Control Strategy IgnorePhysicalThreatsFromWorld

URI: CSG-IgnorePhysicalThreatsFromWorld

Description: Indicates that threats from as well as to the space Space can be ignored, i.e. that the risk model intentionally does not consider physical attacks from Space. This is only permitted if Space is the inferred global public space (the World) used when no locations are asserted in the model. This control strategy is a way to specify that physical security is out of scope for devices with no explicitly specified location(s), i.e. that they are considered physically secure.

(empty)

D.C.HuiPiDCHS.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human enters Data via the user interface of Process on host device Host.

D.C.HuiRACHSPiD.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session in which Human enters Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.

D.C.HuiPv-iDFCHS.3

Data Data sent from FlowsFrom to Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.

D.C.HuiPv-iD-FCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.

D.C.HuiRACv-iDFCHS.3

DS.A.PHHDS.3

Stored copy of Data on AHost lost due to theft or destruction of Host in Space : an attacker with access to Space can physically steal or destroy device Host, removing it from the system, rendering data stored on AHost unavailable. The threat to data is distinct from the threat to the host, as Host could be replaced if the loss is detected, but that would not restore the lost copy of Data.

H.J.UHS.3

Tampering with software via USB at Host in Space: at attacker with physical access to Host in space Space reboots from a USB device and introduces software changes, introducing a means for the attacker to get remote access to admin privileges on Host.

H.W.UHS.3

Physical insertion of malware via USB at Host in Space: at attacker with physical access to space Space is able to insert self-replicating malware on USB Host Host in situ, using physical means (such as power cycling) to reboot and avoid anti-malware software, if installed.

I.Auth.HBImSG.6

Spoofing a device RemoteHost in a Bluetooth pair with device Host in Space: an attacker with access to a location where Host is paired with RemoteHost can spoof the latter to the former. This threat captures the case where SSP is used with a one-sided user confirmation. In principle this can still be spoofed, but it would have to be done where the pair is established, which can be the most secure location they are used (not necessarily in Space where the attacker is present).

I.Auth.HBISG.3

Spoofing a device RemoteHost in a Bluetooth pair with device Host in Space: an attacker with access to a location where Host is paired with RemoteHost, they can physically spoof the connection. This threat covers the case where the connection is freshly established in each location where it is needed.

I.Auth.HUISG.3

Spoofing a device RemoteHost in a USB pair with device Host in location Space: an attacker with access to the location Space of Host can connect a fake version of device RemoteHost to Host.

H.A.PHS.3

Destruction of Host in Space: an attacker with access to Space can physically remove or destroy device Host, removing it from the system and making it unavailable.

H.E.WmPH.9

Physical hosts exist that have no specified or inferrable location: any host with no location is inferred to be in the inferred global public space Space, so physical attacks are not overlooked. If the location of some hosts was deliberately omitted, select controls to indicate whether this is because those hosts are indeed not in a secure location, or because physical attacks on those hosts are out of scope in this system model. If the host locations was an oversight, please add space assets representing their location (if not already included) and add relationships to specify in which space each host is located.

H.IS.PHS-iP.1

Switching on device Host in Space: an attacker with access to Space can physically access disabled device Host and switch it back on.

H.J.PHS-iC.3

Physical tampering with Host in Space: at attacker with physical access to space Space physically alters device Host located there, introducing a means for the attacker to get remote access to admin privileges on Host.

H.L.CHS-iP.3.1

Console access to unprotected guest account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to log in to a guest account.

H.M.CHS.3.1

Console access to unprotected admin account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get root access via an unprotected admin account.

H.M.HumCHS-iP.3.2

Unauthorised console access to an admin account on host Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to gain root privileges via the console.

LS.L.RSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing radio subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device wirelessly to the subnet.

LS.L.RSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where radio subnet LogicalSubnet is accessible can connect their own device unless access is restricted by security measures. Note that access only to the local subnet serving Space.

LS.L.RSSH-P.3

LS.L.WSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing wired subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device to the subnet.

LS.L.WSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.

LS.L.WSSH-P.3

P.L.HuiPCHS.3.1

Console access to unprotected account running Process on device Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get access via an unprotected user account with the rights of process Process.

P.L.HuiPCHS-iP.3.2

Unauthorised console access to interactive process Process on device Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to interact via the console with process Process.

P.L.HuiPCHS-iP.3.3

Unattended console access to interactive process Process on device host Host in Space: an attacker with physical access to device Host in location Space is able to access process Process via the console while the legitimate user is away from the desk.

I.Auth.HRSGSoS.3

Spoofing radio network LogicalSubnet at location Space of access point Gateway: at attacker with access to the location Space of radio networking device Gateway can physically spoof network LogicalSubnet by introducing their own radio network to impersonate the real one.

I.Auth.HSRSoGS.3

Spoofing radio network LogicalSubnet at location Space of supplicant Host: at attacker with access to the location Space of Host can physically spoof network LogicalSubnet by introducing their own radio base station to impersonate the real one.

I.Auth.HSWSoGS.3

Spoofing wired network LogicalSubnet at location Space of supplicant Host: at attacker with access to the location Space of a host Host can physically insert their own device between the host and its wired connection to LogicalSubnet.

I.Auth.HWSGSoS.3

Spoofing wired network LogicalSubnet at location Space of router Gateway: at attacker with access to the location Space of a wired router Gateway can physically insert their own device between the router and its wired connection to device Host.

LS.C.WiFiSSoH.3

Passive snooping in WiFi subnet LogicalSubnet from Space: if an attacker has physical access to WiFi subnet LogicalSubnet from Space, they can passively snoop traffic unless the network is encrypted.

H.P.PHS-iC.3

Theft of device Host from Space: an attacker with access to the physical space Space is able to steal device Host.

H.V.CHS-iP.3

Local anonymous exploit on host Host in Space: an attacker with physical access to the console of device Host in Space is able to exploit a bug in Host.