.3.2

Unauthorised console access to an admin account on host Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to gain root privileges via the console.
H.M.HumHoSt.1

Insider attack by HostManager abusing admin rights on Host: if the manager HostManager of device Host is untrustworthy, they can use their privileges to enable attacks involving Host.
H.L.HsAC.0

Access to Host in any context by an unauthorized agent: if an untrustworthy actor gains access to a host, the worst case trustworthiness of its users in any context is degraded.
H.L.HuiHoSt.1

Insider attack by Human abusing access to Host: if the user Human of device Host is untrustworthy, they can abuse their privileges on that device.
H.L.SHAC.1

Use of admin privilege to control access to Host when in Space: someone with admin rights at device Host when in location Space can control user level access to the device in that context.
H.L.SHmACPAC.1

Use of privileges at Process to access Host in Space: anyone with local rights (i.e. at command shell level) for process Process when the host is in location Space also has user level access to its host Host in the same context.
H.L.HuiHSt.1

Insider attack by employee of Employer abusing access to Host: user Human of device Host may be persuaded by an untrustworthy employer Employer to abuse their privileges on that device.
H.M.HmAC.0

Root access to Host in all contexts by unauthorized agents: if untrustworthy actors gain admin rights on a host, the best case trustworthiness of the host in any context is degraded.
H.M.HmAC.1.1

Root access to Host by its provider: anyone who controls resource allocation for devices of class Host can provision an instance and for grant admin privileges to themselves.
H.M.HmAC.1.2

Root access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has admin rights on Host, it must be assumed they could exploit those rights in any context.
H.M.HsAC.0

Root access to Host in any context by an unauthorized agent: if an untrustworthy actor gains admin rights on a host, the worst case trustworthiness of the host in any context is degraded.
H.M.CHS.3.1

Console access to unprotected admin account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get root access via an unprotected admin account.

I.IS.INC.1

Access from Host to LogicalSubnet not disabled: if an attacker has admin rights on device Host when in range of LogicalSubnet, they can override a policy to avoid connecting to subnet LogicalSubnet.
I.O.IoH.3

Remote DoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker with remote access to Layer 3 subnet LogicalSubnet sends too many messages to the network address of the target device Host on LogicalSubnet.
I.M.I.8

Message traffic from LogicalSubnet via Host is unconstrained: if the interface between Host and LogicalSubnet is in service, then traffic that is not blocked will not be subject to any bandwidth limits unless controls are used to impose such limits.
I.O.DDoH.3

Remote DDoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker able to orchestrate clients on subnet AttackerSubnet arranges for them to send too many messages to the network address of the target device Host on LogicalSubnet.
I.O.HIoH.3.1

Remote DoS attack from LogicalSubnet on Host: an attacker with access to subnet LogicalSubnet sends too many messages to the network address of the connected target device Host.
I.O.HIoH.3.2

Remote DDoS attack from LogicalSubnet on Host: an attacker able to orchestrate clients on subnet LogicalSubnet arranges for them to send too many messages to the network address of the connected target device Host.
I.O.LoH.3

Adjacent DoS attack on Host from LogicalSubnet: an attacker with access to Layer 2 subnet LogicalSubnet sends too many messages to the hardware address of a target device Host connected to that subnet.
Sg.DA.L3SSg2AC-b.1

Routing between FromSubnet and ToSubnet re-disabled at Gateway: if an attacker has admin rights on host Gateway in a context where it is connected to FromSubnet and ToSubnet, then they can override a default policy to drop connection being routed between those subnets.
LS.C.WiFiSSoH.3

Passive snooping in WiFi subnet LogicalSubnet from Space: if an attacker has physical access to WiFi subnet LogicalSubnet from Space, they can passively snoop traffic unless the network is encrypted.
NP.DA.NPLS.8

Network path across LogicalSubnet enters service: the subnet LogicalSubnet being in service means messages can be sent across it.
Sg.A.L3SSg2.6.1

Connections between FromSubnet and ToSubnet via Gateway are disabled: if port forwarding is disabled by closing firewall tunnels at Gateway the route via Gateway between FromSubnet and ToSubnet will be unavailable to legitimate users.
Sg.A.Sg.0

Device Gateway unable to route from FromSubnet to ToSubnet: if device Gateway is not available, it will be unable to route messages from FromSubnet to ToSubnet.
Sg.DA.L3SSg2-b.8

Routing between FromSubnet and ToSubnet via Gateway is enabled by default: if this route between IP subnets is enabled for all communications, it could be exploited by an attacker.
Sg.IS.Sg.8

Routing from FromSubnet to ToSubnet via Gateway is in service: if device Gateway and subnets FromSubnet to ToSubnet are in service, then so is the route between the subnets provided by Gateway.
I.IS.I.8

Access from Host to LogicalSubnet enabled: if Host is in service, then it will connect to LogicalSubnet by default, unless the connection is disabled.
I.O.RoH.3

Remote DoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker with remote access to Layer 3 subnet LogicalSubnet sends too many messages to the network address of the target device Host on LogicalSubnet.
I.DA.I.8

Access to Host from LogicalSubnet enabled: if the network connection between Host and LogicalSubnet is in service, then messages addressed to Host will be accepted via that connection, unless blocked by a firewall policy.
NP.DA.NPmLSmSg.8

Network path from FromSubnet to ToSubnet enters service: if the logical subnets on this path are in service, and gateways do not block message routing between subnets, then messages can be sent on the end-to-end path.
I.Auth.HSWSoGS.3

Spoofing wired network LogicalSubnet at location Space of supplicant Host: at attacker with access to the location Space of a host Host can physically insert their own device between the host and its wired connection to LogicalSubnet.
H.E.RScGcRS.9

Device Gateway connected to multiple WiFi networks in space Space: usually, devices have only one WiFi interface, and so can only be connected to one WiFi from each space they could be in. Use a control to indicate if this device really does have the ability to use multiple simultaneous WiFi channels.
H.E.WScMcWS.9

Mobile device Gateway connected to multiple Wired LANs in space Space: usually, mobile devices do not have more than one Wired network interface, and so can only be connected to one network in each space. Use a control to indicate if this device really does have multiple wired NICs.
H.L.IoH.3

Remote user access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected service listening on LogicalSubnet .
H.L.NoH.3

Remote user access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected service listening on LogicalSubnet .
H.M.IoH.3

Remote root access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected yet privileged service listening on LogicalSubnet .
I.Auth.HWSGSoS.3

Spoofing wired network LogicalSubnet at location Space of router Gateway: at attacker with access to the location Space of a wired router Gateway can physically insert their own device between the router and its wired connection to device Host.
H.M.NoH.3

Remote root access from AttackerSubnet via LogicalSubnet to insecure device Host: an attacker with access to AttackerSubnet gains access to host Host via an unprotected yet privileged service listening on LogicalSubnet .
H.M.RIoH.7

Remote root access from AttackerSubnet via LogicalSubnet to back door on device Host: an attacker with access to AttackerSubnet gains access to host Host via a previously installed back door providing a reverse shell via LogicalSubnet .
I.A.GdHRS.6

Device Host unable to connect to radio subnet LogicalSubnet from Space: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.
I.A.GdHRSi.6

Device Host unable to connect to radio subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.
I.A.GdHWS.6

Device Host unable to connect to wired subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.
I.A.I.0

Effect of overload at interface Interface: if the interface Interface is overloaded it may become unavailable.
I.A.I.6.1

Disabled network connection from Host to LogicalSubnet is not available: if host Host does not in fact connect to subnet LogicalSubnet then that connection will be unavailable.
I.Auth.HRSGSoS.3

Spoofing radio network LogicalSubnet at location Space of access point Gateway: at attacker with access to the location Space of radio networking device Gateway can physically spoof network LogicalSubnet by introducing their own radio network to impersonate the real one.
I.Auth.HSRSoGS.3

Spoofing radio network LogicalSubnet at location Space of supplicant Host: at attacker with access to the location Space of Host can physically spoof network LogicalSubnet by introducing their own radio base station to impersonate the real one.
H.M.RNoH.7

Remote root access from AttackerSubnet via LogicalSubnet to back door on device Host: an attacker with access to AttackerSubnet gains access to host Host via a previously installed back door providing a reverse shell via LogicalSubnet .

D.E.D-Hu-Th.9

Data Data is not related to any human: personal data must have a 'relatesTo' link to its Human data subject. Data Data does not have such a link. If Data is personal data, then you should add the data subject to the model if they are not yet included (even if they are not users of the system) and add the relationship indicating the data relates to that subject. If in fact Data is not personal data, select the control strategy to signal to SSM that the absence of such a link is not an error.
H.E.H-Hu.9

Inappropriate control at device Host: the model specifies that this is a personal device protected by its user, but it is not a personal IoT device related to a data subject, neither is it being used or managed by any user. Deselect the Personal Device control, or insert the user and their relationship with the device.
Hs.E.Hs.9

IOT Health Sensor Sensor is deprecated: Instead of using an IOT Health Sensor use a Sensor and Health Data with the senses relationship between them.
Th.E.IoT-Hu.9

Internet of Things device Thing is not related to any human: IoT devices contain embedded data which may be personal data, in which case they must have a 'relatesTo' link to the Human data subject. Device Thing does not have such a link. If the data used by Thing is personal data, then you should add the data subject to the model if they are not yet included (even if they are not users of the system) and add the relationship indicating that Thing relates to that subject. If Thing is non-personal, then select the control strategy to signal to SSM that the absence of such a link is not an error.

DF.O.CCDS2TC.0

Excessive demand for data Data via Client propagates via Service: if the flow of data Data requested by Client from Service is excessive, then Service will forward the request for an excessive amount of data to StepFrom.
DS.A.CDBSCDSF.4

Malicious query from Client via database Service deletes data Data: an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data could be expected to come via Client, so the attack cannot be prevented using database access controls at Service.
DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.
P.E.LnSc-uP.9

Remote access service LoginService cannot control process Process: A remote access service like LoginService allows users to access the shell on its host. It therefore cannot control access to other processes via some token exchange authentication and authorization workflow unless Process is a reverse proxy that simply forwards client requests to LoginService. The current arrangement is therefore an error. If Process is meant to be a reverse proxy, add a 'uses' relationship from Process to LoginService. If instead users are supposed to use LoginService to log into its host and run Process there, replace the 'controls' relationship by the 'uses' relationship. If Process runs on a different host, then a separate client process will need to be added.
DS.C.CDBSC-DST.4

Malicious query from Client via database Service leaks data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to retrieve data Data. In this scenario, a selection query for Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
I.TA.I.8.1

Access to services on Host from LogicalSubnet enabled by default: if the interface between Host and LogicalSubnet is in service and connections to Host via this interface are allowed by default, then so are connections to services running on Host.
I.A.HLSISC.6.4

Authentication failure for device CHost at Service prevents connection to LogicalSubnet: the device CHost cannot connect to LogicalSubnet because it cannot authenticate with the authenticator service Service controlling access to the network.
I.TA.I.8.2

Access to services on Host from LogicalSubnet enabled by exception: if the interface between Host and LogicalSubnet is in service, then even if connections to Host via that interface are blocked by default, connections to services running on Host will be allowed unless explicitly disabled.
LS.L.HLSISC.1

Access to LogicalSubnet as CHost via EAP authenticator process Service: an attacker who can authenticate with process Service can connect to subnet LogicalSubnet.
P.A.HuirRACSPH.0

Loss of connectivity from Client to Service affects Process: because user Human interacts with Process via remote access client Client and the shell on SHost, if Client cannot connect to remote access service Service on SHost, Human will be unable to interact with Process which will be rendered non-operational.
P.E.HuiSP.9

Reverse proxy Proxy should not have interactive user Human: a reverse proxy is an automated process driven by service requests, and should not have an interactive user.
DS.C.HPsACrDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to read the locally stored copy of Data.
DF.O.CCDS2FC.0

Excessive flow of data Data via Client propagates via Service: if the flow of data Data from Client to Service is excessive, then Service will forward the excessive flow to StepTo.
DF.C.AC-iDF-VCS.3.2

Imposter posing as service Service intercepts flow of Data from FlowsFrom and FlowsTo sent by Client: if an attacker can impersonate service Service, they can intercept content in the flow of data Data between FlowsFrom and FlowsTo via the service and its client Client.
DF.O.CCDFSFC.3

Compromised client Client sends excessive data Data to/via Service: if Client is the source of a flow of data Data which is sent to or via service Service, then if an attacker or malicious user can access Service as Client, they can send too much data, aiming to overload the data flow destination FlowsTo.
DF.C.ACDFVFS-i.3.6

Encrypted flow of data Data from FlowsFrom leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can access its cryptographic key to decrypt data and accept a request for it from a false client acting as Client.
DF.C.ACDF-VSC-i.3.2

Flow of data Data from FlowsFrom to FlowsTo leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can allow a false client to request data by acting as Client.
DF.C.ACDF-VTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.
DF.C.ACDFVTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.
P.E.LnSucP-pS.9

Remote access service LoginService cannot use and be controlled by Process: this arrangement normally implies that a client is using forwarded credentials to access a service. Since LoginService runs Process as a shell command, this makes no sense, unless Process needs credentials from the remote client of LoginService to access some other service. However, in this case there is no such other service.
DF.C.AC-iDF-VCS.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Client and Service: if communications between Client and Service are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.
DF.O.CCDFSTC.3

Compromised client Client requests excessive data Data from/via Service: if Client is the destination of a flow of data Data which is sent from or via service Service, then if an attacker or malicious user can access Service as Client, they can request too much data, aiming to overload the data flow source FlowsFrom.
DF.C.AC-iDF-VSC.3.2

Compromised or impersonated client Client reads data Data flowing from FlowsFrom to FlowsTo when sent from Service: if an attacker can compromise or impersonate Client, they can read Data sent by FlowsFrom to FlowsTo in messages from Service.
DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
DF.C.AC-iDF-VTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
DF.C.CCCSCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Service: if service Service does not send data Data to its client Client , it is still possible for the client to request the data flow using a confused deputy attack against Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).
DF.C.CCCSPCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not receive data Data from its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.
Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.
DF.IS.PDFFA.8

Flow of Data from FlowsFrom to FlowsTo is in service: if process FlowsFrom is in service and able to access the data, and all the steps in the chain of processes between FlowsFrom and FlowsTo are in service, then the flow of Data from FlowsFrom to FlowsTo will be in service and potentially subject to attack, unless disabled.
DF.C.AC-iDF-VSC.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Service and Client: if communications between Service and Client are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.
P.E.PcHpmS.9

Service Process cannot control access to host Host: process Process cannot control access to a host because Process shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access host Host. The knowledge base does not support this arrangement.
P.L.SPNaS.3

Remote control of process Service using a back door via proxy Client: a malicious user or an attacker who can send messages via reverse proxy Client to a back-end service Service could access a back door if previously installed in the software, and gain control of Service including its access to its rights on device SHost.
P.E.Pc-pPpmS.9

Service Proxy cannot control access to service Process: process Proxy cannot control access to a service because Proxy shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access service Process. The knowledge base does not support this arrangement.
SC.A.CCtImSC.0

Connection from SHost to LogicalSubnet affects communication between Client and Service: if the connection of device SHost running Service and subnet LogicalSubnet is not available, this will affect the ccommunication hannel between client Client and service Service.
SC.A.HuSC.6.3

Suspended insecure path from Client to Service affects availability: firewall rules allowing access by Client to service Service via a network path may be suspended where communication on that path is exposed to snooping. However, this means the availability of Client-Service connections using this network path will be reduced if its communication security is under threat.
SC.A.LSmSC.0

Unavailable subnet LogicalSubnet affects client-service communication: if subnet LogicalSubnet is not available, it will interrupt client-service communications via that subnet.
SC.A.SC.6.1

Disabled channel from Client to Service is not available: if the firewall rules allowing access by client Client to service Service have been disabled, then Client will not be able to access Service via that channel.
SC.A.SgmSC.0

Unavailable route at gateway Gateway affects client-service communication: if the route via Gateway from FromSubnet to ToSubnet is not available, it will interrupt client-service communications that depends on this route.
SC.C.ImSCf.3

Snooping client-service communications by spoofing subnet LogicalSubnet to Host: if an attacker can spoof physical network LogicalSubnet to Host, they can intercept client-service communications sent via LogicalSubnet from Host.
SC.A.CCfImSC.0

Connection from CHost to LogicalSubnet affects communication between Client and Service: if the connection of device CHost running Client and subnet LogicalSubnet is not available, this will affect the communication channel between client Client and service Service.
SC.C.LSmSC.3

Snooping client-service communications in subnet LogicalSubnet: If an attacker has access to messages crossing subnet LogicalSubnet, they can intercept client-service communications that follow a network path via that subnet.
SC.IS.SCmSg.8.1

Privileged channel between Client and Service in service: if all routes via gateways plus the final interface to the service host are enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.
SC.IS.SCpSg.8.1

Privileged channel between Client and Service in service: if access to Service from LogicalSubnet is enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.
Sg.TA.L3SSg2+b.8.2

Port forwarding from FromSubnet to ToSubnet via Gateway is enabled: if the route from public subnet FromSubnet to private subnet ToSubnet via a NAT gateway host Gateway is in service, then port forwarding is normally used to allow connections where expected between legitimate clients and services.
Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.
Sg.TA.L3SSg2-b.8.1

Service connections from FromSubnet to ToSubnet via Gateway allowed by default: if the route via Gateway from FromSubnet to ToSubnet is not blocked, then service connections cannot be blocked.
DF.C.ACDF-VFS-i.3.6

Encrypted flow of data Data from FlowsFrom leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can access its cryptographic key to decrypt data and accept a request for it from a false client acting as Client.
SC.C.SgACmSC.3

Client-service snooping at gateway Gateway betweenFromSubnet and ToSubnet: if an attacker has control of physical host Gateway in location Space where it is used to support client-service communication between FromSubnet and ToSubnet, then the attacker can snoop on those communications using that route through Gateway.
P.E.PcLSpmS.9

Service Process cannot control access to network LogicalSubnet: process Process cannot control access to a network because Process shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access network LogicalSubnet. The knowledge base does not support this arrangement.
SC.A.CCCmSCS.0

Client Client cannot access unavailable service Service: loss of availability in the service Service makes the connection from Client unavailable on all channels.
P.O.PILSsSC.0

Service Service running on host SHost overloaded by messages from LogicalSubnet: if the interface between SHost and LogicalSubnet is overloaded, and service Service is listening for client messages on that interface, then the overload also affects Service.
P.E.Pc-uCucmS.9

Process Client cannot be controlled by service Process: Client forwards credentials from its clients, leaving access control decisions to back-end services Service. It cannot also delegate those decisions to another process Process. The knowledge base does not support this arrangement.
P.E.Pu-pPucmS.9

Process Client must forward credentials to service Process: process Client forwards credentials from its clients, leaving access control decisions to back-end services Service. It cannot also use service Process under its own credentials, unless as an authorization service. Each client must either forward credentials or operate using its own credentials. The knowledge base does not support a mixed-mode arrangement.
P.E.RTuP-hCLI.9

Remote terminal RemoteTerminal cannot be used to access process Process: since Process may be a graphical process with no command line interface, it cannot be used by logging into its host Host using a simple terminal. If the link from RemoteTerminal and Process is correct, then either Process must be a more restricted process subclass, or RemoteTerminal must be a Remote Desktop client.
P.E.RTurP-hCLI.9

Remote terminal RemoteTerminal cannot be used to access process Process: since Process may be a graphical process with no command line interface, it cannot be used by logging into its host Host using a simple terminal. If the link from RemoteTerminal and Process is correct, then either Process must be a more restricted process subclass, or RemoteTerminal must be a Remote Desktop client.
P.L.CCCLnSAC.1

Compromise or impersonation of Client allows access to SHost via Service: if anyone can access Service as Client, then because Service is a remote access service, they can access SHost.
P.L.CCCSAC.3

Remote control of Service using a back door from Client: if a back door has previously been installed in service Service, an attacker with control of client Client can exploit the back door to gain access to the rights of Service on its host SHost.
SAP.IS.CAPSAP.8

Privileged network paths to reach service Process from Client via LogicalSubnet are open: messages can be sent from LogicalSubnet to Process thanks to firewall policy exceptions created to allow access by Client, which may be exploited by an attacker.
P.L.CSAPNaS.3

Remote control of service Service using a back door from LogicalSubnet: an attacker with access to LogicalSubnet can exploit a privileged network path to Service via that subnet, and use a previously installed back door to take control of the service, gaining access to the rights of Service on SHost.
P.L.OSAPNaS.3

Remote control of service Service using a back door from LogicalSubnet: an attacker with access to LogicalSubnet can exploit a privileged network path to Service via that subnet, and use a previously installed back door to take control of the service, gaining access to the rights of Service on SHost.
P.L.SPNaLnS.1

Remote access to login service Service via reverse proxy Client: a malicious user or an attacker who can authenticate with reverse proxy Client can send messages via Client to a back-end login service Service, gaining access to its rights on device SHost.
P.O.CCDFSFS.0

Excessive demand of data Data requested via Client overloads Service: if a request for an excessive amount of data Data reaches the data source Service, it may overload Service.
P.O.CCDFSTS.0

Excessive flow of data Data via Client overloads Service: if the flow of data Data reaching Service via Client is excessive, it may overload Service.
P.O.DDoS.3

Distributed DoS attack on service Process from subnet LogicalSubnet: an attacker with control over multiple vulnerable systems connected to LogicalSubnet can use them to send excessive messages via a privileged network paths through firewalls and overload service Process. The best defence is to arrange with your ISP to manage and restrict the traffic sent from the Internet (check threat causes for an unrestricted network interface).
P.O.DoS.3

DoS attack on service Process from subnet LogicalSubnet: an attacker with access to LogicalSubnetcan exploit a privileged network path through firewalls allowing access to service Process, sending too many messages and overloading Process. The best defence is to manage and restrict the traffic sent to the service at one of the inbound network interfaces (check threat causes for unrestricted network interfaces).
P.L.HuHW2ACE.3

Execution of malicious email attachment at WebBrowser on Host in Space: user Human runs a malicious file sent as an email attachment via MUA, allowing the attacker to exploit the privileges of their browser WebBrowser on device Host using network connections it has from location Space.
DF.C.ACDF-VCS-i.3.1

Compromised service Service reads the flow of data Data from FlowsFrom to FlowsTo sent from Client: if an attacker can compromise or impersonate service Service, they can read data in messages from Client.
DF.IS.CCSmDFS.8

Exchange of data is possible between Client and Service is possible: if the client-service relationship of Client with Service is in service, they can exchange data. This does not necessarily mean data is exchanged, only that the exchange is possible.
DF.Auth.CCCSDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Service: if client Client does not send data Data to its service Service, it is still possible to inject false content into the data flow via service Service using a confused deputy attack. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).
CC.AX.CCC-nmCCS.6.1.5

Client Client unable to authenticate via a trusted key pair with Service: the service Service requires that client connections are authenticated using an asymmetric cryptographic challenge against an X509 (or otherwise trusted) key pair, but here access is via a reverse proxy so there is no direct TLS connection.
CC.AX.CCCmSCS.0

Communication failure between Client and Service: if there are no available network paths between client Client and service Service, Client will be unable to connect to Service.
CC.AX.CACSScS.0

Client Client unable to authenticate with Service to access service Process: the service Process requires that clients authenticate with a separate service Service, which is inaccessible to client Client.
CC.AX.CACSSaS.0

Client Client unable to access service Process because Process cannot access authorization service Service: the service Process requires that clients authenticate with a separate service Service, but Process cannot access Service to exchange the client token issued by Service for an access token granting rights at Process.
CC.AuS.CRoSI.3

Spoofing network ToSubnet allows diversion of the connection of client Client to service Service to an imposter service: an attacker that has spoofed the network connection from Gateway to ToSubnet can divert messages from Client to Service so they go to a fake version of the service under their control.
CC.AuS.CRoSG.3

Spoofing of service Service to Client at gateway Gateway in Space: an attacker in control of gateway device Gateway in location Space where it handles messages sent from Client to Service, the attacker can divert these messages via a fake version of the service under their control.
CC.AuS.CRoS.3

Spoofing of service Service to Client at subnet LogicalSubnet: an attacker with control of a logical subnet on the path between client Client and service Service can divert messages for Service so they go to a fake version of the service under their control.
CC.AuS.CACSScS.3.1

Service Process spoofed to client Client by false redirection from Service: service Process authenticates clients by redirecting via authenticator Process. However, if Process is compromised, it may redirect clients back to the wrong service.
CC.AuP.PCCPCCS-i.3

Access via Client to Process via reverse proxy Service: if client Client is a reverse proxy whose client is untrustworthy, then so (in a more limited sense) is Service.
CC.AuP.CCCPCCS-i.3

Access by Client to Process via reverse proxy Service: if client Client has access to service Process via reverse proxy Service, and Client is an untrustworthy client (due to impersonation or compromise), then so (in a more limited sense) is Service.
CC.AuD.CCCSCCS-i.3

Confused deputy as Client via Service: if service Service has access to a back-end service Process that is not normally available to Client, an untrustworthy client may send a malicious request to Service that to gain inappropriate access to Process.
CC.AuD.CCCPCCS-i.3

Confused deputy Client access to Process via Service: if client Client has accepted an inappropriate request from its client to gain access to back-end service Process, and Client has access to Process via reverse proxy Service, then Service will forward the request making it a confused deputy.
CC.AuC.HumCCC-nS.3

Credential stuffing to find password used by Human to access Service from Client: this threat applies where a human user of client Client uses a weak password which can guessed or found by brute force attack and used by an attacker to access Service as the client.
CC.AuC.HuiHrCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when accessing the client via remote access from host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CC.AuC.HuiHCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when the client is running on host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.
CC.AuC.HuDSTCS.3

Unauthentic stored input Data directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client by tampering with stored input Data, can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.
DF.Auth.CCCSPDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not send data Data via its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.
CAP.IS.NPSCCAP.8

Privileged network path(s) from Client to Process are open: if a privileged path from Client to Process is open, and an attacker can access this path from AttackerSubnet, then Process can be attacked from that subnet by exploiting firewall policy exceptions allowing access by Client along the privileged path to Process.
CAP.IS.SCmCAP.8

Privileged network path(s) from Client to Service are open: if a privileged path from Client to Service is open, then Service can be attacked from subnets along that path, by exploiting firewall policy exceptions allowing access by client Client to Service.
CC.AuA.CCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.
CC.AuA.OCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.
CC.AuC.CACHcLSS.1

Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.
CC.AX.CCC-nmSCS.6.1.5

Client Client unable to authenticate via a trusted key pair with Service: the service Service requires that client connections are authenticated using an asymmetric cryptographic challenge against an X509 (or otherwise trusted) key pair, but this is not enabled at Client.
CC.AuC.CACSSaS.3.2

Spoofed authorization service Service allows impersonation of Client to Process: if service Process redirects clients to service Service for authentication, and sends the client credentials to Service for validation, then if an attacker can impersonate Service to Process can falsely validate fake client credentials. Note that this does not necessarily mean they can access Process as Client, only that the client credentials are compromised. The fake token also does not give the attacker rights to other services used by Process.
CC.AuC.CACSScS.3.1

Possible access to Process as client Client by false client of compromised service Service: if service Process redirects clients to service Service for authentication, and Service is compromised, then attackers may be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.
CC.AuC.CACSScS.3.2

Possible access to Process as client Client by interception of credentials by a service imposter: if service Process redirects clients to service Service for authentication, an attacker able to impersonate service Service to Client. Since the attacker would then have access to credentials (even if limited to a single use), they can impersonate Client to Process. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.
CC.AuC.CACSScS.3.3

Possible access to Process as client Client by snooping credentials between Client and authenticator Service: if service Process redirects clients to service Service for authentication, an attacker able to snoop the token issued by Service may be able to impersonate Client to Process before Client does the same, even if the credential is limited to a single use. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.
CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.
CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.
CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.
CC.AuC.CACSScS.1

Possible access to Process by compromised or impersonated client Client of Service: if service Process redirects clients to service Service for authentication, an attacker able to access Service as Client will be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.
CC.AX.CCC-nS.6.1.1

Client Client unable to authenticate via password with Service: the service Service requires that clients authenticate using a password, but this is not available to client Client.
CC.AuC.HuDFTCS.3

Unauthentic flow of data Data from FlowsFrom directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client via FlowsFrom (e.g. via phishing), can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.
CC.AX.CCCS.1.3

Compromised service Service prevents access by Client: if service Service is compromised then the attacker can prevent Client from authenticating with the service.
CC.R.HuoStCCCS.1

Malicious action by insider Human using Client to access Service: if user Human of client process Client is malicious, they can abuse the right of Client to access service Service.
CC.R.HuStCCCS.1

Malicious action by employee of Employer using Client to access Service: user Human of client process Client may be persuaded by their employer Employer to abuse the right of Client to access service Service.
CP.IS.SCmCP.8

Client path(s) from Client to Service is in service: if there is an open channel from client Client to service Service, then the service may be subject to authenticated attacks from logical subnets exploiting the open channel.
DF.A.CCDFSC.6.3

Flow of data Data from FlowsFrom to FlowsTo via untrustworthy process Client disabled: if the system operates a policy to disable the flow of data Data from FlowsFrom if there is a perceived loss of trustworthiness in the recipient Client, then there will also be a loss of availability if Client is untrustworthy.
DF.A.CC-iDFCS.0

Flow of data Data from FlowsFrom to FlowsTo interrupted because Client cannot access Service: if client Client cannot access service Service, the end to end flow of data Data from FlowsFrom to FlowsTo that uses this client-service connection will be interrupted.
DF.A.CC-iDFC-SS.0

Flow of data Data from FlowsFrom to FlowsTo interrupted by unavailable process Client: if process Client is not available then it will be unable to initiate or forward the flow of Data between FlowsFrom to FlowsTo.
DF.Auth.AC-iDF-VSC.3.2

Imposter posing as Service injects false content into the flow of data Data from FlowsFrom to FlowsTo between Service and Client: if an attacker can impersonate service Service, they can inject false data in messages to Client.
DF.A.CC-iDFSC.0

Flow of data Data from FlowsFrom to FlowsTo interrupted because Client cannot access Service: if client Client cannot access service Service, the end to end flow of data Data from FlowsFrom to FlowsTo that uses this client-service connection will be interrupted.
DF.Auth.ACDFVFS-i.3.6

Encrypted flow of data Data to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can access its cryptographic key and alter data Data flowing between Service and FlowsTo.
DF.Auth.ACDF-VSC-i.3.1

Flow of data Data from FlowsFrom to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can they can inject fake data via messages to Client.
DF.Auth.AC-iDF-VCS.3.2

Compromised or impersonated client Client injects fake content into the flow of data Data from FlowsFrom to FlowsTo between Client and Service: if an attacker can compromise or impersonate client Client, they can inject fake data in messages to Service.
DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.
DF.Auth.AC-iDF-VFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.
CC.AX.CCC-nS.6.1.3

Client Client unable to use 2-factor authentication to access service Service: if service Service requires clients to authenticate using a second factor (e.g. a one time key or out of band key exchange), but this is not available to Client then access will be impossible.
DF.Auth.ACDF-VFS-i.3.6

Encrypted flow of data Data to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can access its cryptographic key and alter data Data flowing between Service and FlowsTo.
CC.R.CCCS-i.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.
DF.A.CCDFCS.6.3

Flow of data Data from FlowsFrom to FlowsTo via untrustworthy Service disabled: if the system operates a policy to disable the flow of data Data from FlowsFrom if there is a perceived loss of trustworthiness in a recipient Service, then there will also be a loss of availability if Service is untrustworthy.
CC.L.CSHSAC.1

Client Client affected by access to compromised service Service via LogicalSubnet: if Service can be controlled by the wrong person (i.e. an attacker) in a context where it is accessed by client Client, they can alter the behaviour of Service towards Client.
CC.AX.CCCS.6.1

Disabled access by client Client to Service: access by client Client to service Service has been disabled to prevent communication threats. However, this also causes a loss of accessibility of the service from that client.
CC.AX.CCCS.6.2

Disabling access by impersonated client Client to Service affects availability: access by client Client to service Service may be disabled to prevent access by an impersonated client, but this affects the availability of client-service connections.
CC.R.CACvsCCS.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.
CC.AX.CCCvCCS.0

Access by Client to Service blocked between ProxyClient and Proxy: if Client is accessing Service via a proxy, then a comms failure to or from the proxy also causes an end-to-end comms failure between Client and Service.
CC.AX.CCDFSFS.6.4

Disabling excessive access by client Client to Service affects availability: access by client Client to service Service may be disabled to prevent excessive amounts of data being requested from the service, but this affects the availability of client-service connections.
CC.AX.CCDFSTS.6.4

Disabling excessive access by client Client to Service affects availability: access by client Client to service Service may be disabled to prevent excessive amounts of data being sent to the service, but this affects the availability of client-service connections.
CC.AX.HuCCC-nS.6.1.2

User Human of client Client forgot the password to authenticate with Service: the service Service requires that clients authenticate using a strong password, but the user Human cannot remember the password.
CC.AX.CCCS.6.3

Disabling access by untrustworthy client Client to Service affects availability: access by client Client to service Service may be disabled to prevent access by a malicious or compromised client, but this affects the availability of client-service connections.
CC.C.CCCSCSoAC.3

Communications intercepted between Client and Service: if a network communication path used by Client and Service is subject to snooping, then communications between Client and Service can be intercepted.
CC.E.CSCC-SC.9

No network path from Client to Service: processes Client and Service on different hosts are exchanging messages directly (not via a reverse proxy), but there is no network path connecting their Hosts. Either move them to the same host, or add network connections and/or devices to provide a network path to support their communications.
CC.IS.CSCCmCC.8

Client channel from Client to Service is in service: here, access is via at least one proxy, so the channel is in service and subject to threats only if all its intermediate channels are in service, and it is not disabled by a policy change preventing access to Service by Client.
CC.IS.CSCCSC.8

Client channel from Client to Service is in service: there is a service channel that is not out of service, so the client channel is in service and subject to threats unless disabled by a policy change preventing access to Service by Client.
CC.L.CSCCHuoSt.1

Malicious action by insider Human controlling Service affects Client: if the user Human controling service Service is malicious, they can make it mishandle requests sent from Client.
CC.AX.HuCCC-nS.6.1.7

Continuous authN false negative at Client prevents access to Service: the service Service requires that clients use continuous authentication to verify the identity of the user Human, and this is in place but produces a false negative result.
CC.L.CSCCHuSt.1

Malicious action by employee of Employer controlling Service affects Client: the user Human controling service Service may be persuaded by their employer Employer to make the service mishandle requests sent from Client.

H.M.PHdH.2

Control of host Host provisioned on stolen physical host PhysicalHost: if an attacker has access to admin rights on stolen device PhysicalHost, they can gain access to virtual host Host.
H.P.PHS-iC.3

Theft of device Host from Space: an attacker with access to the physical space Space is able to steal device Host.
I.IS.INC.2

Access from stolen host Host to LogicalSubnet re-enabled: if an attacker gains access to stolen device Host, they can override a policy not to connect it to subnet LogicalSubnet.
LS.L.HL3S.2

Stolen host Host used to communicate on subnet LogicalSubnet: if an attacker gains access to stolen device Host, they can use it to send messages on LogicalSubnet.
P.L.HuiPCH.2.2

Console access to weakly protected account of Human on stolen device Host: an attacker with possession of device Host exploits lax password security by user Human to access processes running under their account.
P.L.HuiPCH.2.1

Console access to unprotected account of Human on stolen device Host: an attacker with possession of device Host uses console access to an unprotected user account and gains access to processes running under that account.
P.L.PMHHS.2.1

Use of Process by reconnecting stolen device Host to networks in Space: an attacker with possession of physical device MobileClient and access to Space can reconnect Host to networks accessible from Space and exploit their ability to control how Process makes use of that connectivity to access services.
P.L.SHP.2

Use of admin privilege at Host to control Process: someone with admin rights on stolen device Host can control process Process hosted by that device and use its privileges.
H.M.MHHS.2.1

Reconnection of stolen device Host in Space: an attacker with possession of device MobileClient and access to Space can reconnect the device to networks accessible from that space.
P.IS.HP.2

Process Process re-enabled on stolen device Host: if an attacker gains access to stolen device Host, they can restart Process, overriding the policy to disable Process.
H.M.HumCH.2.2

Console access to weakly protected admin account on stolen device Host: an attacker with possession of device Host exploits exploits lax password security by user Human to access an admin account via the console.
DF.Auth.AC-iDF-VFC.2.6

Client Client on stolen host CHost injects fake content into the encrypted flow of Data via Service: if an attacker has possession of host CHost and can access client Client, they can access its cryptographic key and inject malicious content into the flow of Data from Client to FlowsTo.
H.M.CH.2.1

Console access to unprotected admin account on stolen device Host: an attacker with possession of device Host exploits an unprotected admin account via the console.
H.M.CH.2.3

Console access to admin account on stolen device Host: an attacker with possession of device Host is eventually able to hack into it and access an admin account via the console.
CC.AuC.CACHLSS.2

Client Client on stolen host CHost used to access Service via LogicalSubnet: if an attacker in possession of stolen device CHost can control the installed client Client when CHost is connected to LogicalSubnet, the attacker can use Client to access Service using a privileged network path, thus acting as a false (impersonated) client.
DF.C.AC-iDFVTC.2.6

Client Client on stolen host CHost reads the encrypted flow of Data from/via Service: if an attacker has possession of host CHost and can access client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
DF.C.AC-iDF-VTC.2.6

Client Client on stolen host CHost reads the encrypted flow of Data from/via Service: if an attacker has possession of host CHost and can access client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
DF.Auth.AC-iDFVFC.2.6

Client Client on stolen host CHost injects fake content into the encrypted flow of Data via Service: if an attacker has possession of host CHost and can access client Client, they can access its cryptographic key and inject malicious content into the flow of Data from Client to FlowsTo.
DS.C.HDS-V.2.2

Use of admin rights on stolen device Host to access stored data Data: if an attacker gains access to stolen device Host, they can read (unencrypted) copies of Data stored on the Host.
DS.C.HPsACr-pDS-V.2

Use of Process to access Data stored on stolen device Host: if an attacker can access Process on stolen device Host, they can exploit the rights of Process to read and serve the locally stored copy of Data.
DS.C.HPsACrpDS-V.2

Use of Process to access Data on stolen device Host: if an attacker can access Process on stolen device Host, they can use the rights of Process to read a local stored copy of Data.
DS.C.HPsACr-pDS-V.2.6

Use of compromised key at Process to access Data stored on stolen device Host: if an attacker can access Process on stolen device Host, they can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
DS.C.HDS-V.2.1

Physical access to data Data on stolen host Host: an attacker in possession of device PhysicalHost can physically transfer its storage media to another device to access data stored there.

LS.L.VSPS-HP.3

Access to virtual subnet LogicalSubnet via physical network PhysicalSubnet: if an attacker has access to physical subnet PhysicalSubnet, they connect to virtual subnet LogicalSubnet routed over PhysicalSubnet, unless prevented by security measures.
LS.C.LSoLS.3

Passive snooping in OverlaySubnet via LogicalSubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then an attacker who can snoop messages sent over LogicalSubnet can also snoop messages in OverlaySubnet.
LS.E.pLSoLS.9

Lack of connectivity for overlay subnet OverlaySubnet: since OverlaySubnet is an IP overlay network, it should be overlaying at least one other subnet, but none was found.
LS.IS.mLSoLS.8

Subnet OverlaySubnet in service: if subnet OverlaySubnet is an overlay on one or more other subnets, and they are all in service, then so is OverlaySubnet.
LS.L.LSoLS.1

Access to LogicalSubnet allows access to OverlaySubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then an attacker with access to LogicalSubnet can also access OverlaySubnet.
LS.L.VSPSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from PhysicalSubnet: if someone has control of device Gateway providing virtual subnet LogicalSubnet, and access to the underlying physical subnet PhysicalSubnet, they can connect their own device to the virtual subnet.
LS.L.VSPSH-P.3

Access to virtual subnet LogicalSubnet via physical network PhysicalSubnet: if an attacker has access to physical subnet PhysicalSubnet, they connect to virtual subnet LogicalSubnet routed over PhysicalSubnet, unless prevented by security measures.
VC.A.VC2HmHC.0

Communication failure in VirtualSubnet due to physical network failure between LocalHost and RemoteHost: the availability of communications in VirtualSubnet depends on that of physical network paths between LocalHost and RemoteHost.
LS.A.LSoLS.0

Loss of availability in subnet LogicalSubnet affects overlay OverlaySubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then if LogicalSubnet is not available, neither is OverlaySubnet.
SC.A.VC2HmSC.0

Loss of physical connectivity between LocalHost and RemoteHost affects client-service communications: if there is a loss of availability in physical network paths between LocalHost and RemoteHost supporting communications in subnet VirtualSubnet, then client-service communication via that virtual subnet will become unavailable.
SC.C.VSHCmSC.3

Snooping client-service comms subnet VirtualSubnet between LocalHost and RemoteHost: If an attacker can snoop at the physical layer between LocalHost and RemoteHost, they can intercept client-service comms in virtual subnet VirtualSubnet that go between those physical hosts.
VH.E.VHH3.9

Virtual host VirtualHost cannot have two hosts: hosts SHost and Host both have relationships indicating that VirtualHost is provisioned on them. A virtual host can only be provisioned on one underlying host at a time. Please break one of the relationships.
VH.M.HACVHmAC.1

Use of admin rights on Host when in Space to control VirtualHost: those with admin rights at device Host when in location Space can control virtual host VirtualHost provisioned on Host.
VS.E.VSVC4H-PP.9

Lack of physical connectivity for virtual subnet VirtualSubnet: hosts FromHost and ToHost on the same virtual network VirtualSubnet cannot communicate over VirtualSubnet because there is no physical network path between their physical hosts LocalHost and RemoteHost. Either add more network connections to support their communications, or make VirtualSubnet a physical subnet.
LS.M.LSoLS.1

Loss of control in subnet LogicalSubnet affects overlay OverlaySubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then if LogicalSubnet is controlled by malicious actors, so is OverlaySubnet.
I.Auth.HVSICSG.3

Spoofing virtual network LogicalSubnet to supplicant Host: at attacker who is able to impersonate the service Service mediating access to LogicalSubnet can induce a supplicant device Host to connect to the wrong virtual subnet.
H.IS.HVH.8

Host Host in service: virtual host Host is not disabled, so is potentially subject to threats.
HC.C.SgACmHC.3

Virtual network snooping at gateway Gateway betweenFromSubnet and ToSubnet: if an attacker has control of physical host Gateway in location Space where it is used to support communication between FromSubnet and ToSubnet, then the attacker can snoop on virtual subnet communications using that route through Gateway.
I.A.GdHVS.6

Device Host unable to connect to virtual subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.
H.A.HVH.0

Loss of availability at SHost affects Host: if host SHost becomes unavailable, so will the host Host provisioned on SHost.
H.A.VHHHoDC.1

Restriction on availability of virtual host Host provisioned by SHost: whoever controls resource allocation for devices of class SHost can control availability for virtual hosts of class Host provisioned on SHost.
H.E.HuiVH.9

User Human cannot interact directly with virtual host Host: host Host is of a type that does not have a user interface, yet user Human is interactively using the host or a process running on it, which is not possible. Either change the type of Host, move the interactive user or process, or convert the process into a service accessed via an interactive client on a different host.
H.E.VHH2.9

Circular virtual hosting relationship at VirtualHost: virtual host VirtualHost is provisionedBy host Host, but that is also a virtual host that is (directly or indirectly) provisioned by VirtualHost. Review the provisionedBy relationships and remove the circular dependency. The simplest solution is to only provision virtual hosts either on physical hosts or at a data centre.
HC.A.ImHCf.0

Interrupted virtual subnet communications from Host via LogicalSubnet: if the connection between Host and LogicalSubnet is not available, then virtual network traffic sent from Host via LogicalSubnet will also be interrupted.
H.E.THVH.9

Hosting error for virtual host VirtualHost: device TrivialHost is a specialised host that cannot provision virtual host VirtualHost. Either remove VirtualHost, or move its provisionedBy relationship to a more general purpose host.
HC.A.LSmHC.0

Loss of availability in subnet LogicalSubnet affects virtual network comms: if subnet LogicalSubnet is not available, then this also applies to virtual network communications sent via this subnet.
HC.A.SgmHC.0

Connectivity issue at Gateway affects virtual network comms: if the route via Gateway between FromSubnet and ToSubnet is not available, virtual network comms via this route will be interrupted.
HC.C.ImHCf.3

Snooping virtual subnet communications by spoofing subnet LogicalSubnet to Host: if an attacker can spoof physical network LogicalSubnet to Host, they can intercept virtual communications sent via LogicalSubnet from Host.
HC.C.INCmHCf.3

Snooping virtual network comms from host Host via LogicalSubnet: if an attacker has control of physical host Host when it is connected to LogicalSubnet, they can snoop virtual communications sent from Host over LogicalSubnet.
HC.C.INCmHCt.3

Snooping virtual network comms to host Host via LogicalSubnet: if an attacker has control of physical host Host when it is connected to LogicalSubnet, they can snoop virtual communications sent to Host via LogicalSubnet.
HC.C.LSmHC.3

Virtual network communications snooped in physical subnet LogicalSubnet: if network traffic can be snooped in subnet LogicalSubnet, then this also applies to virtual network communications sent via this subnet.
HC.A.ImHCt.0

Interrupted virtual subnet communications to Host via LogicalSubnet: if the connection between Host and LogicalSubnet is not available, then virtual network traffic sent to Host via LogicalSubnet will also be interrupted.

P.E-A.HP-iT.8

Vulnerability (A) discovered at Process: software vulnerability found in process Process, which could allow an attack on process availability, and may be known to attackers. Only around 4 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
P.E-M.SHP-iT.8

Vulnerability (M) discovered at Process: software vulnerability found in process Process, which could allow admin level access to its host device, and may be known to attackers. Around 18 percent of vulnerabilities allow complete control of the vulnerable device (NVD 2015-2019).
P.E-I.HP-iT.8

Vulnerability (I) discovered at Process: software vulnerability found in process Process, which could allow an attack on data integrity, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
P.E-C.HP-iT.8

Vulnerability (C) discovered at Process: software vulnerability found in process Process, which could allow an attack on data confidentiality, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
P.E-AU.HP-iT.8

Vulnerability (AU) discovered at Process: software vulnerability found in process Process, which could allow an attack bypassing authentication, and may be known to attackers. Around 82 percent of vulnerabilities can be accessed without authentication (NVD 2015-2019).
P.A.HuDSsXSS.6

Service Service disabled to prevent XSS attack on Client injected via local input Data: if service Service is disabled to prevent XSS attacks on Client injected via input Data, then Service will be unavailable.
H.W.HIoH.3

Remote malware exploit on device Host from LogicalSubnet: an attacker with access to subnet LogicalSubnet sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.
P.A.HuDFsXSS.6

Service Service disabled to prevent XSS attack on Client injected via input Data from FlowsFrom: if service Service is disabled to prevent XSS attacks on Client injected via input Data from FlowsFrom, then Service will be unavailable.
P.A.HuDFrXSS.6

Service Service disabled to prevent XSS attack on Client via its input Data from FlowsFrom: if service Service is disabled by HostManager to prevent XSS attacks using malicious content injected via Data from FlowsFrom, this will make the service unavailable.
P.A.HP-iT.4

Attacker exploit disables Process: the attacker exploits a vulnerability in the process Process and is able to crash it or otherwise prevent access to it.
H.W.HRoH.3

Remote malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.
H.W.HLoH.3

Adjacent malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.
P.E-QI.HP-iT.8

Vulnerability (QI) discovered at Process: software vulnerability found in process Process, which could allow injection of queries into a back-end database, and may be known to attackers. Around 3 percent of vulnerabilities relate to query injection, but around 5 percent of all low complexity attacks are of this type (NVD 2015-2019).
P.A.HuDSrXSS.6

Service Service disabled to prevent XSS attack on Client via its input Data: if service Service is disabled to prevent XSS attacks using malicious content injected via locally stored inpuut Data, this will make the service unavailable.
P.E-U.SHP-iT.8

Vulnerability (U) discovered at Process: software vulnerability found in process Process, which could allow user level access to its host device with the rights of the process, and may be known to attackers. Around 30 percent of vulnerabilities allow local user access to the vulnerable device (NVD 2015-2019).
P.V.CCCSACvLS.2

Adjacent authenticated exploit as Client on service Service from LogicalSubnet: an attacker able to authenticate as client Client and access Service via an adjacent subnet LogicalSubnet used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.
P.E-VL.HP-iT.8

Vulnerability (VL) discovered at Process: software vulnerability found in process Process, which could allow an attack by a local user, and may be known to attackers. Around 14 percent of vulnerabilities require local user access to the vulnerable device (NVD 2015-2019).
P.W.HPsACDSrDI.2

Malware infection of Process via stored input Data: if the stored copy of Data on Host is infected with malware, then process Process may be affected when it uses the data as an input.
P.W.HPDFDI.2

Infection of Process via malware in flow of Data from FlowsFrom: if the copy of Data received from FlowsFrom is infected with malware, process Process may become infected when it consumes the data as an input.
P.W.CCCS.3

Worm propagation exploit on service Service from Client: an infected client Client can send a message containing malware that without authentication, can exploit a bug in Service and infect the process.
P.V.SPNaS.2

Remote authenticated exploit on service Service via reverse proxy Client: a malicious user or attacker able send messages to Service via reverse proxy Client can send a malicious request that can exploit a bug in Service after authentication.
P.V.OSAPNaS.3

Remote anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can use a privileged network path to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.
P.V.OSAPLaS.3

Adjacent anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can exploit firewall policy exceptions enabling access to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.
P.V.HACPmAC.2

Local authenticated exploit on process Process in Space: an attacker with local user access to device Host in space Space can exploit a bug in Process.
P.V.CSAPNaS.3

Remote anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can use a privileged network path to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.
P.V.CCCvsCCSAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.
P.V.CCCS-iAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.
H.V.NoH.3

Remote anonymous exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, without authentication, can exploit a vulnerability in Host.
P.L.HPAC.4

Attacker exploit takes control of Process in Space: the attacker exploits a vulnerability in process Process when its host Host is located in Space, giving them control of the process behaviour and access to its privileges on Host when in that location.
P.E-XS.HP-iT.8

Vulnerability (XS) discovered at Process: software vulnerability found in process Process, which could allow a cross-site scripting attack on a client, and may be known to attackers. Around 14 percent of vulnerabilities relate to cross site scripting, including 32 percent of vulnerabilities relating to medium complexity exploits (NVD 2015-2019).
P.E-W.HP-iT.8

Vulnerability (W) discovered at Process: software vulnerability found in process Process, which could allow an attack by self-propagating malware, and may be known to attackers. Statistics not analysed, but should be less likely than user-level access because someone would need to know about the vulnerability and then develop fully automated and self-propagating malware able to attack it.
P.E-VN.HP-iT.8

Vulnerability (VN) discovered at Process: software vulnerability found in process Process, which could allow an attack from a remote network, and may be known to attackers. Around 84 percent of vulnerabilities can be accessed from a remote network (NVD 2015-2019).
P.E-VA.HP-iT.8

Vulnerability (VA) discovered at Process: software vulnerability found in process Process, which could allow an attack from an adjacent network, and may be known to attackers. Under 2 percent of vulnerabilities require low level access from an adjacent network (NVD 2015-2019), and presumably the majority are in the O/S (i.e. the host).
H.V.NoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.
H.V.CHS-iP.3

Local anonymous exploit on host Host in Space: an attacker with physical access to the console of device Host in Space is able to exploit a bug in Host.
H.V.LoH.2

Adjacent authenticated exploit on device Host from LogicalSubnet: an attacker with local access to device Host when connected to subnet LogicalSubnet can send a message containing malicious content that, after authentication, can exploit a bug in Host.
DS.C.HPsACrpDS-V.4

Attacker exploit at Process accesses its input Data: the attacker is able to exploit a vulnerability in process Process, gaining access to the stored copy of Data used by the process on its host device Host.
DS.C.HPsACr-pDS-V.4

Attacker exploit at Process accesses Data: the attacker is able to exploit a vulnerability in process Process and gains access to the stored copy of Data on device Host which is served by the process.
DS.C.HDS-V.4

Attacker exploit at Host accesses stored data Data: the attacker is able to exploit a vulnerability in device Host gaining access to its stored copy of Data.
DS.Auth.HPsACdpDS-V.4

Attacker exploit at Process alters output Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data updated by the process on its host device Host.
DS.Auth.HPsACd-pDS-V.4

Attacker exploit at service Process alters Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data on its host device Host.
DS.Auth.HDS-V.4

Attacker exploit at Host alters stored copy of Data: the attacker exploits a vulnerability in device Host and is able to alter the stored copy of Data on the device.
H.A.H.4

Attacker exploit disables Host: the attacker exploits a vulnerability in device Host and is able to crash the device.
DS.A.HPsACDAdDS.4

Attacker exploit at Process to delete Data: the attacker exploits a vulnerability in process Process and is able to delete or otherwise disable access to the stored copy of Data on its host device Host.
CC.R.CDBSC.4

Query injection at Service into back end DB: an attacker having exploited a bug in Service when connected to DB, is able to send arbitrary queries to DB. This is modelled as an adverse behaviour in the inferred client channel representing their trust relationship, fulfilling the precondition for further threats using injected queries to access or alter data stored by DB.
CC.AuC.DSsXSS.3

Stored XSS exploit from Service against Client: an attacker who can inject malicious content into service input Data stored on SHost can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.
CC.AuC.DSrXSS.3

Reflected XSS exploit on Client from Service injected via locally stored client input Data: an attacker who can inject malicious content into locally stored input Data used by Client can exploit a bug in Service and send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.
CC.AuC.DFsXSS.3

Stored XSS exploit against Client by Service injected via input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Service from FlowsFrom can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.
CC.AuC.DFrXSS.3

Reflected XSS exploit on Client via Service injected via client input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Client from FlowsFrom can exploit a bug in Service to send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.
SC.A.HuCAPmSC.6.2

Suspended channels from Client to vulnerable service Service via LogicalSubnet are not available: the firewall rules allowing access by client Client to service Service may be disabled if the risk of an expoit by an attacker on subnet LogicalSubnet is too high. . However, this cuts privileged network paths, so communication between Client and Service via that subnet will become unavailable.
DS.A.HDS.4

Attacker exploit at Host deletes Data: the attacker exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.
H.E-A.TH.8

Vulnerability (A) discovered at Host: software vulnerability found in device Host, which could allow an attack on host availability, and may be known to attackers. Only around 4 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
H.E-AU.H.8

Vulnerability (AU) discovered at Host: software vulnerability found in device Host, which could allow an attack that bypasses authentication, and may be known to attackers. Around 82 percent of vulnerabilities can be accessed without authentication (NVD 2015-2019).
H.E-C.TH.8

Vulnerability (C) discovered at Host: software vulnerability found in device Host, which could allow an attack on data confidentiality, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
H.V.IoH.3

Remote anonymous exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, without authentication, can exploit a vulnerability in Host.
H.V.IoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.
H.V.HL1HS.3

Anonymous exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, without authentication, can exploit a bug in Host.
H.V.HL1HS.2

Authenticated exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, after authentication, can exploit a bug in Host.
H.V.HAC.2

Local authenticated exploit on device Host when in location Space: an attacker with local user level access to device Host in location Space exploits a bug in Host.
H.M.HmACPAC.4

Attacker exploit at Process in location Space gains admin rights at Host: the attacker exploits a vulnerability in the process Process when its host Host is in Space, and is able to escalate privileges to gain admin rights on Host in that context.
H.M.HAC.4

Attacker exploit gains admin rights at Host when it is in location Space: the attacker exploits a vulnerability in device Host in context HostAccess and gains control over the device in that context.
H.L.HAC.4

Attacker exploit gains user privileges at Host in location Space: the attacker exploits a vulnerability in device Host when it is located in Space, and gains user level access to the device in that context.
H.J.GH.7

Malware inserts remote access back door in infected device Host: the malware infecting device Host exploits a vulnerability to insert a means for the attacker to remotely access admin privileges on Host.
H.E-W.GH.8

Vulnerability (W) discovered at Host: software vulnerability found in device Host, which could allow an attack by self-propagating malware, and may be known to attackers. Statistics not analysed, but should be less likely than user-level access because someone would need to know about the vulnerability and then develop fully automated and self-propagating malware able to attack it.
H.E-VN.H.8

Vulnerability (VN) discovered at Host: software vulnerability found in device Host, which could allow an attack from a remote network, and may be known to attackers. Around 84 percent of vulnerabilities can be accessed from a remote network (NVD 2015-2019).
H.E-VL.H.8

Vulnerability (VL) discovered at Host: software vulnerability found in device Host, which could allow an attack by a local user, and may be known to attackers. Around 14 percent of vulnerabilities require local user access to the vulnerable device (NVD 2015-2019).
H.E-VA.H.8

Vulnerability (VA) discovered at Host: software vulnerability found in device Host, which could allow an attack from an adjacent network, and may be known to attackers. Under 2 percent of vulnerabilities require low level access from an adjacent network (NVD 2015-2019).
H.E-M.SH.8

Vulnerability (M) discovered at Host: software vulnerability found in device Host, which could allow an attack gaining admin level access, and may be known to attackers. Around 18 percent of vulnerabilities allow complete control of the vulnerable device (NVD 2015-2019).
H.E-I.TH.8

Vulnerability (I) discovered at Host: software vulnerability found in device Host, which could allow an attack on data integrity, and may be known to attackers. Less than 1 percent of vulnerabilities are specific to this type of action (NVD 2015-2019).
H.V.LoH.3

Adjacent anonymous exploit on device Host from LogicalSubnet: an attacker with local access to the subnet LogicalSubnet to which device Host is connected can send a message containing malicious content designed to exploit a bug in Host, without authentication.
SC.A.HuSAPmSC.6.2

Suspended channels to vulnerable service Service via LogicalSubnet cuts availability: the firewall rules allowing access to service Service via LogicalSubnet may be suspended if necessary to prevent attacks. However, this cuts privileged network paths, so communication with Service via that subnet will become unavailable.