Trustworthiness Attributes

Trustworthiness of the actor or process managing a host (including control over access to the host) while it is connected to the system and fulfilling its system role (i.e. in some context).

Free of software vulnerabilities that are accessible to attackers.

Trustworthiness of users with access to the shell or having the rights of a process on a host while the host is connected to the system and fulfilling its system role (i.e. in some context).

The data (which may be embedded in an IoT device) is what it claims to be, i.e. it is neither forged nor altered in a way designed to induce false behaviour in other assets consuming the data.

Signifies that data (which may be embedded in an IoT device) is only accessible to authorised users.

The data (which may be embedded in an IoT device) is correct and fit for purpose.

Represents a state in which a data asset is up to date, or a process or human has up to date inputs.

An attribute of stored or flowing copies of data, signifying that the data is accessible in unencrypted form. Considered a trustworthiness attribute as it precludes loss of availability where a process lacks a suitable decryption key, and used to model side effects of encryption controls.

An attribute of stored or flowing copies of data, signifying that the data is accessible in encrypted form. Considered a trustworthiness attribute as it prevents loss of confidentiality unless the key is compromised, and used to model side effects of encryption controls.

Represents the spare capacity at a Data Centre.

The host has no back doors inserted into its operating system or other software running on the host. If back doors are present, this also makes processes running on the host vulnerable.

Provisining is controlled by a trustworthy process or administrator.

The asset is not currently engaged or being used within the system, and hence cannot be exploited by attackers.

Trustworthiness of users with access to an abstract or logical network subnet.

Control over routing within an abstract or logical subnet.

Free of functional software bugs that cause errors or crashes without external provocation.

Free of self-propagating malware.

Free of software vulnerabilities in processes and devices that are likely to be discovered by potential attackers.

Modelling artefact: an attribute that is always set to the lowest trustworthiness level, and used as a cause for threats that are triggered entirely by the use of security controls.

Represents the total capacity at a Data Centre, or more accurately, the level of trust that it will be able to handle any demand placed on it by automatically provisioned for hosts and processes.

Signifies that bandwidth used by message flows through an interface can be restricted based on their source and/or destination addresses.

Applies to a network or a communication channel between processes, signifying that messages cannot be intercepted and read in that network or channel.

Applies to a communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets, signifying that by default, messages will be dropped.

The connection from a supplicant device is not an imposter subnet.

Trustworthiness of users with physical access to a space.

Control over the means of access to a space.

The service accessed by a client is not controlled by a malicious actor.

Applies to a communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets. Signifies that no exceptions were created to allow client-service connections and messages to tunnel through a default deny routing policy.

The service accessed by a client is not an imposter.

Only trustworthy clients can send requests via the client (which is a reverse proxy) to the related service.

Only trustworthy users can send messages to a service from the direction of a specific client. This relates to any message so it includes messages sent anonymously, prior to authentication. It is not related to which users can access the service. Consequently, the calculated level will often be low, and this is not necessarily a cause for concern.

The client accessing the related service is not controlled by an untrustworthy actor. This pertains to the trustworthiness of those able to access the service as the client (i.e., after authentication).

The client accessing the related service has a reliable means of authentication which can be verified by the service. This is not related to the trustworthiness of those able to access the service, only the trustworthiness of those in possession of client credentials.

The client is clear on what requests it should send to the service on behalf of its own clients.

A device or a process running on the device is still controlled by a trustworthy actor or process in some context after the device has been stolen by an attacker.

Attribute signifying that a (mobile) device is in the hands of the right user.

The ability to detect attempts by other agents to induce inappropriate action through deception.

The asset is able to carry out its function within the system, including being accessible by other assets that need to interact with it.

Free of malicious motives or desires to cause adverse effects without external provocation.

Ability to carry out reliably the functions of a user role within the system.

Means the asset will perform tasks correctly, with no functional errors, assuming the asset is not supplied with corrupt or inaccurate information as input (in the case of Human or Process assets).

Propensity of a Stakeholder (usually a Human) to engage with and fulfil their role in a system.

Free of software vulnerabilities that can be accessed from a remote network.

Free of software vulnerabilities that can be accessed from a local shell or via physical access.

Free of software vulnerabilities that can be accessed only from the local network, requiring access to either the broadcast or collision domain of the vulnerable software.

Free of software vulnerabilities whose exploitation would allow an attacker user level access.

Free of software vulnerabilities that allow injection of queries into a trusting back-end process.

Free of software vulnerabilities whose exploitation would compromise asset availability.

Free of software vulnerabilities whose exploitation would compromise integrity or authenticity of data.

Free of software vulnerabilities whose exploitation would compromise confidentiality.

Free of software vulnerabilities that can be accessed without authentication.

Free of software vulnerabilities whose exploitation would allow insertion of self-propagating malware.

Free of software vulnerabilities whose exploitation would allow an attacker to take control.

Free of software vulnerabilities that allow injection of malicious scripts into a client process.