Package Network

URI: Network

Description: Model of hosts connected to networks, plus control processes.

R-AC

Finds a solo AuthClient.

R-AS

Finds a solo authentication/authorisation service.

R-C

Finds a Host that represents a virtual or physical cluster.

R-CaS

Finds a client accessing a service.

R-CcuS

Finds a client accessing a service and controlling access to the same service (which should never happen).

R-CH

Finds a solo Console Host.

R-CHS

Finds a Console Host located in a Space.

R-CS

Finds a client using a service.

R-CScP

Finds a client directly or indirectly accessing a service which is controlled by another process.

R-CuP

Finds a client accessing a service but not to get authorization decisions about 3rd parties.

R-CuScS

Finds a client using a service for application or authentication and also controlled by the service.

R-CuSHS

Finds a Host running both a Client and a Service used by the Client, in a Space.

R-DC

Finds a solo Data Centre.

R-DCH

Finds a Host resourced by a DataCentre.

R-DCLS

Finds a DataCentre connected to an Abstract Subnet.

R-DCpLS

Finds a DataCentre providing a LogicalSubnet, and a router located in the data centre.

R-DCPS

Finds a Process hosted directly on a Data Centre.

R-DCVHRS

Finds a Host that is physically in a DataCentre and connected to a WiFi LAN.

R-DCVHWS

Finds a Host that is physically in a DataCentre and connected to a Wired LAN.

R-DCWH

Finds a Data Centre with a router and wired network, in which is located another Fixed Host.

R-FcLSS

Finds a Logical Subnet to which is connected a Fixed Host (or a Virtual Host running on it) located in a Space.

R-FpLSS

Finds a Logical Subnet which is provided by a Fixed Host (or a Virtual Host running on it) located in a Space.

R-GH

Finds a General Host.

R-H

Finds a solo Host.

R-HAC

Finds a Host in a Space with the associated access context.

R-HACP

Finds a process running on a host in a space and the host location access context.

R-HCHLSS

Finds a Host location access context and the related host and space and one related subnet.

R-HcWHS

Finds a WiFiLAN hotspot and its local implementation in a Space, and a host connected to the hotspot in that space.

R-HHu2

Finds a Host with two interactive users.

R-HIUS

Finds a Host in a Space connected to the Internet.

R-HL3S

Finds a host connected to an L3 subnet, and an associated network access context.

R-HLnSP

Finds a Login Service and a Process used by it on the same Host.

R-HLS

Finds a Host connected to a LogicalSubnet.

R-Hm2Hu

Finds a host and two humans that manage the host.

R-HNP

Finds a Host connected to an Abstract Subnet controlled by a Process.

R-HP

Finds a Process and its Host.

R-HPAC

Finds a Process running on a Host in a Space and the associated process access context.

R-HPHLS

Finds a logical subnet to which is connected a host that directly is or indirectly has a physical host.

R-HprL3SAC

Finds a Layer 3 LogicalSubnet provided by a Host, along with an associated network access context.

R-HprLS

Finds a LogicalSubnet provided by a Host.

R-HprLSAC

Finds a LogicalSubnet provided by a Host and an associated network access context.

R-HRASuPcC

Finds a host running a remote access service that launches a process which is used by a client that it also controls, implying the client forwards credentials to the process.

R-HRASuPCcS

Finds a host running a remote access service that launches a process which is used by a client where both it and the client are controlled by the same authenticator, implying the client forwards credentials obtained from the authenticator to the process.

R-HRASuPcS

Finds a host running a remote access service that launches a process which uses a service by which it is also controlled, implying that the process uses forwarded credentials to access the service.

R-HRASuPScS

Finds a host running a remote access service that launches a process which uses a service, where the service and the process are controlled by the same authenticator, implying that the process accesses the service using a token shared with it by a client.

R-HuE

Finds a human interacting with an email client.

R-HuHE

Finds a human interacting with an email client running on a host.

R-HuHE2AC

Finds a human interacting directly with an email client running on a host in a space, plus the associated location access context.

R-Hui2H

Finds a physical Host with two interactive users.

R-HuiCH

Finds a Human interacting with a console host.

R-HuiCHLnS

Finds a human interacting with a console host and a login service running on a possibly remote host.

R-HuiDH

Finds a Human interacting with a Dumb Host.

R-HuiH

Finds a Human interacting with a Host.

R-HuiHAC

Finds a Human interacting with a host that runs an authentication client.

R-HuiHP

Finds a Human interacting with a Process running on a Host.

R-HuiHPSP

Finds a Human interacting with a Process running on an interactive Host located in a private space.

R-HuiHRAC

Finds a Human interacting with a host that runs a remote access client.

R-HuiHS

Finds a Human interacting with a Host located in a space.

R-HuiHSt

Finds a Human interacting with a Host and their employer.

R-HuiP

Finds a Human using an interactive Process.

R-HuiPCHS

Finds a Human interacting with a Process running on a Console Host located in a space.

R-HuiPDaS

Finds a Human that uses a personal device and has access to a space.

R-HuiPH

Finds a Human interacting with a Personal Host.

R-HuiPSt

Finds a Human using an interactive Process and their employer.

R-HuirP

Finds a Human interacting (possibly remotely) with a Process.

R-HuirRACP

Finds a Human interacting remotely with a Process via a Remote Access Clent which remotely uses the Process.

R-HumCH

Finds a Human managing a Fixed Console Host.

R-HumCHS

Finds a Human interactively managing a Host located in a space via its console.

R-HumH

Finds a Human managing a Host.

R-HumHcS

Finds a human managing a host that has a remote management service (which may be a Login service).

R-HumHP

Finds a Human managing a host running a process.

R-HumHRAS

Finds a human managing a host that has a root privileged remote access service.

R-HumHSt

Finds a Human managing a Host and their employer.

R-HumP

Finds a Human managing a Process.

R-HumPH

Finds a Human managing a process running on a host.

R-HumSH

Finds a Human managing a Shell Host.

R-HuoH

Finds a Human operating a Host.

R-HuPCH

Finds a Human interacting with a Process running on an Interactive Host.

R-HuRACP

Finds a human interacting with a remote access client on a local host that is remotely using a process.

R-HuSP

Finds a human user interacting with a smartphone.

R-HuwStmH

Finds a Human managing a Host and working for an Employer.

R-HuwStmP

Finds a Human managing a Process and working for an Employer.

R-IcP

Finds a Process controlling an Internet class subnet.

R-Internet

Finds an Internet class network.

R-IpH

Finds a Host providing an Internet class subnet.

R-LnScP

Finds a login service controlling access to a process.

R-LnSucP

Finds a remote access service using a process to which it forwards credentials.

R-LnSuP

Finds a login service using a process.

R-LS

Finds a solo Logical Subnet.

R-MHC

Finds a solo Mobile Console Host.

R-MHcIS

Finds a Mobile Console Host in a Public Space connected to the Internet.

R-MHHS

Finds a Host whose physical host is a Mobile Client that may be in a Space.

R-P

Finds a solo Process.

R-PC

Finds a physical cluster host.

R-PccP

Finds two processes, each of which controls the other.

R-PcH

Finds a Process that controls a Host.

R-PcLS

Finds a Process that controls a network.

R-PCPHLSS

Finds a Process location access context and the related process, host and space and one subnet to which the host is connected. Note that the role names are not the ones usually used because this pattern feeds into a CP where the INS should follow the sequence Host-Process-Subnet.

R-PcSHLnS

Finds a Process controlling a Shell Host that runs a Remote Access Service.

R-PcWH

Finds a WiFiLAN and its local implementation, plus a controlling process.

R-PH

Finds a solo physical host.

R-PH2

Finds a process with two hosts.

R-PHH

Finds a host that directly is or indirectly has a physical host.

R-PHHPS

Finds a process running on a host that can be accessed from a space.

R-PHHS

Finds a host that directly is or indirectly has a physical host in a space.

R-PHLSS

Finds a host that directly is or indirectly has a physical host in a space and is connected to a logical subnet accessible from that space.

R-PHS

Finds a Physical Host located in a Space.

R-PMHHS

Finds a Process running on a host whose physical host is a Mobile Console Host, which may be located in a Space.

R-PS

Finds a solo Physical Subnet.

R-RAC

Finds a remote access client.

R-RACuHRASP

Finds a host running a process and a remote access service that uses the process, and is used by a remote access client.

R-RACuP

Finds a Remote Access Client using a Process.

R-RACuRHRASP

Finds a host running a process and a remote access service that uses the process, where both are used remotely by a remote access client.

R-RAS

Finds a remote access service.

R-Rr

Finds a solo Router.

R-RSS

Finds a Radio Subnet accessible from a Space, and the (abstract) hotspot or cellular network it implements locally.

R-RSSH

Finds a Radio Subnet accessible from a Space, provided by a gateway host, implementing an (abstract) hotspot or cellular network, plus a context in which the gateway provides the subnet.

R-RTuHP

Finds a Host running a Process used remotely by a Remote Terminal client.

R-RTuP

Finds a remote terminal using a process plus the process host.

R-RTurP

Finds a remote terminal remotely using a process plus the process host.

R-RTuRTuS

Finds a remote terminal using remotely another remote terminal which is using remotely a third process.

R-SH

Finds a Shell Host.

R-SHAC

Finds a Shell Host in a Space and an associated access context.

R-SHACP

Finds a Process running on a Shell Host in a Space and an associated Host access context.

R-SHGP

Finds a simple host running a general process.

R-SHLnSACP

Finds a remote access service controlling a process running on a shell host in a space, and a location access context to the remote access service.

R-SHP

Finds a Process running on a shell Host.

R-SHPAC

Finds a Process running on a Shell Host in a Space and the associated process access context.

R-SHRLnSAC

Finds a remote access service controlling a shell host in a space, and a location access context to the process.

R-SHuPH

Finds a Human managing a Space in which a Fixed Host is located.

R-StDC

Finds a stakeholder operating a data centre.

R-StH

Finds a stakeholder operating a Host.

R-StHP

Finds a Stakeholder operating a Host that runs a Process.

R-StS

Finds a Private Space operated by a Stakeholder.

R-StSPH

Finds a Private Space operated by a Stakeholder where a Fixed Host is located.

R-Sv

Finds a solo Server.

R-TH

Finds a solo trivial host.

R-THGP

Finds a trivial host running a general process.

R-TP

Finds a solo trivial process.

R-WH

Finds a solo WiFiLAN which may be a hotspot.

R-WiFiSS

Finds a WiFi network accessible from a Space, and the subnet it implements locally.

R-WpHS

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN.

R-WpHSH

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN.

R-WS

Finds a solo WiFiLAN.

R-WSS

Finds a Wired Subnet accessible from a Space.

R-WSSH

Finds a Wired Subnet provided by a gateway Host accessible from a Space.

MP-AC

Finds a solo AuthClient.

MP-AS

Finds a solo authentication/authorisation service.

MP-C

Finds a Host that represents a virtual or physical cluster.

MP-CcuS

Finds a client accessing a service and controlling access to the same service (which should never happen).

MP-CH

Finds a solo Fixed Console Host.

MP-CHS

Finds a Console Host located in a Space, with associated access contexts and optionally an interactive user and system manager.

MP-CHS-iP

Finds a Console Host located in a Space, with associated access contexts and optionally an interactive user and system manager, where the device is not a personal device.

MP-CuSHS

Finds a Host that is not a Cluster running both a Client and a Service used by the Client, in a Space.

MP-DC

Finds a solo Data Centre.

MP-DC-C

Finds a Data Centre with no server cluster of its own.

MP-DCH

Finds a Physical Host resourced by a Data Centre.

MP-DCLS

Finds a DataCentre connected to an Abstract Subnet, and a Router located in the DataCentre.

MP-DCpLS

Finds a DataCentre providing a LogicalSubnet.

MP-DC-R

Finds a Data Centre without its own Router.

MP-DCVHRS-H

Finds a Host that is physically in a DataCentre and connected to a WiFi LAN that is not provided by any host.

MP-DCVHWS-H

Finds a Host that is physically in a DataCentre and connected to a Wired LAN that is not provided by any host.

MP-DCWH-LS

Finds a Data Centre with a router and wired network, in which is located another Fixed Host not connected to or providing any subnet.

MP-FcLSS

Finds a Logical Subnet to which is connected a Fixed Host (or a Virtual Host running on it) located in a Space.

MP-FpLSS

Finds a Logical Subnet which is provided by a Fixed Host (or a Virtual Host running on it) located in a Space.

MP-GH

Finds a General Host (i.e. a host that can run arbitrary processes).

MP-H

Finds a solo Host, with optionally its manager(s) and interactive user(s).

MP-HAC

Finds a Host in a Space with the associated access context, with optionally its manager, and all related access contexts.

MP-HACPmAC

Finds a process running on a host in a space and the host location access context, with all related process location and network access contexts.

MP-HACPmNC

Finds a process running on a host in a space and the host location access context, with all related process network access contexts.

MP-HCHLSS

Finds a Host location access context and the related host and space and one related subnet.

MP-Hc-pN-hP

Finds a Host connected to but not providing an Abstract Subnet, which controlled by a Process not running on the Host.

MP-HcWHS

Finds a WiFiLAN hotspot and its local implementation in a Space, and a host connected to the hotspot in that space.

MP-HHu2d

Finds a host with two distinct interactive users.

MP-H-iR-iMCHIUS

Finds a Host that is not a Router or a Mobile Console Host in a Public Space connected to the Internet.

MP-HL3S

Finds a host connected to an L3 subnet, and an associated network access context, plus optionally the host manager.

MP-HLnSP-hCLI

Finds a Login Service and a Process used by it on the same Host that does not have a CLI.

MP-HLS

Finds a Host connected to a LogicalSubnet.

MP-Hm2dHu

Finds a host and two distinct humans that manage the host.

MP-HmAC

Finds a solo Host plus all location access contexts, and optionally the host manager and interactive user.

MP-HmACPAC

Finds a process running on a host in a space and an associated process location access context, plus related host access contexts and optionally the host manager and process user.

MP-HmNCPAC

Finds a process running on a host in a space and an associated process location access context, plus related process network access contexts.

MP-HP

Finds a Process and its Host, and optionally the host manager and the interactive user of the process.

MP-HPAC

Finds a non-trivial Process running on a Host in a Space and the associated process access context, plus optionally the host manager, the interactive process user, and all related access contexts.

MP-HPHLS-S

Finds a logical subnet to which is connected a host that directly is or indirectly has a physical host, but the subnet is not accessible from any space where the host can be located. Note that there must be at least one host location, so this threat should not detect inferred routers implementing abstract subnets.

MP-HP-iT

Finds a non-trivial Process and its Host, and optionally the host manager and the interactive user of the process.

MP-HPmAC

Finds a Process and its Host with associated access contexts, and optionally the host manager and the interactive user of the process.

MP-HprL3SAC

Finds a Layer 3 LogicalSubnet provided by a Host, along with an associated network access context.

MP-HprLS

Finds a LogicalSubnet provided by a Host.

MP-HprLSAC

Finds a LogicalSubnet provided by a Host and an associated network access context.

MP-HPsAC

Finds a Process and its Host with any associated location access contexts, and optionally the host manager and the interactive user of the process.

MP-HRASuPcC

Finds a host running a remote access service that launches a process which is used by a client that it also controls, implying the client forwards credentials to the process.

MP-HRASuPCcS

MP-HRASuPcS

Finds a host running a remote access service that launches a process which uses a service by which it is also controlled, implying that the process uses forwarded credentials to access the service.

MP-HRASuPScS

MP-HsAC

Finds a solo Host plus any of its location access contexts, and optionally the host manager and interactive user.

MP-HsACP

Finds a Process and its Host, plus any location contexts allowing access to the host, and optionally the host manager and interactive process user.

MP-HuE

Finds a human interacting with an email client.

MP-HuHE

Finds a human interacting directly with an email client running on a host.

MP-HuHE2AC

Finds a human interacting directly with an email client running on a host in a space, plus the associated location access context, and related process access contexts corresponding to the subnet connections of the host.

MP-Hui2H

Finds a physical Host with two distinct interactive users.

MP-HuiCHLnS-AC

Finds a human interacting with a console host and a login service running on a remote host, where the user does not interact with a terminal client that uses the login service.

MP-HuiDH

Finds a Human interacting with a Dumb Host (which is not possible).

MP-HuiHAC

Finds a Human interacting with a host that runs an authentication client.

MP-HuiH-Hu

Finds a Human interacting with a Host that has no manager.

MP-HuiHoSt

Finds a Human interacting with a Host but not with any of its processes, and optionally their employer.

MP-HuiHP

Finds a Human interacting with a Process running on a Host.

MP-HuiHP-m

Finds a Human interacting with an unmanaged Process running on a Host.

MP-HuiHPSP

Finds a Human interacting with a Process running on an interactive Host located in a private space.

MP-HuiHRAC

Finds a Human interacting with a host that runs a remote access client.

MP-HuiHS

Finds a Human interacting with a Host located in a space.

MP-HuiHSt

Finds a Human interacting with a Host, and their employer.

MP-HuimH-e

Finds a human without access to email who is interacting with at least one console host.

MP-HuiPCH

Finds a Human interacting with a Process running on a fixed console host.

MP-HuiPCHS

Finds a Human interacting with a Process running on a fixed Host located in a space, plus associated process access contexts.

MP-HuiPCHS-iP

Finds a Human interacting with a Process running on a Host which is not their personal device, located in a space, plus associated process access contexts.

MP-HuiPDaS-S

Finds a Human that has access to a space and uses a Personal Device which has no specified location.

MP-HuiPH-Hu

Finds a Human interacting with a Personal Host that has no manager.

MP-HuiPH-iD

Finds a Human interacting with a Personal Host, where there is no self-referential link indicating that the device is shared with other users.

MP-HuiPoSt

Finds a Human using an interactive Process (but not a login shell), and an optional employer of the Human.

MP-HuiPSt

Finds a Human interacting directly with a Process, along with their employer and their contexts for accessing the Process.

MP-HuirP

Finds a Human remotely interacting with a Process.

MP-HuirRACP

Finds a Human interacting remotely with a Process via a Remote Access Clent which remotely uses the Process.

MP-HumCH

Finds a Human managing a Fixed Console Host.

MP-HumCHS-iP

Finds a Human managing a Host located in a space via the console, where the host is not a personal device.

MP-HumH

Finds a Human managing a Host.

MP-HumHoSt

Finds a Human managing a Host, and an optional employer of the Human.

MP-HumHP-im

Finds a Human managing a host running a process which has neither a manager nor an interactive user.

MP-HumHP-iT

Finds a Human managing a host running a non-trivial process, and optionally an interactive process user.

MP-HumHSt

Finds a Human managing a Host and their employer.

MP-HumH-StSt

Finds a Human who does not work for anyone else, managing a Host that has no operator.

MP-HummH-e

Finds a human without access to email who is managing at least one host, but not interacting with any host.

MP-HumPH-m

Finds an unmanaged host running a process that has a manager.

MP-HumP-StSt

Finds a Human managing a Process, where the Human is not an employee, and the Process has no operator.

MP-HuoH-m

Finds a Human operating an unmanaged Host.

MP-HuPCH

Finds a Human interacting with a Process that is not a Remote Access Service running on an Interactive Host.

MP-HuSP

Finds a human user interacting with a smartphone which is a personal device with no other users.

MP-HuwStmH-St

Finds a Human working for an Employer, who manages a Host that has no other operator.

MP-HuwStmP-St

Finds a Human working for an Employer, and managing a Process that has no operator.

MP-IcP

Finds a Process controlling an Internet class subnet.

MP-InternetMP

Finds an Internet class network.

MP-IpH

Finds a Host providing an Internet class subnet.

MP-LnSuP-H

Finds a login service using a process where the two do not have the same Host.

MP-LS

Finds a solo Logical Subnet.

MP-LS-iH

Finds a solo Logical Subnet.

MP-LS-prH

Finds a Logical Subnet not provided by any host.

MP-MHC

Finds a solo Mobile Console Host.

MP-MHcIS

Finds a Mobile Console Host in a Public Space connected to the Internet.

MP-MHHS

Finds a Host whose physical host is a Mobile Console Host in a Space, where it can access at least one Logical Subnet (this pattern contains only multiple network access contexts), plus optionally an interactive user and system manager.

MP-PccP

Finds two processes, each of which controls the other. This is the simplest case of a cyclic authentication dependency, which is a logical impossibility.

MP-PC-LnS

Finds a physical Cluster that is not controlled by any process.

MP-PCPHLSS

Finds a Process location access context and the related process, host and space and one related subnet.

MP-PcWH

Finds a WiFiLAN and its local implementation, plus a controlling process.

MP-PH

Finds a solo physical host, and optionally its manager.

MP-PH2

Finds a process with two distinct hosts.

MP-PHdH

Finds a host that has a physical host (but is not the physical host).

MP-PHHPS

Finds a process running on a host that can be accessed from a space.

MP-PHHS

Finds a host that directly is or indirectly has a physical host in a space, and all connected logical subnets accessible from that space.

MP-PHLSS

Finds a host that has or directly is a physical host in a space and is connected to a logical subnet accessible from that space (other than an abstract hotspot).

MP-PHS

Finds a Physical Host located in a Space, and optionally the host manager and interactive user.

MP-PH-S

Finds a physical host that is not located in any space.

MP-PHS-iC

Finds a Physical Host that is not a Cluster located in a Space, and optionally the host manager and interactive user.

MP-PHS-iP

Finds a Physical Host that is not a Personal Device located in a Space, and optionally the host manager and interactive user.

MP-PMHHS

Finds a non-trivial Process running on a host whose physical host is a Mobile Console Host that may be located in a Space, plus associated process network access contexts from that Space, and optionally an interactive Process user.

MP-PnH

Finds a Process with no Host.

MP-PS-iH

Finds a solo Physical Subnet that is not a hotspot.

MP-RAC

Finds a remote access client.

MP-RACuHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used by a remote access client.

MP-RACuP-iP

Finds a Remote Access Client using a Process that is not a reverse proxy.

MP-RACuRHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, where both are used remotely by a remote access client.

MP-RAS

Finds a remote access service.

MP-Rr

Finds a solo Router.

MP-Rr-LnS

Finds a Router that is not controlled by any process.

MP-RSSH

Finds a Radio Subnet provided by a Gateway Host accessible from a Space, and optionally the service controlling access to it and the gateway manager.

MP-RSS-HP

Finds a Radio Subnet accessible from a Space, and the subnet it implements locally, where there is no gateway specified as the subnet provider and no controlling Process.

MP-RSSH-P

Finds a Radio Subnet with no controlling process, provided by a Gateway host and accessible from a Space, plus optionally the manager of the Gateway.

MP-RTuHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used remotely by a Remote Terminal client, not mediated by a collocated remote access service, nor by a reverse proxy.

MP-RTuP-hCLI

Finds a Remote Terminal that uses a Process that has no CLI and is not a remote access service nor a proxy, plus the Process host.

MP-RTurP-hCLI

Finds a Remote Terminal that remotely uses a Process that has no CLI and is not a remote access service nor a proxy, plus the Process host.

MP-RTuRTuS-uR

Finds a remote terminal using remotely another remote terminal which is using remotely a third process that is not yet remotely used by the first.

MP-SH

Finds a Shell Host (i.e. a host that allows user commands with the rights of the administrator or some user/process).

MP-SHAC

Finds a Shell Host plus optionally its manager, and an associated access context.

MP-SHACPmAC

Finds a process running on a shell host in a space and the host location access context, with all related process location and network access contexts where the host is normally in that location or connected to that network.

MP-SHGP

Finds a simple host running a general process.

MP-SHLnSACPmAC

Finds a remote access service controlling a process running on a shell host in a space, and a location access context to the remote access service, related process access contexts and optionally the process manager.

MP-SHmACPAC

Finds a process running on a shell host in a space, and a location access context to the process, related host access contexts and optionally the host manager.

MP-SHmACRLnSAC

Finds a remote access service controlling a shell host in a space, and a location access context to the process, related host access contexts and optionally the host manager.

MP-SH-mHu

Finds a Shell Host that has no manager.

MP-SHP

Finds a Process running on a shell Host, and optionally the interactive process user and host manager.

MP-SHP-iT

Finds a non-trivial Process running on a shell Host, and optionally the interactive process user and host manager.

MP-SHuPH-Hu

Finds a Human managing a Space in which an unmanaged Fixed Host is located.

MP-StDC

Finds a stakeholder operating a data centre.

MP-StH

Finds a stakeholder operating a Host.

MP-StHP

Finds a Stakeholder operating a Host that runs a Process.

MP-StSPH-St

Finds a Private Space operated by a Stakeholder where a Fixed Host with no operator is located.

MP-StS-St

Finds a Private Space operated by a Stakeholder where access is not controlled by any stakeholder.

MP-Sv-LnS

Finds a Server that is not controlled by any process.

MP-TH

Finds a solo trivial host, and optionally the host manager, an interactive user, and any related access contexts.

MP-THGP

Finds a trivial host running a general process.

MP-TP

Finds a solo trivial process.

MP-WHmWS

Finds a WiFi hotspot with at least one local implementation.

MP-WiFiSSoH

Finds a WiFi subnet accessible from a Space, the network it implements, and optionally the host providing the subnet and service controlling access to it.

MP-WmPH

Finds a solo World asset (i.e. the inferred global public space), in which at least one Host is assumed to be (due to having no other defined location).

MP-WpHS-aF

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN which is not accessible from any space, and providing no other WiFiLAN accessible in its space.

MP-WpHSH-aF

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN which is a hotspot, and no other WiFiLAN accessible in its space.

MP-WS-H

Finds a solo WiFiLAN that is not an abstract hotspot.

MP-WSSH

Finds a Wired Subnet provided by a Gateway host accessible from a Space, and optionally the process controlling access and the manager of the gateway.

MP-WSS-HP

Finds a Wired Subnet accessible from a Space, where there is no gateway specified as the subnet provider, and no controlling Process.

MP-WSSH-P

Finds a Wired Subnet with no controlling process, provided by a Gateway host accessible from a Space, and optionally the manager of the Gateway.

(empty)

DC.A.DC.0

Effect of overload at DataCentre: if data centre DataCentre is overloaded, then it may become unavailable. Formulated as a primary threat so the level of confidence in the Data Centre can be a user-specified trustworthiness level.

DC.O.DCH.0

Effect of overload at Host on DataCentre: if physical host Host at DataCentre is overloaded, then DataCentre as a whole may become subject to high total load.

DC.RTW.StDC.1

Operator Operator compromises resource management at DataCentre: since Operator cis the operator of the data centre DataCentre, if they have adverse motives, they can misallocate resources within the data centre.

H.A.DCH.0

Loss of availability at DataCentre affects Host: if data centre DataCentre becomes unavailable, so will the host Host provisioned at DataCentre.

H.A.H.0

Loss of availability at overloaded host Host: if Host is overloaded, then it will be unable to fulfil its function and become effectively unavailable.

H.A.H.1.1

Use of privilege to control Host availability: anyone who controls resource allocation for Host can control the availability of Host instances.

H.A.H.5

Software bug crashes Host: a software bug in the operating system of device Host causes it to crash, compromising availability.

H.A.H.6.1

Loss of availability through disabled device Host: device Host is vulnerable, and the security control strategy was to disable Host, causing a loss of availability.

H.A.HsAC.1.2

Use of privilege to control Host availability: an attacker who has gained admin rights for a device Host can crash or deny access to it. For mobile hosts, we assume the host can be permanently locked down, so access in any context is sufficient, causing loss of availablity unless independent instances of class Host are available.

H.A.HumH.6.2

Loss of availability through disabling vulnerable device Host: if device Host is vulnerable to attack, and the security control strategy is for its manager HostManager to disable Host to prevent the attack, this will cause a loss of availability.

H.A.HumH.6.4

Loss of availability through disabling infected device Host: if device Host is vulnerable to malware infection, and the security control strategy is for its manager HostManager to disable Host if it becomes infected, this will cause a loss of availability.

H.A.PHS.3

Destruction of Host in Space: an attacker with access to Space can physically remove or destroy device Host, removing it from the system and making it unavailable.

H.E.HHu2d.9

Inappropriate control at device Host: the model specifies that this is a personal device protected by its user, but it is being used by multiple users. Deselect the Personal Device control, or remove relationships with all but one user.

H.E.H-iR-iMCHIUS.9

Host Host should not be connected directly to the Internet: device Host in Space is connected to an Internet-class subnet LogicalSubnet, but the Internet connection from Space should be mediated by a Router or (as an abstraction) a mobile user device, and Host is neither of these. Either insert some network infrastructure (a router or a cellular network) in Space to handle the connection, or remove Space and treat Host as not having any specific location.

H.E.Hm2dHu.9

Host Host has two managers: device Host has two distinct managers (Human1 and Human2). Normally management of a device should be assigned to one type of user, so this may be a modelling error. If not, it may represent a weakness in organisational security.

H.E.HPHLS-S.9

Host Host cannot be connected to subnet LogicalSubnet: the model says host Host is connected to subnet LogicalSubnet, but Host is not located in any physical space from which LogicalSubnet is accessible. Note that this error will probably cause other errors in communication with this host or processes hosted there.

H.E.HuiDH.9

User Human cannot interact directly with dumb host Host: host Host is of a type that does not have a user interface, yet user Human is interactively using the host or a process running on it, which is not possible. Either change the type of Host, move the interactive user or process, or convert the process into a service accessed via an interactive client on a different host.

H.E.IpH.9

Public network LogicalSubnet cannot be provided by Host: LogicalSubnet is a public network, providing an abstract representation of multiple linked subnets over a wide area. This cannot be provided by a host within the system. To fix this , change the relationship to a simple connection between Host and LogicalSubnet, or make LogicalSubnet a local, concrete network class.

H.E.SH-mHu.9

Host Host has no manager: in principle, every non-trivial host should have a manager, defined explicitly in the system model or implied by other factors such as its physical location or whether it is a personal device. If you mean this host to have no manager, e.g. because it is not dedicated to the modelled system and its management handled by some external process or agency, select the control strategy to negate this error threat. If not, please add a manager or change the class or relationships of Host so one can be inferred.

H.E.WmPH.9

Physical hosts exist that have no specified or inferrable location: any host with no location is inferred to be in the inferred global public space Space, so physical attacks are not overlooked. If the location of some hosts was deliberately omitted, select controls to indicate whether this is because those hosts are indeed not in a secure location, or because physical attacks on those hosts are out of scope in this system model. If the host locations was an oversight, please add space assets representing their location (if not already included) and add relationships to specify in which space each host is located.

H.E-D.H.8

Vulnerabilities discovered in device Host: one or more software vulnerabilities in device Host become known to attackers. This is a pre-requisite for exploitation of more specific types of vulnerabilities.

H.IS.PH.8

Host Host in service: device Host is not disabled, so is potentially subject to threats.

H.IS.PHS-iP.1

Switching on device Host in Space: an attacker with access to Space can physically access disabled device Host and switch it back on.

H.J.PHS-iC.3

Physical tampering with Host in Space: at attacker with physical access to space Space physically alters device Host located there, introducing a means for the attacker to get remote access to admin privileges on Host.

H.L.CHS-iP.3.1

Console access to unprotected guest account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to log in to a guest account.

H.L.HmAC.0

Access to Host in all contexts by unauthorized agents: if untrustworthy actors gain access to a host, the best case trustworthiness of its users in any context is degraded.

H.L.HmAC.1

Access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host, it must be assumed they can use Host in any context.

H.L.HsAC.0

Access to Host in any context by an unauthorized agent: if an untrustworthy actor gains access to a host, the worst case trustworthiness of its users in any context is degraded.

H.L.HuiHoSt.1

Insider attack by Human abusing access to Host: if the user Human of device Host is untrustworthy, they can abuse their privileges on that device.

H.L.HuiHSt.1

Insider attack by employee of Employer abusing access to Host: user Human of device Host may be persuaded by an untrustworthy employer Employer to abuse their privileges on that device.

H.L.SHAC.1

Use of admin privilege to control access to Host when in Space: someone with admin rights at device Host when in location Space can control user level access to the device in that context.

H.L.SHmACPAC.1

Use of privileges at Process to access Host in Space: anyone with local rights (i.e. at command shell level) for process Process when the host is in location Space also has user level access to its host Host in the same context.

H.M.CHS.3.1

Console access to unprotected admin account on host Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get root access via an unprotected admin account.

H.M.HmAC.0

Root access to Host in all contexts by unauthorized agents: if untrustworthy actors gain admin rights on a host, the best case trustworthiness of the host in any context is degraded.

H.M.HmAC.1.1

Root access to Host by its provider: anyone who controls resource allocation for devices of class Host can provision an instance and for grant admin privileges to themselves.

H.M.HmAC.1.2

Root access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has admin rights on Host, it must be assumed they could exploit those rights in any context.

H.M.HsAC.0

Root access to Host in any context by an unauthorized agent: if an untrustworthy actor gains admin rights on a host, the worst case trustworthiness of the host in any context is degraded.

H.M.HumCHS-iP.3.2

Unauthorised console access to an admin account on host Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to gain root privileges via the console.

H.M.HumHoSt.1

Insider attack by HostManager abusing admin rights on Host: if the manager HostManager of device Host is untrustworthy, they can use their privileges to enable attacks involving Host.

H.M.HumHSt.1

Insider attack by employee HostManager of Employer abusing admin rights on Host: the manager HostManager of device Host may be persuaded by an untrustworthy employer Employer to abuse their rights and enable attacks involving Host.

H.M.SHmACRLnSAC.1

Use of login via RemoteAccessService to control Host in Space: anyone with local rights (i.e. at command shell level) for root remote access service RemoteAccessService controlling Host when it is in location Space also has admin rights on Host in the same context.

H.O.HP-iT.0

Effect of overload at process Process on Host: if the process Process is overloaded, it may cause an overload on its host Host.

H.RTW.DCH.1

Use of privilege at DataCentre to control resourcing of Host: anyone who controls resource allocation at DataCentre can control the provision of instances of Host, resourced by DataCentre.

H.RTW.StH.1

Operator Operator compromises resource management at Host: Operator is the operator of (the class of devices) Host, so if they have adverse motives, they can misallocate instances or refuse to allocate instances.

H.U.H.5

Software bug at Host: a software bug in the operating system of device Host causes it to become unreliable.

H.W.HuHE.3

Malware infection at Host due to execution of viral attachment in email client MUA on Host: the user Human runs a malicious file sent as an email attachment via their email client MUA, infecting their client device Host.

Hu.E.HuimH-e.9

User Human has no access to email: users with the role Human do not have access to email via either a local client or via webmail. Since email is a source of risk, through which attackers could attack devices connected to the system, this should be added to the model. If users in role Human really do not use email on any device (i.e. that is a policy and not an oversight), then select the control strategy to indicate this.

Hu.E.HummH-e.9

LS.A.HprLS.0

Loss of availability at Gateway affects LogicalSubnet: if device Gateway becomes unavailable, so will the subnet LogicalSubnet routed by Gateway.

LS.A.HprLS.1.1

No provisioning for LogicalSubnet: whoeever controls resource allocation for devices of class Gateway can prevent provisioning of instances of subnet LogicalSubnet provided by Gateway.

LS.A.HprLS.6.1

Disabled subnet LogicalSubnet is not available: if provisioning by host Gateway of subnet LogicalSubnet has been disabled, then LogicalSubnet will be unavailable.

LS.A.HprLSAC.1.2

Provisioning of LogicalSubnet prevented at Gateway: someone with admin rights for device Gateway can prevent access to subnet LogicalSubnet provided by Gateway, unless other independent instances are available.

LS.A.LS.0

Effect of overload at logical subnet LogicalSubnet: if the subnet LogicalSubnet is overloaded it may become unavailable.

LS.IS.HprLS.8

Subnet LogicalSubnet in service: if device Gateway is in service, it will provide subnet LogicalSubnet, unless network provision is explicitly disabled.

LS.IS.HprLSAC.1

Provision of subnet LogicalSubnet by Gateway not disabled: if an attacker has admin rights on host Gateway, they can override a policy to disable provision by Gateway of network LogicalSubnet.

LS.IS.LS-prH.8

Subnet LogicalSubnet in service: subnet LogicalSubnet is not disabled, so is potentially subject to threats and can be exploited by an attacker.

LS.IS.WHmWS.8

Wireless hotspot Hotspot is in service: hotspot Hotspot is up and running in at least one of the spaces where the providing host may be present.

LS.L.HL3S.1

Access to Host allows local communication on subnet LogicalSubnet: someone with access to Host can send messages on LogicalSubnet to which Host is connected.

LS.L.RSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing radio subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device wirelessly to the subnet.

LS.L.RSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where radio subnet LogicalSubnet is accessible can connect their own device unless access is restricted by security measures. Note that access only to the local subnet serving Space.

LS.L.RSSH-P.3

LS.L.WSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing wired subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device to the subnet.

LS.L.WSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.

LS.L.WSSH-P.3

LS.M.HprL3SAC.1

Use of admin privilege at Gateway to control LogicalSubnet: someone with admin rights at device Gateway can control the subnet LogicalSubnet provided by device Gateway.

P.A.HP.0

Loss of availability at Host affects Process: if device Host becomes unavailable, so will the process Process hosted there.

P.A.HP.1.1

Use of privileges at Host to control provisioning of Process: anyone who controls resource allocation for Host instances can do the same for instances of Process hosted by Host instances.

P.A.HP.6.1

Loss of availability in disabled process Process: if process Process has been disabled to prevent it being attacked, this will mean Process is no longer available.

P.A.HP-iT.1.3

Use of privileges at Process to control availability: anyone with local user rights (i.e. local control) of a process Process can shut it down. However, this does not prevent access where there are other instances of Process running on independent instances of Host.

P.A.HP-iT.5

Software bug crashes Process: a software bug in process Process causes it to crash, compromising availability.

P.A.HP-iT.6

Effect of overload at low priority process Process: the priority of process Process may be reduced to prevent it from overloading its host Host, but in that case Process may become unavailable even if Host is not.

P.A.HsACP.1.2

Use of rights at Host to control availability of Process : anyone with admin rights on device Host can shut down process Process. For mobile hosts, we assume the process can be permanently disabled, so access in any context is sufficient, causing Process to become unavailable in any context unless there are instances running on independent instances of class Host.

P.A.HuiHP.6

User Human cannot access device Host to operate Process: if access to device Host is restricted, and user Human lacks the means to gain access, they will be unable to log in and hence unable to interact with process Process.

P.A.HuiHPSP.6

User Human cannot access private space Space to operate Process: if access to space Space is restricted, and user Human lacks the means to gain access, they will be unable to log in to device Host and hence unable to interact with process Process.

P.A.HuirP.0

Unavailable Human affects Process: if user Human is unable to make decisions in their system role and interact with process Process, then it also will become unavailable.

P.A.HuirRACP.0

Unavailable remote access client RemoteAccessClient affects Process: because user Human accesses process Process via RemoteAccessClient, if RemoteAccessClient becomes unavailable then Human will be unable to interact with Process, rendering it non-operational.

P.A.HumHP-iT.6.2

Loss of availability through disabling vulnerable process Process: if process Process may be vulnerable to attack, and the contingency plan is that its host manager HostManager will disable Process to prevent adverse consequences, this may lead to a loss of availability.

P.A.HumHP-iT.6.4

Loss of availability through disabling infected process Process: if process Process may be infected by malware, and the contingency plan is that its host manager HostManager will disable Process to prevent adverse consequences, this may lead to a loss of availability.

P.E.CcuS.9

Client Client should not control access to its own service Service: the domain model does not support situations where a client makes authN/authZ decisions for itself. This would create ambiguous dependencies that cannot be resolved in the current models of client credential sharing, forwarding and exchange. Delete the 'controls' relationship from Client to Service, and have some other process control access (or leave the service to handle authentication and authorization decisions for itself).

P.E.HLnSP-hCLI.9

Login service RemoteAccessService cannot be used to access process Process: since Process may be a graphical process with no command line interface, it cannot be launched on its host Host via the terminal login service RemoteAccessService. If Process is meant to be remotely accessible to an interactive user, then either Process must be a more restricted process subclass, or RemoteAccessService must be a remote Desktop Service.

P.E.IcP.9

Public network LogicalSubnet cannot be controlled by Process: since LogicalSubnet is a public network, it is an abstract representation of multiple linked subnets that cannot be controlled by a specific process. To fix this error, remove the controls relationship between Process and LogicalSubnet.

P.E.LnSuP-H.9

Remote access service LoginService cannot use remote service Process: a remote access service provides access to the shell on its host. It allows its user to run (use) processes running on the same host, but it cannot send requests to services on other hosts, so a direct relationship to Process is an error, causing inconsistency with the domain model. To make such a request, the user should launch a client process which sends the request. This can be modelled by adding such a client running on the same host as LoginService, with uses relationships from LoginService and to Process.

P.E.PccP.9

Processes Client and Service cannot authenticate for each other: this forms a cyclic authentication dependency, which is a logical impossibility in a functioning system. This threat detects the presence of the simplest case (with two interdependent processes), but loops composed of more processes should also be avoided. This threat will appear twice per pair of processes as each processes will be matched to both roles in the threat.

P.E.PH2.9

Process Process has two hosts: hosts Host and OtherHost both have relationships saying that they host process Process. A process can only run on one host. Please break one of the relationships, and if necessary create a distinct process to run on that host.

P.E.PnH.9

Process Process has no host: every process should be running on a host. If the host for this process is missing from the model, add it. Then create a hosts relationship between the host and Process.

P.E.SHGP.9

Hosting error for process GeneralProcess: Device SimpleHost is a specialised host class that cannot host a general (complex) process like GeneralProcess. Either remove GeneralProcess, or move the hosts relationship to a more general purpose host.

P.E.THGP.9

Hosting error for process GeneralProcess: Device TrivialHost is a specialised host class that cannot host a general (complex) process like GeneralProcess. Either remove GeneralProcess, or move the hosts relationship to a more general purpose host.

P.E-D.HP.8

Vulnerabilities discovered in process Process: one or more software vulnerabilities in process Process become known to attackers. This is a pre-requisite for exploitation of more specific types of vulnerabilities.

P.IS.HP.8

Process Process in service: if host Host is in service, then Process running on Host will also be in service and subject to attack, unless explicitly disabled.

P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.

P.J.SHP-iT.7

Malware infection installs back door in process Process: if Process is infected by malware, it may install a back door in Process, which could be accessed remotely at a later time.

P.L.HPmAC.0

Access to the rights of Process by unauthorized agents in all contexts : if untrustworthy actors gain access to Host with the rights of Process, the best case trustworthiness of its users in any context is degraded.

P.L.HPmAC.1

Access to Process by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host with the rights of Process, then they could exploit those rights in any context.

P.L.HPsAC.0

Access to the rights of Process by unauthorized agents in any context: if an untrustworthy actor gains access to Host with the rights of Process in any context, the worst case trustworthiness of its users in any context is degraded.

P.L.HuHE2AC.3

Execution of malicious email attachment by MUA on Host in Space: the user Human runs a malicious file sent as an email attachment while the host device is located in Space, allowing the attacker to exploit the privileges using connections accessible to their email client MUA via Host from Space.

P.L.HuiPCHS.3.1

Console access to unprotected account running Process on device Host in Space: an attacker with access to the physical space Space where the device is located uses console access to get access via an unprotected user account with the rights of process Process.

P.L.HuiPCHS-iP.3.2

Unauthorised console access to interactive process Process on device Host in Space: an attacker with physical access to device Host in location Space exploits lax password security by user Human to interact via the console with process Process.

P.L.HuiPCHS-iP.3.3

Unattended console access to interactive process Process on device host Host in Space: an attacker with physical access to device Host in location Space is able to access process Process via the console while the legitimate user is away from the desk.

P.L.HuiPoSt.1

Insider attack by Human abusing their control of Process: if the legitimate user Human of process Process is malicious, they can abuse the privileges assigned to Process.

P.L.HuiPSt.1

Insider attack by employee of Employer abusing their control of Process: the legitimate user Human of process Process may be persuaded by an untrustworthy employer Employer to abuse the privileges assigned to Process.

P.L.SHACPmAC.1

Use of admin privilege at Host via Space to control Process: someone with admin rights at device Host in location Space can control process Process hosted by that device in that context.

P.L.SHLnSACPmAC.1

Use of login via RemoteAccessService to control Process on Host in Space: anyone with local rights (i.e. at command shell level) for remote access service RemoteAccessService controlling the collocated process Process on Host when it is in location Space also has control of Process in that context.

P.O.HP-iT.5

Software bug overloads Process: a software bug in process Process causes it to become overlaoded.

P.U.HP.0

Unreliable host Host affects Process: if there is a loss of reliability at device Host, it causes a loss of reliability in process Process running on that device.

P.U.HP-iT.5

Software bug causes Process to become unreliable: a software bug in process Process causes it to become unreliable.

P.W.HP-iT.7

Process Process infected via its host: device Host having been infected with malware, the software installed on the host for running process Process may also become infected.

W.E.WmPH.9

Inconsistent resolution for omitted physical host locations: any host with no location is inferred to be in the inferred global public space Space, so physical attacks are not overlooked. If the location of some hosts was deliberately omitted, controls can be used to indicate whether this is because those hosts are indeed not in a secure location, or because physical attacks on those hosts are out of scope in this system model. However, both options cannot be specified as this would mean such attacks should be both included and excluded from the analysis.

InService	Engagement by an asset in the system, which is usually desirable, but means the asset is open to attack, abuse or misuse (and hence it is modelled as a potential threat consequence).
LossOfCapacity	Reduction in the capacity of a Data Centre to handle demands placed on it by automatically provisioned for hosts and processes.
LossOfControl	Untrusted, potentially malicious agents gained admin rights in some system context.
LossOfDefaultTW	Modelling artefact, corresponding to the trustworthiness attribute DefaultTW, which is already set by default to the lowest trustworthiness level.
LossOfExtrinsicTW	Deterioration in the quality and/or integrity of software engineering used to implement the asset, such that it will contain more software vulnerabilities likely to be discovered by an attacker.
LossOfIntrinsicTW	Deterioration in the quality and/or integrity of software engineering used to implement the asset, such that it will contain more functional software bugs that cause errors or crashes without external provocation.
LossOfNetworkControl	Untrusted, potentially malicious agents can contorl routing within the abstract or logical subnet.
LossOfNetworkUserTW	Untrusted, potentially malicious agents have access to the abstract or logical network subnet, i.e. they can access a connected host that may or may not be part of the modelled system.
LossOfResourceTW	Untrusted, potentially malicious agents can control the provisining of or allocation of resources to the asset.
LossOfUserTW	Untrusted, potentially malicious agents gained user rights in some system context.
MalwareInfection	Insertion into the asset of malicious, self-propagating software.
Overloaded	The asset is being used or requested more than allowed or expected.
TotalLoad	The total load on a Data Centre.
TrojanInsertion	Insertion of a back door into a host operating system or other software stored and running on a host.
VulnerabilityDiscovered	Discovery by potential attackers of one or more vulnerabilities in software associated with the affected host or process.

CSG-AccountLockingAtHost	The number of login attempts at device *Host* is limited, and user accounts locked when there are too many unsuccessful login attempts, or too many login attempts within a short period.
CSG-AccountLockingAtService	The number of login attempts at service *Service* is limited, and user accounts locked when there are too many unsuccessful login attempts, or too many login attempts within a short period.
CSG-AntiMalwareAtHost	Anti-malware software is installed on device *Host* and kept up to date by regular software patches, and so can detect and prevent the execution of malicious code.
CSG-AntiMalwareAtServiceHost	Anti-malware software is installed on device *SHost* and kept up to date by regular software patches, and so can detect and prevent the execution of malicious code.
CSG-AutomaticScreenLock	Host device *Host* is configured with an automated screen lock activated after a suitably short period of inactivity, requiring user *Human* to re-authenticate before resuming a session.
CSG-BiometricAccessControlAtHost	Access to device *Host* is controlled, by authenticating authorised users using biometrics.
CSG-BiometricIDCheckedAtHost	Users in the role *Human* have a biometric ID such as a fingerprint registered with the system, enabling them to pass a biometric ID check to access host *Host*.
CSG-BugFixingAtHost	Use a systematic procedure for regular updating of software used (including hosted processes) on device *Host, and have a contingency plan included in the system operating policies and practices for HostManager* to manually apply updates immediately should the need for them become urgent.
CSG-BugFixingAtHost-Implementation	Represents a situation in which software patches have been applied manually by *HostManager* to address functional bugs in device *Host. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Note that this should only be considered if a suitable software patch is available. To implement this at runtime, signal the responsible user HostManager. Then deselect the SoftwarePatched control and restore the asserted Intrinsic TWL of Host* once the update has been confirmed.
CSG-ChipAndPinAccessControlAtHost	Access to device *Host* is controlled, by authenticating authorised users using a 2-factor system involving possession of a physical key or dongle, such as a chip and PIN card.
CSG-ChipAndPinCardAccessToHost	Users in the role *Human* are issued with a 2-factor authentication key they can use to verify their identity and access host *Host*.
CSG-ClientContinuousAuthentication	Access to service *Service* is controlled by authenticating user *Human* based on their registered usage characteristics captured by the device *CHost*.
CSG-ClientContinuousAuthentication-Trigger	Access to service *Service* is controlled by authenticating user *Human* based on their registered usage characteristics captured by the device *CHost*.
CSG-ClientOneTimeKeyAccess	Access to a service *Service* requires a one time key, generated using a one time key device which itself requires a password entered by the user *Human, who then types the one time key into their client application Client*.
CSG-ClientOneTimeKeyAuthentication	Access to service *Service* is controlled, by authenticating authorised users using a one time key created using a client-side authentication device provided to them.
CSG-ClientOutOfBandKeyAccess	Access to a service *Service* requires the user *Human* to supply a password, and then enter a key which is sent to them via a separate channel into their client application *Client*.
CSG-ClientOutOfBandKeyAuthentication	Access to service *Service* is controlled, by authenticating authorised users using a password and a separate key sent to them via a separate (out of band) means.
CSG-ClientPasswordAccess	Access to a service *Service* requires a password, which is stored by the client process *Client* on its host *CHost*.
CSG-ClientPasswordAuthentication	The service *Service* controls access by requiring users to authenticate with a password.
CSG-ClientServiceTLS	Transport layer security is implemented by both *Client* and *Service* for communication between them. This prevents passive snooping in the network, including gateway devices, but it does not prevent service impersonation attacks. That can be prevented by also using service authentication via a trusted key (e.g. X.509 or equivalent).
CSG-ClientStoredPasswordAccess	Access to a service *Service* requires a password, which was supplied originally by the user *Human* and stored by the client *Client* in a secure password store.
CSG-ClientStoredPasswordAccess-Optional	Access to a service *Service* requires a password, which was supplied originally by the user *Human* and stored by the client *Client* in a secure password store.
CSG-ClientStrongPasswordAuthentication	The quality of passwords to authenticate users of service *Service* is checked whenever the password is set or changed, e.g. using standards like NIST-800-63.
CSG-ClientUserPasswordAccess	Users in the role *Human* choose a password which is registered with the system allowing access to *Service*.
CSG-ClientUserPasswordAccess-Optional	Users in the role *Human* choose a password which is registered with the system allowing access to *Service*.
CSG-ClientUserStrongPasswordAccess	Access to service *Service* is controlled, by authenticating authorised users using a strong password, which is supplied each time by the user *Human*. This is a trigger condition for the potential risk that the user may forget the strong password.
CSG-ClientX509Authentication	Access to service *Service* is controlled, by authenticating authorised users during the TLS connection against a known public key registered via a trustworthy means such as X509.
CSG-ContinuouslyObservedGateway	Physical access to host *Gateway* is controlled by being situated where it can be under constant surveillance in a location that is continuously occupied at times when attacks may occur.
CSG-ContinuouslyObservedHost	Physical access to host *Host* is controlled by being situated where it can be under constant surveillance in a location that is continuously occupied at times when attacks may occur.
CSG-ContinuousUserAuthentication	Access to process *Process* is controlled by authenticating user *Human* based on their registered usage characteristics captured by a personal device *Host*.
CSG-DeprioritisedProcess-Runtime	The process *Process* is configured to run with low priority, so it cannot overload its host *Host, although this means if overloaded it will likely become unavailable instead. This can be configured in advance to block the threat, or implemented as a run-time response to an overload by signalling the manager HostManager* of the process host *Host*.
CSG-DisableGatewayHost-Runtime	Device *Gateway* is disabled to prevent it being involved in an attack. This strategy represents a run-time adaptation in response to a threat, which may or may not be following some contingency plan. It also triggers threats representing side effects that would be caused by such an action.
CSG-DisableHost-Runtime	Device *Host* is disabled to prevent it being involved in an attack. This strategy represents a run-time adaptation in response to a threat, which may or may not be following some contingency plan. It also triggers threats representing side effects that would be caused by such an action.
CSG-DisableHost-Trigger	This strategy represents a state in which *Host* has been disabled, used as a trigger for threats representing side effects. It should not be used for any other purpose.
CSG-DisableProcess-Runtime	Process *Process* is disabled to prevent it being involved in an attack. This strategy represents a run-time adaptation in response to a threat, which may or may not be following some contingency plan. It also triggers threats representing side effects that would be caused by such an action.
CSG-DisableProcess-Trigger	Process *Process* is disabled to prevent it being involved in an attack. This strategy represents a run-time adaptation in response to a threat, which may or may not be following some contingency plan. It also triggers threats representing side effects that would be caused by such an action.
CSG-DisableRadioSubnet	Indicates provision of network *RadioSubnet* is disabled at device *Gateway*, meaning the subnet is not available to potential attackers. This strategy does not represent a contingency plan, but a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction. The most common situation where provision of a subnet is possible but would not be used in practice is where a mobile device provides a WiFi hotspot. The control applies to the hotspot implementation, so affects provision of the hotspot in one location, making it possible to indicate that the user would keep the hotspot functionality switched off in that location.
CSG-DisableSubnet	Indicates provision of network *LogicalSubnet* is disabled at device *Gateway*, meaning the subnet is not available to potential attackers. This strategy does not represent a contingency plan, but a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction. The most common situation where provision of a subnet is possible but would not be used in practice is where a mobile device provides a WiFi hotspot, which it could do in any location, but the user will keep the hotspot functionality switched off in some locations.
CSG-EmbeddedHostSecurity	Host *Host* is locked or built into the physical environment *Space* such that neither it nor any of its internal storage media can be removed or altered without destroying them.
CSG-FormalDeviceVerification	The software for device *Host* has been analysed by independent experts using formal methods and shown to be free of bugs. It is therefore guaranteed to work correctly for arbitrary (even malicious) inputs. However, this is only possible for simple devices. Note that it does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations (although in principle no vulnerabilities should ever be found).
CSG-FormalProcessVerification	The software for process *Process* has been analysed by independent experts using formal methods and shown to be free of bugs. It is therefore guaranteed to work correctly for arbitrary (even malicious) inputs. However, this is only possible for simple processes. Note that it does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations (although in principle no vulnerabilities should ever be found).
CSG-HostCertification	The software and hardware at device *Host* has been assessed and certified to be secure by independent experts. The device is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-HostEncryption	Data stored on physical device *PhysicalHost* are encrypted, so data cannot be accessed by physically extracting and reading storage devices from *PhysicalHost*, as an alternative to logging into the device.
CSG-HostManagerScreening	Persons in the role *HostManager* responsible for managing *Host* are screened by their employer *Employer* before being given that role. This ensures they are more trustworthy than one would expect given the population or community from which they are recruited.
CSG-HostWithMultipleWiFiNIC	Means host *Gateway* has more than one WiFi LAN network interface.
CSG-HostWithMultipleWiredNIC	Means mobile host *Gateway* has more than one Wired LAN network interface.
CSG-IgnoreManagementOfHost	Signifies that the management of device *Host* is omitted because it is out of scope, e.g. because its management does not form part of the system. Note that this means modelling error threats to detect unmanaged devices will be ignored, but threats that could be addressed by a system manager will still apply to the unmanaged devices.
CSG-IndependentGatewayHosts	If the instances of a class of devices *Gateway* are independent of each other, having admin rights does not allow control of resourcing of *Gateway* instances.
CSG-IndependentHosts	If the instances of a class of devices *Host* are independent of each other, having admin rights does not allow control of resourcing of *Host* instances.
CSG-ManagerHostFaultRecovery	The device *Host* is monitored for reliability or availability, and if problems are found, its manager *HostManager* can take corrective action while waiting for updated software or hardware. This strategy represents a contingency plan included in the system operating policies and practices, e.g. to roll back software to an older but more reliable version or switch to a stand-in device from a different hardware vendor.
CSG-ManagerHostFaultRecovery-Implementation-Runtime	The device *Host* was found to have reliability or availability issues, and action has been taken by its manager *HostManager* to correct the problem. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To implement the plan at runtime, signal *HostManager* that the problem was detected with *Host*.
CSG-ManagerProcessFaultRecovery	The process *Process* is monitored for reliability and availability, and if problems are found, the manager *HostManager* of its host device *Host* can take corrective action while waiting for updated software. This strategy represents a contingency plan included in the operating policies and practices if certain threats should arise, e.g. to roll back software to an older but more reliable version.
CSG-ManagerProcessFaultRecovery-Implementation-Runtime	The process *Process* was found to have reliability or availability issues, and action has been taken by the manager *HostManager* of its host device to correct the problem. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To implement the plan at runtime, signal *HostManager* that the problem was detected with *Process*.
CSG-NetworkAuthN-PSK	To prevent network spoofing, a gateway *Gateway* providing the network and the supplicant device *Host* can use a pre-shared key that can be verified by *Host*.
CSG-NetworkAuthN-PSK-Optional	To prevent network spoofing, a gateway *Gateway* providing the network and the supplicant device *Host* can use a pre-shared key that can be verified by *Host*.
CSG-NetworkAuthN-X509	To prevent network spoofing, a gateway *Gateway* providing the network can use an X509 (or otherwise trusted) key pair, verified by the supplicant device *Host*.
CSG-NetworkAuthN-X509-Optional	To prevent network spoofing, a gateway *Gateway* providing the network can use an X509 (or otherwise trusted) key pair, verified by the supplicant device *Host*.
CSG-NetworkEAP-AAA	Control access to subnet *LogicalSubnet* using a (usually remote) AAA service that verifies keys provisioned in SIM cards to authorised supplicants. You should also specify SIM cards be used by supplicant devices or they will be unable to connect.
CSG-NetworkEAP-PSK	Control access to subnet *LogicalSubnet* using a pre-shared key. This is installed at the device *Gateway* providing the network, which also verifies that supplicants have the same key, preventing unauthorised access. You should also specify shared keys for supplicant devices or they will be unable to connect.
CSG-NetworkEAP-PSK-Client	If subnet *LogicalSubnet* uses a pre-shared key to control access, supplicant device *Host* can connect if it has the pre-shared key.
CSG-NetworkEAP-TLS	Control access to subnet *LogicalSubnet* using authentication via X509 or otherwise trusted public-private key pairs. The gateway device *Gateway* providing the network has an (X509 certified) key, and a means to verify (X509 certified) keys registered by authorised supplicants. You should also specify that supplicant devices have (X509 certified) key pairs or they will be unable to connect.
CSG-NetworkEAP-TLS-Client	If subnet *LogicalSubnet* uses a EAP.TLS to control access, supplicant device *Host* can connect if it has an X509 certified (or similarly trusted) asymmetric key pair.
CSG-PasswordChecksAtHost	Access to device *Host* is controlled, by authenticating authorised users using a password.
CSG-PasswordSelfServiceReset	If user *Human* forgets their (strong) password, service *Service* provides a way for them to reset it using an out of band communication (e.g. email or sms).
CSG-PatchingAtHost	Use a systematic procedure for regular security patching of software used (including hosted processes) on device *Host, and have a contingency plan included in the system operating policies and practices for HostManager* to manually apply patches immediately should the need for them become urgent.
CSG-PatchingAtHost-Implementation	Represents a situation in which software patches have been applied manually by *HostManager* to eliminate vulnerabilities in device *Host. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Note that this should only be considered if a suitable software patch is available. To implement this at runtime, signal the responsible user HostManager. Then deselect the SoftwarePatched control and restore the asserted Extrinsic TW levels of Host* once the update has been confirmed.
CSG-PatchingAtProcess	Use a systematic procedure for regular security patching of software used (including hosted process *Process) on device Host, and have a contingency plan included in the system operating policies and practices for HostManager* to manually apply patches immediately for *Process* should the need for them become urgent.
CSG-PatchingAtProcess-Implementation	Represents a situation in which software patches have been applied manually by *HostManager* to eliminate vulnerabilities in process *Process. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Note that this should only be considered if a suitable software patch is available. To implement this at runtime, signal the responsible user HostManager*.
CSG-PatchingAtService	Use a systematic procedure for regular security patching of software used (including hosted process *Service) on device SHost, and have a contingency plan included in the system operating policies and practices for HostManager* to manually apply patches immediately for *Service* should the need for them become urgent.
CSG-PatchingAtService-Implementation	Represents a situation in which software patches have been applied manually by *HostManager* to eliminate vulnerabilities in process *Service. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Note that this should only be considered if a suitable software patch is available. To implement this at runtime, signal the responsible user HostManager*.
CSG-PenTestingOfHost	The software and hardware at device *Host* has been tested and certified to be secure by independent experts. The device is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-PenTestingOfProcess	The software for process *Process* has been tested and certified to be secure by independent experts. The process is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-PersonalDeviceOversight	Device *Host* is a personal device dedicated to one user, who will protect it from some types of attacks involving ongoing physical access or evident alteration of the device. For these threats, the protection level is very good because a momentary lapse in attention from the user is not sufficient to allow the attack.
CSG-PersonalDeviceProtection	Device *Host* is a personal device dedicated to one user, who will protect it from some types of attacks involving physical access. This particular strategy relates to threats that are blocked, affording slightly less than perfect protection because the user may be overcome by force or become temporarily less than vigilant.
CSG-PersonalDeviceSecurity	Device *Host* is a personal device dedicated to one user, who has been trained in basic security and will protect it from some types of attacks involving physical access. Similar to personal device protection, but more effective due to the user being able to maintain vigilance and avoid physically uncontrollable situations.
CSG-PhysicalChecksOnGateway	Device *Gateway* is physically monitored to rapidly detect if it has been physically removed, altered or substituted, so its manager *HostManager* can address any physical compromise. This strategy represents a contingency plan included in the system operating policies and practices, e.g. to repair or replace the affected device. Activation of the plan restores normal service, but if the device was stolen the attacker still has possession of the original which could still be misused.
CSG-PhysicalChecksOnGateway-Implementation-Runtime	Device *Gateway* having found to be physically removed, altered or substituted, action has been taken by its manager *HostManager* to restore normal service. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To implement the plan at runtime, signal *HostManager* that the problem was detected with *Gateway* which may need repair or replacement.
CSG-PhysicalChecksOnHost	Device *Host* is physically monitored to rapidly detect if it has been physically removed, altered or substituted, so its manager *HostManager* can address any physical compromise. This strategy represents a contingency plan included in the system operating policies and practices, e.g. to repair or replace the affected device. Activation of the plan restores normal service, but if the device was stolen the attacker still has possession of the original which could still be misused.
CSG-PhysicalChecksOnHost-Implementation-Runtime	Device *Host* having found to be physically removed, altered or substituted, action has been taken by its manager *HostManager* to restore normal service. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To implement the plan at runtime, signal *HostManager* that the problem was detected with *Host* which may need repair or replacement.
CSG-ProcessCertification	The software for process *Process* has been assessed and certified to be secure by independent experts. The process is unlikely to contain exploitable bugs, though the assessment may become outdated so should be renewed from time to time. Note that this does not prevent bugs that are present being discovered and exploited by attackers, so it is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-RadioSubnetEncryption	To prevent passive snooping in radio network *LogicalSubnet, one can configure the network to use encrypted radio communication in LogicalSubnet*.
CSG-RemoteMobileWiping	Device *Host* can be remotely wiped by its user *Human* if the device is lost or stolen, permanently removing accounts, security keys and data. This strategy represents a contingency plan
CSG-RemoteMobileWiping-Implementation-Runtime	Device *Host* has been remotely wiped by its user after being stolen. To implement this at runtime, signal the device user *Human* that the action should be taken. The control strategy is used to model the effect this should have so it can be considered as an option in current (runtime) decision support calculations. To activate it at runtime, signal user *Human* who is responsible for the device. Then deselect the ManualActionTaken control and restore the asserted Possession TWL of *Host* once the action has been confirmed.
CSG-RestrictedRemoteAccess	Remote access service *Service* runs a restricted shell on *SHost, such that remote users cannot gain full access to the host, and can only run specific application processes on SHost* (those controlled by *Service*).
CSG-SecureBIOSatHost	Device *Host* is configured to prevent alteration of its software by physical insertion during its boot sequence.
CSG-SecureHostConfig	Device *Host* is configured securely: passwords or other authentication are set up including resetting default passwords for all user and administrator accounts, auto-run features disabled to prevent execution without user authorisation for files from removable storage or from the internet, and unnecessary software and especially network accessible services removed or disabled.
CSG-SecureProcessExecution	Uses hardware security on device *Host* to bootstrap a protected enclave in which *Process* can execute without interference even by someone with admin rights at *Host*.
CSG-ServiceAuthN-X509	The client *Client* authenticates the service *Service* using an asymmetric cryptographic challenge against a public key registered to the service operator through a trusted means such as X509.
CSG-SharedKeyManagement	Processes *Client* and *Service* have secure access to a shared key used to encrypt and decrypt data *Data* for transfer via file or network.
CSG-SoftwareTestingOfHost	The hardware and software for device *Host* has been independently tested and verified to meet functional requirements. The device is therefore unlikely to contain bugs that cause a malfunction. This does not prevent bugs that are present from causing problems, so this is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-SoftwareTestingOfProcess	The software for process *Process* has been independently tested and verified to meet functional requirements. The process is therefore unlikely to contain bugs that cause a malfunction. This does not prevent bugs that are present from causing problems, so this is a prior mitigation only which is ignored in current (run-time) risk calculations.
CSG-SoftwareUpdatingAtHost	Use a systematic procedure for updating software used (including hosted processes) on device *Host*.
CSG-SpamFilteringAtMUA	Spam filtering functionality is installed on the email user agent *MUA* (a mail client or a webmail service).
CSG-SuspendInfectedHost	Device *Host* may be temporarily disabled by its manager *HostManager* to prevent it being exploited should it become infected by malware. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendInfectedHost-Implementation-Runtime	Device *Host* has been disabled by its manager *HostManager* to prevent it being exploited after being infected by malware. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing the device. The Disabled Host control should be deselected only when the host has been restarted.
CSG-SuspendInfectedHost-Trigger	Device *Host* may be temporarily disabled by its manager *HostManager* to prevent it being exploited should it become infected by malware. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendInfectedProcess	Process *Process* may be temporarily disabled by the manager of its host *HostManager* to prevent it being exploited should it become infected by malware. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendInfectedProcess-Implementation-Runtime	Process *Process* has been disabled by the manager of its host *HostManager* to prevent it being exploited after being infected by malware. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing the device hosting *Process*. The Disabled Process control should be deselected only when the process has been restarted.
CSG-SuspendInfectedProcess-Trigger	Process *Process* may be temporarily disabled by the manager of its host *HostManager* to prevent it being exploited should it become infected by malware. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendServiceVulnerableToXSS	Service *Service* may be temporarily disabled by the manager of its host *HostManager* to prevent a known vulnerability being exploited in a cross-site scripting attack. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendServiceVulnerableToXSS-Implementation-Runtime	Process *Service* has been disabled by the manager of its host *HostManager* to prevent it being exploited in a cross-site scripting attack. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing device *SHost* where *Service* is running. The Disabled Process control should be deselected only when the process has been restarted.
CSG-SuspendServiceVulnerableToXSS-Trigger	Service *Service* may be temporarily disabled by the manager of its host *HostManager* to prevent a known vulnerability being exploited in a cross-site scripting attack. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableHost	Device *Host* may be temporarily disabled by its manager *HostManager* to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableHost-Implementation-Runtime	Device *Host* has been disabled by its manager *HostManager* to prevent a known vulnerability being exploited by an attacker. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing the device. The Disabled Host control should be deselected only when the host has been restarted.
CSG-SuspendVulnerableHost-Trigger	Device *Host* may be temporarily disabled by its manager *HostManager* to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableProcess	Process *Process* may be temporarily disabled by the manager of its host *HostManager* to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableProcess-Implementation-Runtime	Process *Process* has been disabled by the manager of its host *HostManager* to prevent a known vulnerability being exploited by an attacker. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing device *Host* where *Process* is running. The Disabled Process control should be deselected only when the process has been restarted.
CSG-SuspendVulnerableProcess-Trigger	Process *Process* may be temporarily disabled by the manager of its host *HostManager* to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableService	Service *Service* may be temporarily disabled by the manager of its host *HostManager* to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableService-Implementation-Runtime	Service *Service* has been disabled by the manager of its host *HostManager* to prevent a known vulnerability being exploited by an attacker. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user *HostManager* who is responsible for managing device *Host* where *Service* is running. The Disabled Process control should be deselected only when the process has been restarted.
CSG-UserBasicSecurityTraining	Users in the role *Human* are trained to avoid basic cyber security errors associated with the use of passwords.
CSG-UserPasswordAccessToHost	Users in the role *Human* choose a password which is registered with the system allowing access to interactive host *Host* that authenticates using the password.
CSG-UserSecurityTraining	Users in the role *Human* are trained to avoid most common cyber security errors by using only strong passwords, recognising malicious emails, and the importance of physical security including the use of screen locking for fixed devices that cannot be carried on the person.
CSG-UserWithoutEmail	The user *Human* has no access to email from any device used by them while engaged in the system.
CSG-X509CertificationOfClient	Access to a service requires authentication using an asymmetric cryptographic challenge during a TLS connection establishment by *Client*, based on an X509 or other trusted public key belonging to the authorised user.
CSG-X509CertificationOfHost	Access to a service requires authentication using an asymmetric cryptographic challenge during a TLS connection establishment by *Client, based on an X509 or other trusted public key belonging to the authorised user. Here the client Client* is acting as a proxy for its host device, so the key is actually installed on *CHost*.
CSG-XSSPreventionAtService	The XSS Sanitisation control means the service *Service* has been implemented using an XSS-safe language and framework including XSS detection code scanners.

AAA	The subnet uses an AAA service not included in the model for network authentication and access control based on SIMs. Used for high level abstrations representing public cellular networks.
AccessControl	The asset (device or service) has an enforcement point (PEP) preventing unauthorised access. Normally used in conjunction with an authentication mechanism.
AntiMalware	The device has software installed that protects against malware.
AuthenticationLimits	Represents measures to restrict the number or rate of authentication attempts, and to lock out users on a permanent or temporary basis when these limits are reached.
BasicSecurityTraining	The user has undergone basic training in password security and device protection before acting in the specified role.
BiometricIDVerifier	The host has a means to authenticate authorised users using biometrics.
ChipAndPINVerifier	The host has a means to authenticate authorised users using a chip and pin card.
Clustering	The host represents a class of identical hosts that form a scalable cluster. The control indicates that multiple hosts can be used at the same time to run a process or store a data asset, either to scale up performance or provide extra resilience.
ContinuousAuthN	The process captures usage characteristics, allowing the user identity to be verified by a suitable authentication service against a previously registered profile.
ContinuousAuthNID	The user has continuous authentication identification characteristics registered with a continuous authentication verification service in the system.
ContinuousAuthVerifier	The service has a means to verify the identity of a device user based on continuous authentication data sent by the device.
DeviceCertification	The device has been independently tested and certified as secure to a suitable evaluation assurance level.
DisabledHost	The host device has been disabled. This is not a contingency plan but a state reached after activation of a contingency plan. It should be selected in current risk calculations to determine the effect of disabling the host, or when runtime monitoring detects the host is not running.
DisabledProcess	The process has been disabled. This is not a contingency plan but a state reached after activation of a contingency plan. It should be selected in current risk calculations to determine the effect of disabling the process, or when runtime monitoring detects the process is not running.
DisableNetwork	Disable a network (logical subnet). Most commonly used to prevent provision of an abstract subnet (e.g. a hotspot) by a mobile device when the device is in a specific location (with the control applied to the logical subnet representing implementation in that location). Note that control strategies involve controls at the providing host, so this is only possible where there is such a host.
DisableNetworkProvision	Applied to a host providing a logical subnet, this control signifies that provision of networking by the host can be disabled.
EncryptedComms	The subnet uses encryption below OSI Layer 3, established via the CCMP protocol from IEEE.802.11i or equivalent.
FormalVerification	The process or host software has been formally verified and found to be correct.
HomomorphicEncryption	The algorithms used by the process are capable of performing calculations on encrypted data.
HostEncryption	Data storage devices on the host that are used to store application data are encrypted. This does not protect data when the host is running as decrypion keys ust be available to running processes. However, it does prevent access to data by removing storage devices from a host, e.g. after it has been stolen.
HostMonitoring	The host is monitored to detect any software problems (errors or crashes).
IndependentInstances	The host is actually a set of instances whose provisioning is independent of their management.
KeyManagement	The process has a way to access a shared key required to access encrypted data.
LoadMonitoring	The host or process is monitored to detect any overload situations.
Logging	The host creates a log of its activities.
LowPriority	The priority of the process has been lowered to prevent it overloading its host. This may mean the process will become unavailable, however.
MultipleWiFiNIC	Means the host can connect to multiple WiFi LANs at the same time.
MultipleWiredNIC	Means the host can connect to multiple wired LANs at the same time.
OneTimeKey	The human has a device for generating a one-time key by entering a PIN.
OneTimeKeyVerifier	The process has a means to verify a one-time key generated by an authorised user.
OutOfBandKey	The human has a way to obtain a one-time key sent to it by a separate (out of band) communication channel.
OutOfBandKeyVerifier	The process has a way to verify a one-time key sent to an authorised device or user via a separate (out of band) communication channel.
Password	The human has registered a password for identification purposes, which may be stored in a process acting on their behalf.
PasswordQualityCheck	The host or process has a way to check the quality of a password when set or changed by a user. For example, it may use checks as specified in NIST-800-63.
PasswordReset	A service has a mechanism for self-service resetting of a user password.
PasswordStore	The process has an encrypted password store, enabling its user to more easily recall and use strong passwords.
PasswordVerifier	The host or process has a means to verify a password given by an authorised user.
PenetrationTesting	The software for a host or process has been tested to check it is not vulnerable to certain attacks.
PersonalDevice	The host is a personal device, carried by and therefore monitored and protected by its only user.
PhysicalChecks	The device is checked physically at suitable intervals to detect physical alteration or removal.
PhysicalDeviceProtection	The device is physically protected by being built into its physical environment.
PhysicallyObservable	Signifies that the Physical Host can be under continuous visual observation within the Space where it is located. Physically large hosts will normally be observable, but for smaller hosts this depends on where in the space they are located.
ProcessMonitoring	The process is monitored to detect any software problems (errors or crashes).
RemoteWiping	The mobile device has a means to delete stored data which can be triggered remotely by its authorised user, e.g. if the device is lost or stolen.
RestrictedShell	Signifies that a process has restricted access to the shell on its host. A user with full control over such a process cannot exploit its rights in arbitrary ways. When applied to a desktop or login service (which are intended to provide access to the shell), it means the shell itself is restricted, and can only be used to run specific applications. In this case, the remote access service controls other processes the user can access.
ScreenLock	A screen lock is automatically started after a suitably short interval of inactivity to prevent access to an interactive device, requiring password authentication to resume the session.
SecureBIOS	The device has a secure BIOS and boot up sequence, ensuring its security cannot be bypassed by rebooting using an external (e.g. USB) boot device.
SecureConfig	Removal of security vulnerabilities arising from insecure default configurations prior to entry of the affected device into the system.
SecureEnclave	The device provides a secure enclave, an area of memory that is accessible only by a specific process, and protected by hardware that allows cryptographic bootstrapping of trust in its contents.
SecureExecution	The process is executed in a secure enclave provided by its host.
SecurityTraining	The human has undergone security training, going beyond basic password and device security and covering aspects such as malicious email threats, and physical security of mobile and fixed host devices.
SharedKey	The host has a shared key which can be used to prove its identity to others holding the same key.
SharedKeyVerifier	The host or process has a means to verify possession of the shared key by another asset.
SoftwareCertification	The process software has been independently tested and certified as secure to a suitable evaluation assurance level.
SoftwarePatched	Represents the application of security patches to eliminate software vulnerabilities in a device or process. Should be used only for run-time decision support calculations.
SoftwarePatching	Employ a well defined process for applying updates to the software running on the associated host.
SoftwareTesting	The process software has been tested to verify that it functions correctly.
SpamFiltering	The email user agent process has a means to scan emails, mark potentially malicious or unwanted emails as spam, and prevent them being seen by a user via the usual channel.
SuspendInfectedHost	The host may be temporarily taken out of service to prevent it being involved in an attack by automated malware to cause a security breach. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.
SuspendInfectedProcess	The process may be temporarily taken out of service to prevent it being involved in an attack by automated malware to cause a security breach. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.
SuspendVulnerableHost	The host may be temporarily taken out of service to prevent it being involved in an attack that exploits a vulnerability to cause a security breach. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.
SuspendVulnerableService	The service may be temporarily taken out of service to prevent it being involved in an attack that exploits a vulnerability to cause a security breach. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.
SystemSecurityTraining	The user has undergone training in operational security relevant to the system, e.g. when and how to impose restrictions on network connectivity or service access, and procedures to safeguard the system in response to threat intelligence, such as emergency application of (possibly untested) software patches. This control can only be applied to an Adult user.
TLS	The process implements transport layer encryption for its communications.
Unmanaged	This control indicates that the management of a device is considered out of scope. It is used to tell SSM that where no manager is specified, that was deliberate and is not an oversight. Note that this only addresses the modelling error threat used to detect a possible oversight. It does not mean other threats that could be managed by a system manager are also ignored.
UsesNoEmail	Applies to Humans in a system role, indicating that they should not use email while acting in that role.
X509	The host or process has an asymmetric key pair, and the association with the public key is attested by a suitably trusted means, often but not necessarily via an X509 certification authority.
X509ClientVerifier	The host or process has a means to verify that an entity that initiated communication with it is the holder of a private key corresponding to a trusted public key association such as an X509 certificate.
X509ServiceVerifier	The host or process has a means to verify that an entity it initiates communication with is the holder of a private key corresponding to a trusted public key association such as an X509 certificate.
XSSSanitisation	The process is implemented using a framework that prevents cross-site scripting attacks.

Role_AbstractSubnet	A communication network that is implemented from a set of logical subnets.
Role_AHost	A host, which may or may not be its own physical host.
Role_AttackerSubnet	A communication network that is accessible to attackers.
Role_AuthClient	A process acting as an authentication client to gain access to a network or service.
Role_AuthService	A process providing authentication/authorisation services.
Role_CHost	A host role, usually one running a client process.
Role_Client	A process acting as a client, i.e. initiating communication with a service.
Role_Cluster	A host role filled by some form of a cluster.
Role_ConsoleHost	A host that users can log into and interacting with via a console.
Role_CoreNetwork	A backbone network role.
Role_DataCentre	A data centre role.
Role_Gateway	A host that provides a subnet and/or acts as a router between subnets.
Role_GeneralProcess	A general process.
Role_Host	A host.
Role_HostAccess	A context for access rights on a host.
Role_HostManager	A user role assigned to managing a host.
Role_HostNetContext	A network connectivity context for access rights on a host.
Role_Hotspot	A WiFi network provided by a mobile device wherever it goes.
Role_Internet	The Internet.
Role_LocalHost	A host that is local to some other asset or phenomenon.
Role_LogicalSubnet	A logical subnet (i.e. a subnet that can be used for direct communication between connected hosts).
Role_LoginService	A login service (i.e. a process that supports shell access to a host).
Role_MobileClient	A mobile client supporting login (i.e. a notebook, tablet or smartphone).
Role_MUA	A process acting as a Mail User Agent.
Role_Operator	A stakeholder role with legal responsibility for operation of part or all of a system.
Role_OtherHost	A host that is not the first one found in a pattern.
Role_PhysicalHost	A physical host.
Role_PhysicalSubnet	A physical subnet.
Role_ProcAccess	A context for access rights of a process.
Role_Process	A process.
Role_ProcessManager	A user role assigned to managing a process.
Role_ProcNetContext	A network connectivity context for access rights of a process.
Role_RadioSubnet	A radio subnet.
Role_RemoteAccessClient	A remote access client.
Role_RemoteAccessService	A remote access service.
Role_RemoteHost	A host that is remote from some other asset or phenomenon.
Role_RemoteTerminal	A remote access terminal process.
Role_Router	A host acting as a router.
Role_Server	A server.
Role_Service	A process acting as a service, i.e. open to communication requests from clients.
Role_ServiceManager	A user role assigned to managing a service.
Role_SHost	A host in a role where it supports a virtual host or service.
Role_SimpleHost	A simple host.
Role_SimpleProcess	A simple process.
Role_SmartPhone	A smart phone.
Role_Subnet	A logical subnet.
Role_TrivialHost	A trivial host unable to support shell access, e.g. a removable storage device or an IoT device.
Role_TrivialProcess	A process that is so trivial it is not subject to some types of threats.
Role_WiredLAN	A wired local area network.

AbstractSubnet	Base class for all network subnets, including real subnets (i.e. those over which messages can be sent or routed) and some that are not real but represent a set of (inferred) real networks and routers.
AuthClient	A simple process that runs on a host and handles authentication of that hosts to subnets that require it.
AuthService	A simple process that provides authentication and authorization of client processes or devices connecting to other services and networks.
Cluster	A collection of identical physical servers that can be managed as a cluster. A singleton Cluster in a system model represents multiple Server-class Hosts.
ClusterHost	Common base class for any Host that represents a collection of Hosts.
ConsoleHost	A (physical) host with a user interface that also supports shell access, making it possible for users to log in. Attackers who can gain physical access could also exploit vulnerabilities and gain control over the device.
CoreNetwork	Represents a wide area, mostly wired network composed of several connected subnets that are not explicitly included.
CoreRouter	A type of wired network router that provides connections with and within core networks.
DataCentre	A building or buildings containing physical hosts and networks that can itself be connected to other networks, and used to support virtual hosts and management via a cloud platform. Internal connections and resources will be inferred where necessary, if not added manually.
DumbHost	A (physical) host device that has no built in (physical) user interface, which means it cannot be used directly by a Human.
EmailClient	Represents an ESMTP Mail User Agent (MUA) process that is used interactively by its users.
EmailMUA	Represents a general ESMTP Mail User Agent (MUA) process. It provides a means for attackers to send malicious content designed to trick its users. Used as a base class for assertible subclasses representing webmail services and desktop email clients, etc.
EmailService	Represents an ESMTP Mail User Agent (MUA) process accessed remotely by users. This is either via a WebBrowser (which makes the MUA a webmail service) or an EmailClient (which makes the MUA an IMAP/POP service). The MUA provides a means for attackers to send malicious content designed to trick its users.
FixedHost	A Host that is always located in one fixed Space, i.e. it doesn't move around, and its network connections are thus persistent.
GeneralHost	A parent class for devices that are able to run arbitrary processes and hold data with no problems. Distinct from SimpleHost devices, which are specialised to a particular purpose.
GeneralProcess	A process with significant complexity unable to run on a specialised device.
HContext	A common parent class for host-related access contexts.
Host	A device that can store, process, transmit or receive data.
HostContext	Represents accessibility for a host when in a specific location, with links to the host, location (space), and networks it can be connected to in that location.
HostNetContext	Represents accessibility for a host when on a specific subnet, with links to the host, subnet, and locations (spaces) where it can be connected to in that subnet.
HostPalette	An overlay parent class descended from Palette Type, to be used to control the grouping of assertable assets in the SSM GUI Asset Palette.
InteractiveHost	A (physical) host with a user interface that allows users to interact with a process, but not to log into the host.
InternalSubnet	A base class for logical subnets that are purely internal within a single host.
Internet	Special type of PhysicalSubnet, used as an abstraction for the core and access networks that make up the global, public Internet. There is only one Internet, so only one of these should appear in each system model.
L01Subnet	Common parent of L0 and L1 subnets, i.e. subnets that support communication within a single host or between two paired hosts.
L0Subnet	An L0Subnet is one provided by a host for communication within that host. This covers API calls and socket level communication between hosted processes to emulated IP switching between virtual hosts. The key difference between this and L3 virtual networks is that intrusion on the network is impossible except by compromising a connected host.
L23Subnet	Common parent of L2 and L3 subnets, i.e. subnets that support communication between different, unpaired hosts.
L2Subnet	An OSI Layer 2 subnet is one supporting communication between connected devices.
L3Subnet	An OSI Layer 3 subnet is one that supports addressing of messages between connected devices and devices that need not be connected to the same subnet.
LogicalSubnet	A base class for any means of communication between hosts.
LoginService	Supports remote access to command line functionality on its host. If the service controls the host, it has root privileges, enabling remote system admin. If the service controls other processes running on the host, it has the privileges assigned to those processes, and users can interact via a remote terminal client with those processes. A desktop service may be configured as a restricted workspace by enabling security controls such that it does not allow the user unrestricted access to the shell, but only to processes that are specified as being available to the login service.
MobileClient	A device that is mobile, but could be a Notebook, Smartphone, or Tablet. Used where different users may employ different types of client device, so the model cannot specify (or assume) a single type.
MobileHost	A Host that has no fixed location, and whose network connections are thus mostly non-persistent.
NetworkAsset	Base class for all network assets excluding host devices, including abstract and real subnets, network interfaces, routes through gateway hosts, and extended network paths.
NetworkPalette	An overlay parent class descended from Palette Type, to be used to control the grouping of assertable assets in the SSM GUI Asset Palette.
Notebook	A mobile interactive computer, equipped with wireless and sometimes cellular network interfaces, able to run arbitrary applications, including client processes for accessing services over a network. Although designated as a PC, they are not always used as personal devices.
PContext	A common parent class for process-related access contexts.
PersonalHost	A mobile or IoT device that is dedicated to a single user and carried wherever they go. It is possible for hosts of these types to be non-dedicated, but if a user both interacts with and manages them, they are considered dedicated.
PhysicalHost	A physical host device, that could therefore be physically as well as electronically attacked (unlike a VirtualHost).
PhysicalSubnet	A physical subnet is one that makes direct use of physical hardware.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.
ProcessContext	Represents accessibility for a process when running on a specific host in a specific location, with links to the process, host, location (space), and networks it can use for communication in that location, plus channels and paths that are accessible to a client or available for accessing a service when in that location.
ProcessPalette	An overlay parent class descended from Palette Type, to be used to control the grouping of assertable assets in the SSM GUI Asset Palette.
ProcNetContext	Represents accessibility for a process when running on a specific host on a specific subnet, with links to the process, host and subnet, and locations (spaces), where it can be connected to that subnet, plus channels and paths that are accessible to a client or available for accessing a service when it is connected.
RadioSubnet	A network that uses radio as its means of communication, and may therefore be snooped or jammed.
RemoteAccessClient	A remote access client is any process that can be used to run commands or otherwise interact with processes running in a shell on a remote host.
RemoteAccessService	A remote access service is any process that can be accessed remotely and used to run commands or otherwise interact with processes running in a shell on its host.
RemoteTerminal	Provides a means to access the command line on a remote host via a login service running on that host.
RemovableMedia	Represents the ability to use removable (e.g. USB) storage devices as a means to transfer data between hosts. Such devices therefore act a bit like networks, so in practice any threats are caused by the mechanism used to connect them to other hosts.
Router	A very simple fixed device used to transmit and receive data between different locally connected subnets.
Server	A fixed physical host used to run application processes that are accessed remotely over a network. If your server device is not headless, make it a Workstation.
ShellHost	A parent class for devices that support access via something equivalent to a shell, i.e. a means for users to run and control processes.
SimpleHost	A parent class for devices that are specialised for a purpose, and are therefore not normally able to host arbitrary processes and data. As distinct from GeneralHost devices, which have no such limitations.
SimpleProcess	A process with limited complexity able to run on a specialised device.
Smartphone	A mobile physical host used to run apps that mostly act as clients for accessing services over a network.
Smartwatch	A mobile physical host used to run apps that mostly act as clients for accessing services over a network, and which typically connects using near field communications to a router such as a smartphone.
SMSClient	Represents a text messaging client running on a phone that is used interactively by its users. The domain model assumes every smart phone will be running one of these clients, but they must be inserted by users if they run on other devices including tablets or PCs, etc.
SocketLAN	Represents the ability of processes on a common host to communicate with each other using the loopback address.
Tablet	A mobile physical host used to run apps, some of which run locally but many act as clients for accessing services over a network.
TrivialHost	A device specialised to support functionality so limited that it does not support shell access, e.g. a USB thumb drive, IoT controller or IoT sensor.
TrivialProcess	A type of simple process that is so trivial that some types of threats arise so rarely they can be neglected, e.g. threats involving software bugs.
TypeOverlayHost	A base class for all host classification overlay parent classes.
TypeOverlayProcess	A base class for all process classification overlay parent classes.
TypeOverlaySubnet	A base class for logical subnet classification overlay parent classes.
WiFiLAN	A locally connected physical network that uses radio communication.
WiredLAN	A locally connected network in which connections between hosts are provided by physical wires.
WiredSubnet	A network that uses physical wiring as its means of communication.
Workstation	A fixed physical host with a fully functional user interface, including a conventional PC, used to run interactive applications locally, as well as interactive client processes for accessing services over a network.

Capacity	Represents the total capacity at a Data Centre, or more accurately, the level of trust that it will be able to handle any demand placed on it by automatically provisioned for hosts and processes.
DefaultTW	Modelling artefact: an attribute that is always set to the lowest trustworthiness level, and used as a cause for threats that are triggered entirely by the use of security controls.
ExtrinsicTW	Free of software vulnerabilities in processes and devices that are likely to be discovered by potential attackers.
Health	Free of self-propagating malware.
IntrinsicTW	Free of functional software bugs that cause errors or crashes without external provocation.
NetworkControl	Control over routing within an abstract or logical subnet.
NetworkUserTW	Trustworthiness of users with access to an abstract or logical network subnet.
OutOfService	The asset is not currently engaged or being used within the system, and hence cannot be exploited by attackers.
ResourceTW	Provisining is controlled by a trustworthy process or administrator.
TrojanTW	The host has no back doors inserted into its operating system or other software running on the host. If back doors are present, this also makes processes running on the host vulnerable.
Underload	Represents the spare capacity at a Data Centre.

Package Network

Root Patterns (146)

R-AC

R-AS

R-C

R-CaS

R-CcuS

R-CH

R-CHS

R-CS

R-CScP

R-CuP

R-CuScS

R-CuSHS

R-DC

R-DCH

R-DCLS

R-DCpLS

R-DCPS

R-DCVHRS

R-DCVHWS

R-DCWH

R-FcLSS

R-FpLSS

R-GH

R-H

R-HAC

R-HACP

R-HCHLSS

R-HcWHS

R-HHu2

R-HIUS

R-HL3S

R-HLnSP

R-HLS

R-Hm2Hu

R-HNP

R-HP

R-HPAC

R-HPHLS

R-HprL3SAC

R-HprLS

R-HprLSAC

R-HRASuPcC

R-HRASuPCcS

R-HRASuPcS

R-HRASuPScS

R-HuE

R-HuHE

R-HuHE2AC

R-Hui2H

R-HuiCH

R-HuiCHLnS

R-HuiDH

R-HuiH

R-HuiHAC

R-HuiHP

R-HuiHPSP

R-HuiHRAC

R-HuiHS

R-HuiHSt

R-HuiP

R-HuiPCHS

R-HuiPDaS

R-HuiPH

R-HuiPSt

R-HuirP

R-HuirRACP

R-HumCH

R-HumCHS

R-HumH

R-HumHcS

R-HumHP

R-HumHRAS

R-HumHSt

R-HumP

R-HumPH

R-HumSH

R-HuoH

R-HuPCH