Misbehaviour LossOfConfidentiality

URI: LossOfConfidentiality

Package: Application

< prev | next >

Description: Disclosure of data (which may be embedded in an IoT device) to unauthorised parties, or a state where prevention or detection of such a disclosure cannot be ensured.

This misbehaviour affects the trustworthiness attribute Confidentiality

Data

Represents a class of data items that can be stored on Hosts, or processed and exchanged by Processes. Note that this asset represents the presence of data in the system. Physical copies of the data are represented by inferred assets linked with Processes that serve or use them, hosts where they are stored.

DataContainer

A common parent class for any asset that contains data, including assets that represent stored or flowing data, and assets such as IoT Things that incorporate embedded data.

DataField

Represents a specific element within a structured data asset. Used to model the presence of parts in data that may be more sensitive or have extra protection compared to the remaining contents of a data asset.

LossOfConfidentiality
D.C.HuiPiDCHS.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human enters Data via the user interface of Process on host device Host.
LossOfConfidentiality
D.C.HuiRACHSPiD.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session in which Human enters Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.
LossOfConfidentiality
D.C.HuiPv-iDFCHS.3

Data Data sent from FlowsFrom to Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.
LossOfConfidentiality
D.C.HuiPv-iD-FCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.
LossOfConfidentiality
D.C.HuiRACv-iDFCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.
LossOfConfidentiality
DS.C.HPsACr-pDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and serve the locally stored copy of Data.
LossOfConfidentiality
DS.C.HPsACrpDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and process the locally stored copy of Data.
LossOfConfidentiality
DS.C.HPsACr-pDS-V.1.6

Use of compromised key at Process to access Data stored on Host: someone with the rights of Process on its host device Host can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
LossOfConfidentiality
DS.C.HsACDS-V.1.2

Use of admin privileges at Host to access stored data Data: anyone with admin rights at Host can read (unencrypted) copies of Data stored on the Host.
LossOfConfidentiality
DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.
LossOfConfidentiality
Co.C.CoPD.0

Data leakage at controller Controller: if the control input data for a controller leaks, it is modelled as a loss of confidentiality for the controller.
LossOfConfidentiality
Se.C.SePD.0

Data leakage at sensor Sensor: if the onboard data at a sensor leaks, it is modelled as a loss of confidentiality at the sensor.
LossOfConfidentiality
DF.C.ACDF-VCS-i.3.1

Compromised service Service reads the flow of data Data from FlowsFrom to FlowsTo sent from Client: if an attacker can compromise or impersonate service Service, they can read data in messages from Client.
LossOfConfidentiality
DF.C.ACDF-VFS-i.3.6

Encrypted flow of data Data from FlowsFrom leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can access its cryptographic key to decrypt data and accept a request for it from a false client acting as Client.
LossOfConfidentiality
DF.C.ACDFVFS-i.3.6

Encrypted flow of data Data from FlowsFrom leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can access its cryptographic key to decrypt data and accept a request for it from a false client acting as Client.
LossOfConfidentiality
DF.C.ACDF-VSC-i.3.2

Flow of data Data from FlowsFrom to FlowsTo leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can allow a false client to request data by acting as Client.
LossOfConfidentiality
DF.C.ACDF-VTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.
LossOfConfidentiality
DF.C.ACDFVTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.
LossOfConfidentiality
DF.C.AC-iDF-VCS.3.2

Imposter posing as service Service intercepts flow of Data from FlowsFrom and FlowsTo sent by Client: if an attacker can impersonate service Service, they can intercept content in the flow of data Data between FlowsFrom and FlowsTo via the service and its client Client.
LossOfConfidentiality
DF.C.AC-iDF-VCS.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Client and Service: if communications between Client and Service are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.
LossOfConfidentiality
DF.C.AC-iDF-VSC.3.2

Compromised or impersonated client Client reads data Data flowing from FlowsFrom to FlowsTo when sent from Service: if an attacker can compromise or impersonate Client, they can read Data sent by FlowsFrom to FlowsTo in messages from Service.
LossOfConfidentiality
DF.C.AC-iDF-VSC.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Service and Client: if communications between Service and Client are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.
LossOfConfidentiality
DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
LossOfConfidentiality
DF.C.AC-iDF-VTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
LossOfConfidentiality
DF.C.CCCSCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Service: if service Service does not send data Data to its client Client , it is still possible for the client to request the data flow using a confused deputy attack against Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).
LossOfConfidentiality
DF.C.CCCSPCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not receive data Data from its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.
LossOfConfidentiality
DS.C.CDBSC-DST.4

Malicious query from Client via database Service leaks data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to retrieve data Data. In this scenario, a selection query for Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
LossOfConfidentiality
DS.C.HPsACrDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to read the locally stored copy of Data.
LossOfConfidentiality
DF.C.AC-iDFVTC.2.6

Client Client on stolen host CHost reads the encrypted flow of Data from/via Service: if an attacker has possession of host CHost and can access client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
LossOfConfidentiality
DF.C.AC-iDF-VTC.2.6

Client Client on stolen host CHost reads the encrypted flow of Data from/via Service: if an attacker has possession of host CHost and can access client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.
LossOfConfidentiality
DS.C.HDS-V.2.1

Physical access to data Data on stolen host Host: an attacker in possession of device PhysicalHost can physically transfer its storage media to another device to access data stored there.
LossOfConfidentiality
DS.C.HDS-V.2.2

Use of admin rights on stolen device Host to access stored data Data: if an attacker gains access to stolen device Host, they can read (unencrypted) copies of Data stored on the Host.
LossOfConfidentiality
DS.C.HPsACr-pDS-V.2

Use of Process to access Data stored on stolen device Host: if an attacker can access Process on stolen device Host, they can exploit the rights of Process to read and serve the locally stored copy of Data.
LossOfConfidentiality
DS.C.HPsACrpDS-V.2

Use of Process to access Data on stolen device Host: if an attacker can access Process on stolen device Host, they can use the rights of Process to read a local stored copy of Data.
LossOfConfidentiality
DS.C.HPsACr-pDS-V.2.6

Use of compromised key at Process to access Data stored on stolen device Host: if an attacker can access Process on stolen device Host, they can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.
LossOfConfidentiality
DS.C.HDS-V.4

Attacker exploit at Host accesses stored data Data: the attacker is able to exploit a vulnerability in device Host gaining access to its stored copy of Data.
LossOfConfidentiality
DS.C.HPsACr-pDS-V.4

Attacker exploit at Process accesses Data: the attacker is able to exploit a vulnerability in process Process and gains access to the stored copy of Data on device Host which is served by the process.
LossOfConfidentiality
DS.C.HPsACrpDS-V.4

Attacker exploit at Process accesses its input Data: the attacker is able to exploit a vulnerability in process Process, gaining access to the stored copy of Data used by the process on its host device Host.

        (empty)