Package ProcessComms

URI: ProcessComms

Description: Model of process-process communications.

R-ACDFCS

Finds a data flow that goes via a client and thence a service, and the related auth channel and data.

R-ACDFFC

Finds a data flow from a client to/via a service, and the associated auth channel, data and data access. The source and destination of the flow are matched twice, so they can be referred to by either role name in control strategies.

R-ACDFFS

Finds a data flow from a service to/via a client, and the associated channel, data and data access. Note that roles FlowsFrom and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.

R-ACDFSC

Finds a data flow that goes via a service and thence a client, and the related auth channel and data.

R-ACDFTC

Finds a data flow to a client from or via a service, and the associated auth channel, data and data access. The destination of the flow is matched twice, so they can be referred to by either role name in control strategies.

R-ACDFTS

Finds a data flow to a service from/via a client, and the associated channel, data and data access. Note that roles FlowsTo and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.

R-ACDFVFC

Finds a data flow encrypted with keys from a vault, flowing from a client to/via a service, and the associated auth channel, data and data access. The source and destination of the flow are matched twice, so they can be referred to by either role name in control strategies.

R-ACDFVFS

Finds a data flow encrypted with keys from a vault, flowing from a service to/via a client, and the associated channel, data and data access. Note that roles FlowsFrom and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.

R-ACDFVTC

Finds a data flow encrypted with keys from a vault, flowing to a client from a service, and the associated auth channel, data and data access. The destination of the flow is matched twice, so they can be referred to by either role name in control strategies.

R-ACDFVTS

Finds a data flow encrypted with keys from a vault, flowing to a service from/via a client, and the associated channel, data and data access. Note that roles FlowsTo and Service are matched by the same asset(s). Having two roles makes it possible to create links to control strategies using either role name.

R-CACHcLSS

Finds a service accessed by a client via a subnet the client is on, and an associated context for access to the client.

R-CACHLSS

Finds a service accessed by a client via a subnet the client need not normally be on, and an associated context for access to the client.

R-CACPaACS

Finds a client providing authentication credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes.

R-CACPzACS

Finds a client providing indirect authorization credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes.

R-CACS

Finds a Client and Service with an Auth Channel between them, plus their hosts.

R-CACScACP

Finds a client and process connected via a channel, where the client also uses another service that controls the process, along with the associated channels.

R-CACSSaS

Finds a channel between a client and a service used to pass authorization tokens, and a second channel from the service to another service used to validate those tokens, along with the hosts of the client and the second service.

R-CACSScS

Finds a channel between a client and a service, where authentication on this channel is controlled by authentication on another channel from the same client to a second service, along with the hosts of the client and the second service.

R-CAPlISAP

Finds a client attack path via a service attack path where the former has a last interface.

R-CAPNPSAP

Finds a Client Attack Path via a Service Attack Path and a Network Path.

R-CAPSAP

Finds a Client Attack Path via a Service Attack Path.

R-CCAPNoS

R-CCCCAP

Finds a Client Channel via a proxy Client Channel that goes via an Attack Path.

R-CCCfCCS+aFC

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel to the first Proxy, and the client and service hosts, plus a client context in which the client can access the proxy channel.

R-CCCLnS

Finds a Client and Remote Access Service with a ClientChannel between them, plus their hosts.

R-CCCPCCS

Finds a client accessing a reverse proxy that uses a service, via the associated client channels.

R-CCCS

Finds a Client and Service with a Client Channel between them, plus their hosts.

R-CCCSCCS

Finds a client accessing a service that uses another service, via the associated client channels.

R-CCCSCCSDF

Finds a client accessing a service that uses another service, via the associated client channels, plus a data flow from the second service to the first.

R-CCCSCS

Finds a Client and Service connected via a Service Channel, plus the Client Channel between them. The presence of a Service Channel means this is a direct connection (not via a reverse proxy) involving communication over a network (not via a local API or sockets).

R-CCCSDFCCS

Finds a client accessing a service that uses another service, via the associated client channels, plus a data flow to the second service from the first.

R-CCCSPCCSDF

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, with a data flow from the second service to the first, plus the associated client channels.

R-CCCSPDFCCS

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, with a data flow to the second service from the first, plus the associated client channels.

R-CCCSPSFCS

Finds a client sending a flow of data to a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.

R-CCCSPSFSC

Finds a client receiving a flow of data from a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.

R-CCCSvLS

Finds a Client with a Client Channel to a Service via an adjacent L2 subnet, plus their hosts.

R-CCCtCCS+aTS

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel from the last Proxy, and a service context in which the service can be accessed via the proxy channel.

R-CCCvCCS

Finds a Client accessing a Service via a Proxy, with the Client Channel between the Client and Service, the channel to the Proxy, plus the client and service hosts.

R-CCCvCCvLS

Finds a Client Channel from a Client process that goes via a Logical Subnet and also via another Client Channel (i.e. the client and service communicate via a credential sharing/forwarding chain).

R-CCDFCDAScDA

Finds a data flow from a service to an indirect client, where the client encrypts the data flow to create an outbound data asset controlled by a vault.

R-CCDFCS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data.

R-CCDFSC

Finds a data flow that goes via a service and thence a client, and the related client channel and data.

R-CCDFSDAScDA

Finds a data flow to a service from an indirect client, where the service encrypts the data flow to create an outbound data asset controlled by a vault.

R-CCDFSFC

Finds a data flow from a client to/via a service, and the associated client channel, data and the first data step. The source of the flow is matched twice, so it can be referred to by either role name.

R-CCDFSFS

Finds a data flow to/via a client from a service, and the associated client channel, data and the first data step. The source of the flow is matched twice, so it can be referred to by either role name.

R-CCDFSTC

Finds a data flow to a client from/via a service, and the associated client channel, data and the last data step. The destination of the flow is matched twice, so it can be referred to by either role name.

R-CCDFSTS

Finds a data flow from/via a client to a service, and the associated client channel, data and the last data step.

R-CCDS2FC

Finds a data flowing from/via a client via a service, plus the associated client channel and the data steps from the client and from the service.

R-CCDS2TC

Finds a data flowing to/via a client via a service, plus the associated client channel and the data steps to the client and to the service.

R-CCfI

Finds a Client Channel from an Interface at the Client host.

R-CCS

Finds a client and service connected by a client channel.

R-CCSC

Finds a client and service connected by a client channel and a service channel.

R-CCSCAP

Finds a Client Channel via a Service Channel that goes via an Attack Path.

R-CCSCCP

Finds a client channel via a service channel that is via a client path.

R-CCSCfI

Finds a Client Channel via a Service Channel that goes from an Interface.

R-CCSCtI

Finds a Client Channel via a Service Channel that goes to an Interface.

R-CCSCtSg

Finds a Client Channel via a Service Channel that goes via a Logical Segment.

R-CCSCvI

Finds a Client Channel via a Service Channel that goes via an Interface.

R-CCSCvLS

Finds a Client Channel via a Service Channel that visits a Logical Subnet.

R-CCtI

Finds a Client Channel to an Interface at the Service host.

R-CDBSC

Finds a process acting as a client to a DB in a context where the connection between them is open.

R-CDBSCDADS

Finds a process using a DB service to update data, where the data in this case may or may not normally be accessed via the process.

R-CDBSCDSDA

Finds a process using a DB service to update data, where the data in this case may or may not normally be accessed via the process.

R-CDBSCDSF

Finds a process using data served by a DB service the process is using, and the associated client channel, host and data copy assets.

R-CRoS

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, and a Logical Subnet used by at least one path from the client, plus the Client Path for that Client from this Subnet.

R-CRoSG

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface from a Gateway host to a subnet on at least one path from the Client, plus the Client Path from that Interface, and an access context for the gateway where it is on the relevant path.

R-CRoSI

R-CSAPNaS

Finds a host running a service and a closed service attack path to the service from a logical subnet.

R-CSCC

Finds a Client and Service with a ClientChannel between them, plus their hosts.

R-CSCCHu

Finds a Human manager of a Service and a Client Channel to the Service from a Client.

R-CSCCHuSt

Finds a Human manager of a Service and their employer, and a Client Channel to the Service from a Client.

R-CSCCSC

Finds a Client and Service with a Client Channel between them and a single associated Service Channel.

R-CSCLS

Finds a client and its host and a service channel to the service via a logical subnet to which the host is connected, plus the associated process access contexts.

R-CSCLS+ii

Finds a client and its host (and physical host) and a service channel to the service via the Internet to which the host need not be connected, accessible from the World in which the host need not be located.

R-CSCLS-ii

Finds a client and its host (and physical host) and a service channel to the service via an L3 subnet to which the host need not be connected, accessible from a space in which the host need not be located.

R-CSCvLS

Finds a Service Channel from a client process to a service, and a logical subnet visited by it, plus the interface from which the channel enters that subnet.

R-CSDS

Finds a client and service plus the associated client channel where there is a data step from the client to the service.

R-CSHSAC

Finds a service accessed by a client and an associated context for access to the service.

R-CSL0H

Finds a client channel whose client and service are collocated on a host, and an internal (socket) LAN provided by the host that is accessible in a space.

R-CSL1H2

Finds a client and service whose hosts are connected in a pair, plus their interfaces on each side.

R-CSL3H

Finds a client channel whose client and service are collocated on a cluster host that is accessible in a space, and an L3 Subnet connecting to the cluster.

R-CSLS2H2

Finds a client and service running on different hosts connected to different logical subnets that are not hotspots, and a network path between the two subnets.

R-CSLSH2

Finds a client and service whose hosts are connected to the same logical subnet.

R-CucSaP

Finds a Client using a Service with forwarded or shared credentials, and also using a third Process for authentication which controls the Service.

R-CuPiS

Finds a client process using a service indirectly using another service.

R-CuPnS

Finds a client accessing a process that directly or indirectly uses a service, where the process shares or forwards client credentials and sends them to the service.

R-CuPuS

Finds a client process using a service using another service.

R-CuPuSCC

Finds a client accessing a service indirectly, via one intermediary, plus the auth channels between client and service and between each and the intermediary process.

R-CuPvnS

Finds a client accessing a process that is in a credential forwarding chain with a service used indirectly by the client (i.e., the service is at the end of the chain).

R-CuPvSCC

Finds a client accessing a service indirectly, where there is more than one intermediary, plus the first intermediary adjacent to the client, and channels between client and service and between the client and this intermediary process.

R-CuvS

Finds a client indirectly accessing a process via a credential sharing/forwarding chain.

R-CvPuSCC

Finds a client accessing a service via more than one intermediary, plus the last intermediary adjacent to the service, and channels between client and service and between this intermediary process and the service.

R-CvPvSCC

Finds a client accessing a service via at least two intermediaries, and two intermediaries that are adjacent, and the channels between client and service and between these two intermediary processes. Note that the link from the client is to the intermediary proxy that is closer to the service, and vice versa. This guarantees that these two links will be usesIndirectly (indirect) and not accessesService (direct) in the matching system assets.

R-CzS

Finds a client providing authorization claims to a remote service.

R-CzSzP

Finds a client sending an authorization token to a service which uses a separate OAuth-style process to validate and exchange the token.

R-DDoS

Finds a service and client, where the communication path crosses the Internet.

R-DFDSCS

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service.

R-DFDSSC

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client.

R-DFrXSS

Finds human using a web browser that uses a service with a host, where the browser receives data from another process, plus the client channel between the browser and the service.

R-DFsXSS

Finds a human using a web browser that accesses a service running on a Host and using inflowing data. The data flow destination is matched twice so it can be referred to in CSGs using different role names.

R-DoS

Finds a service with its host, and a service attack path to the service from a (possibly remote) subnet.

R-DSrXSS

Finds human using a web browser that uses a service with a host, where the browser also uses locally stored data.

R-DSsXSS

Finds a human using a web browser that accesses a service running on a host and using stored input data.

R-HLSISC

Finds a host connecting to a logical subnet by authenticating to a controlling service.

R-HPdDSCCV

R-HPrDSCCV

R-HuCAP

Finds a client attack path from a subnet, plus the associated client, service process and service host, and the service and service host managers.

R-HuCCCS

Finds a User of an interactive Client using a Service with a ClientChannel between them, plus their hosts.

R-HuDFrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses inflowing data.

R-HuDFsXSS

Finds a human using a web browser that accesses a service which is using inflowing data and whose host has a manager. The destination of the flow is matched twice, so it can be referred to by either role name.

R-HuDFTCS

Finds a Human using a Web Browser that accesses a Service, where the browser consumes a data flow that is viewed by the user, plus the client channel associated with the commnication and data flow.

R-HuDSrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses locally stored data.

R-HuDSsXSS

Finds a human using a web browser that accesses a service which is using stored input data and whose host has a manager.

R-HuDSTCS

Finds a Human using a Web Browser that accesses a Service, where the browser consumes a locally stored data input viewed by the user, plus the client channel associated with the data use and client-service commnication.

R-HuHW2ACE

Finds a Human using a web browser running on a host to access email, when the host is located in a space, plus the associated host location access context.

R-HuiHCCCS

Finds a Human using a Host to run a Process that is a Client of a Service.

R-HuiHrCCCS

Finds a Human using a Host running a Remote Access Client used to access a Process that is a Client of a Service.

R-HuirRACSPH

Finds a Human interacting remotely with a Process via a Remote Access Clent, plus the Process Host, collocated Remote Access Service, and the Client Channel between the Remote Access Client and the Remote Access Service.

R-HuiSP

Finds a Human interactively using a reverse proxy (which is not normally permitted).

R-HumCCCS

Finds a User managing a Client using a Service with a ClientChannel between them, plus their hosts.

R-HuSAP

Finds a service attack path from a subnet, plus the associated service process and service host, and the service and service host managers.

R-HuSC

Finds a service channel representing a privileged communication path to a service, plus the associated service process and service host, and the service and service host managers.

R-HuStCCCS

Finds the Employer of a User of an interactive Client using a Service with a ClientChannel between them, plus their hosts.

R-NPSCCAP

Finds an off-channel Client Attack Path via Network Path from an attacker Subnet into a Service Channel.

R-OCAPNoS

R-OSAPLaS

Finds a host connected to an L2 subnet running a service, and an open service attack path from the subnet to the service.

R-OSAPNaS

Finds a host running a service and an open service attack path to the service from a logical subnet.

R-PCaFCSCCC

Finds a client channel via a service channel which is accessible to a client in a process context.

R-PCaTSSCAP

Finds an attack path path via a service channel on which a service is accessible in a process context.

R-PCaTSSCCC

Finds a client channel via a service channel which gives access to a service in a process context.

R-PcC

Finds a client that is controlled by another process.

R-PccCuS

Finds a client using a service for application or authentication, where both client and service are controlled by the same process.

R-PCCPCCS

Finds a reverse proxy accessing another reverse proxy that accesses a service, via the associated client channels.

R-PcP

Finds a Process in the role of Proxy controlling another Process.

R-PILS

Finds a Process running on a Host connected via an Interface to a Logical Subnet.

R-PnPnS

Finds a client using a service with shared or forwarded credentials, where the service uses another service in the same way.

R-RACvSPHRASP

Finds a host running a process and a remote access service that uses the process, and is used by a remote access client via a reverse proxy chain.

R-RDvSPDtS

Finds a remote desktop client using a reverse proxy chain that provides access to a remote desktop service.

R-RDvSPHP

Finds a Host running a Process used remotely via a reverse proxy by a Remote Desktop client.

R-RDvSPIP

Finds a remote desktop client using a reverse proxy chain that provides access to an interactive process.

R-RTvSPCP

Finds a remote terminal client using a reverse proxy chain that provides access to a console (command line interactive) process.

R-RTvSPHP

Finds a Host running a Process used via a reverse proxy chain by a Remote Terminal client.

R-RTvSPRAS

Finds a remote terminal client using a reverse proxy chain that provides access to a remote access service.

R-SC

Finds a client and service connected by a service channel, plus the service host.

R-SCAPvLS

Finds a Host running a Service connected via an Interface to a Subnet visited by a Service Channel via an Attack Path to the Service Process.

R-SCCAP

Finds a service channel linked with a closed client attack path from a logical subnet to the service process.

R-SCCHNPLS

Finds a Service Channel via a Logical Path from a Client, the Client Host, Subnet and Interface.

R-ScDACDACCDF

Finds a data flow to a service from an indirect client, where the client creates the data flow from an inbound data asset controlled by a vault.

R-ScDASDACCDF

Finds a data flow from a service requested by an indirect client, where the service creates the data flow by decrypting an inbound data asset controlled by a vault.

R-SCDS

Finds a client and service plus the associated client channel where there is a data step from the service to the client.

R-SCLPLSg

Finds a service channel via a logical path that traverses a logical segment.

R-SCLPvLS

Finds a service channel via a logical path that visits a subnet.

R-SCLSg

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.

R-SCLSI

Finds a Service Channel via a Logical Subnet connected to the service host.

R-SCNSg

Finds a Service Channel traversing a NAT segment, and the subnets on either side.

R-SCsAPtI

Finds an Attack Path from a subnet at the start of a Service Channel, the path from which is a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.

R-SCvLS

Finds a Service Channel that visits a Logical Subnet, plus the Service and the Interface into the subnet.

R-SOCAP

Finds a service channel linked with an open client attack path from a logical subnet to the service process.

R-SP

Finds a reverse proxy process.

R-SPNaLnS

Finds a host running a remote access service accessed by a reverse proxy, plus the associated client channel.

R-SPNaS

Finds a host running a service accessed by a reverse proxy, plus the associated client channel.

R-SPuS

Finds a reverse proxy directly using a service.

R-SSClIAP

Finds a service channel from a last interface to a service process via an attack path.

R-SSCLS

Finds a service and its host and a service channel from a client via a logical subnet to which the host is connected, plus the associated process access contexts.

MP-ACDF-VCS-i

Finds a data flow not encrypted with keys from a vault, that goes via a client and thence a service, plus any data fields, and the related channel, where the connection is direct and not via any credential-sharing intermediaries.

MP-ACDF-VFS-i

Finds a data flow not encrypted with keys from a vault flowing from a service to/via a client, plus any data fields, and the associated channel, where the connection is direct.

MP-ACDFVFS-i

Finds a data flow encrypted with keys from a vault flowing from a service to/via a client, plus any data fields, and the associated client channel, where the connection is direct.

MP-ACDF-VSC-i

Finds a data flow not encrypted with keys from a vault, that goes via a service and thence a client, and the related channel and any data fields, where the connection is direct and not via any credential-sharing intermediaries.

MP-ACDF-VTS-i

Finds a data flow not encrypted with keys from a vault, flowing to a service from/via a client, plus the data, data access and any data fields, and the associated channel, where the connection is direct and not via any credential-sharing intermediaries.

MP-ACDFVTS-i

Finds a data flow encrypted with keys from a vault, flowing to a service from/via a client, plus any data fields, the data access, and the associated client channel, where the connection is direct and not via any credential-sharing intermediaries.

MP-AC-iDF-VCS

Finds a data flow not encrypted with keys from a vault, that goes via a client and thence a service, plus any data fields, and the related auth channel, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end relationship).

MP-AC-iDFVFC

Finds a data flow encrypted by a key from a vault, flowing from a client to or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access and any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsFrom or Client) in control strategies.

MP-AC-iDF-VFC

Finds a data flow not encrypted by a key from a vault, flowing from a client to or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access, any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsFrom or Client) in control strategies.

MP-AC-iDF-VSC

Finds a data flow not encrypted with keys from a vault, that goes via a service and thence via a client, plus any data fields, and the related auth channel, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end relationship).

MP-AC-iDFVTC

Finds a data flow encrypted by a key from a vault, flowing to a client from or via a service, and the associated auth channel which must not be to a trust intermediary, the data access and any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsTo or Client) in control strategies.

MP-AC-iDF-VTC

Finds a data flow not encrypted by a key from a vault, flowing to a client from or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsTo or Client) in control strategies.

MP-CACHcLSS

Finds a service accessed by a client via a subnet the client is on, and an associated context for access to the client, plus the two process hosts and optionally the client user and service manager.

MP-CACHLSS

Finds a service that is not acting as a reverse proxy accessed by a client and an associated context for access from the client via a subnet to which it need not normally be connected, plus the two process hosts and optionally the client user and service manager.

MP-CAC-pPaAC-pS

Finds a client providing authentication credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain.

MP-CAC-pPzAC-pS

Finds a client providing indirect authorization credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain.

MP-CAC-pScAC-pP

Finds a client and process connected via a channel, where the client also uses another service that controls the process, along with the associated channels, where the Client, Process and Service are not in a credential sharing chain.

MP-CACSSaS

MP-CACSScS

MP-CACvsCCS

Finds a Client accessing a Service via intermediaries, along with the Auth Channel between the Client and Service, and the related client channels via intermediaries, any of which can cause a threat, plus the client and service hosts and and optionally the service manager and interactive client user.

MP-CAPlISAP

Finds a client attack path via a service attack path where the former has a last interface.

MP-CAPNPSAP

Finds a Client Attack Path via a Service Attack Path and a Network Path.

MP-CAPSAP

Finds a Client Attack Path via a Service Attack Path.

MP-CCAPNaS

Finds a service and its host accessed by a client via the associated client channel on a closed client attack path from a logical subnet where messages from the attacker come from the same address as those from the client, plus all the associated service process contexts, and optionally the client user and the service and service host managers.

MP-CCCCAP

Finds a Client Channel via a proxy Client Channel that goes via an Attack Path.

MP-CCCfCCS+aFC

MP-CCCLnSAC

Finds a Client and Remote Access Service with a ClientChannel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client and service managers.

MP-CCCmSCS

Finds a Client and Service with a Client Channel between them and all associated Service Channels (of which there must be at least one), plus the client and service hosts and optionally the service manager and interactive client user.

MP-CCC-nmCCS

Finds a Client not acting as an authentication proxy with access via at least one proxy to a Service which is not using a separate authenticator, with a Client Channel between them and all associated proxy client channels (of which there must be at least one), plus the client and service hosts and optionally the Client user and Service manager.

MP-CCC-nmSCS

Finds a Client accessing and authenticating directly with a Service, the Client Channel between them and all associated Service Channels (of which there must be at least one), plus the client and service hosts and optionally the service manager and client user.

MP-CCC-nS

Finds a Client that is not sharing or forwarding credentials, with access to a Service that does not use a separate authenticator, the ClientChannel between them, the Client and Service hosts and optionally the Client user and Service manager.

MP-CCC-nS-i

Finds a Client and Service where the Service is responsible for authenticating the client, the ClientChannel between them which must be a direct connection, plus the Client and Service hosts and optionally the Client user and Service manager.

MP-CCCPCCS-i

Finds a client accessing a reverse proxy that uses a service, via the associated client channels, where the client and service are not in a credential forwarding chain, plus optionally the reverse proxy manager.

MP-CCCS

Finds a Client and Service with a ClientChannel between them, the Client and Service hosts and optionally the client user and the service and service host managers.

MP-CCCSAC

Finds a Client and Service with a Client Channel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.

MP-CCCSACvLS

Finds a Client with a Client Channel to a Service via an adjacent L2 subnet, plus their hosts, all related access contexts at the Service, and optionally the client user and the service and service host managers.

MP-CCCSCCSDF-Vi

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service, plus a data flow not encrypted with keys from a vault, that flows to the second service from the first but not to the client.

MP-CCCSCCS-i

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service.

MP-CCCSCSoAC

Finds a Client and Service connected via a Client Channel, also connected by a Service Channel, plus any indirect Auth Channels that depend on this Client Channel (which may be none). The presence of the Service Channel means the first Client Channel is a direct connection (not via intermediaries) involving communication over a network (not via a local API or sockets).

MP-CCCSDF-VCCS-i

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service, plus a data flow and any data fields not encrypted with keys from a vault flowing to the second service from the first but not from the client.

MP-CCCS-i

Finds a Client and Service with a direct ClientChannel between them, the Client and Service hosts and optionally the client user and the service and service host managers.

MP-CCCS-iAC

Finds a Client and Service with a direct Client Channel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.

MP-CCCSPCCSDF-Vi

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, where the client is not authenticated by the second service, with a data flow not encrypted with keys from a vault going from the second service to the first but not to the client, plus the associated client channels.

MP-CCCSPDF-VCCS-i

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, where the client is not authenticated by the second service, with a data flow not encrypted with keys from a vault, flowing to the second service from the first but not from the client, plus the associated client channels.

MP-CCCSPSFCS

Finds a client sending a flow of data to a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.

MP-CCCSPSFSC

Finds a client receiving a flow of data from a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.

MP-CCCtCCS+aTS

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel from the last Proxy, the client and service hosts, and a service context in which the service can be accessed via the proxy channel.

MP-CCCvCCS

Finds a Client accessing a Service via a Proxy, with the Client Channel between the Client and Service, and the related channel to the Proxy, the hosts of client and service and and optionally the service manager and interactive client user.

MP-CCCvCCvLS

Finds a Client Channel from a Client process that goes via a Logical Subnet and also via another Client Channel (i.e. the client and service communicate via a credential sharing/forwarding chain).

MP-CCCvsCC-nS

Finds a Client accessing a Service via intermediaries, where the Service is responsible for client authentication, along with the Client Channel between the Client and Service, and the related channels via intermediaries, any of which can cause a threat, plus the client and service hosts and and optionally the service manager and interactive client user.

MP-CCCvsCCSAC

Finds a Client and Service with a Client Channel between them that goes via at least one channel via an intermediary, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.

MP-CCDFCDAScDA-c

Finds a data flow from a service to an indirect client, where the client encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow.

MP-CCDFCS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data.

MP-CCDFSC

Finds a data flow that goes via a service and thence a client, and the related client channel and data.

MP-CCDFSDAScDA-c

Finds a data flow to a service from an indirect client, where the service encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow.

MP-CCDFSFC

Finds a data flow from a client to/via a service, and the associated client channel, data and the first data step, plus optionally the managers of the service and the source of the data flow. The source of the flow is matched twice, so it can be referred to by either role name.

MP-CCDFSFS

Finds a data flow to/via a client from a service, and the associated client channel, data and the first data step, plus optionally the managers of the service and the source of the data flow. The source of the flow is matched twice, so it can be referred to by either role name.

MP-CCDFSTC

Finds a data flow to a client from/via a service, and the associated client channel, data and the last data step, plus optionally the managers of the service and the source of the data flow. The destination of the flow is matched twice, so it can be referred to by either role name.

MP-CCDFSTS

Finds a data flow from/via a client to a service, and the associated client channel, data and the last data step, plus optionally the managers of the service and the source of the data flow. The destination of the flow is matched twice, so it can be referred to by either role name.

MP-CCDS2FC

Finds a data flowing from/via a client via a service, plus the associated client channel and the data steps from the client and from the service, and optionally the manager of the service and of the data flow source process.

MP-CCDS2TC

Finds a data flowing to/via a client via a service, plus the associated client channel and the data steps to the client and to the service, and optionally the manager of the service and of the data flow source process.

MP-CCfImSC

Finds a Client Channel from an Interface at the Client host with at least one associated Service Channel.

MP-CC-iDFCS

MP-CC-iDFC-SS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end credential sharing chain), and the client does not get the data from its own client. The last restriction is so related threats are not duplicated if the client also acts as a service when exchanging this data.

MP-CC-iDFSC

Finds a data flow that goes via a service and thence via a client, plus the related client channel and data, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end credential sharing chain).

MP-CCSC

Finds a client and service connected by a client channel and a service channel.

MP-CCSCAP

Finds a Client Channel via a Service Channel that goes via an Attack Path.

MP-CCSCCP

Finds a client channel via a service channel that is via a client path.

MP-CCSCfI

Finds a Client Channel via a Service Channel that goes from an Interface.

MP-CCSCtI

Finds a Client Channel via a Service Channel that goes to an Interface.

MP-CCSCtSg

Finds a Client Channel via a Service Channel that goes via a Logical Segment.

MP-CCSCvI

Finds a Client Channel via a Service Channel that goes via an Interface.

MP-CCSCvLS

Finds a Client Channel via a Service Channel that visits a Logical Subnet.

MP-CCSmDFS

Finds a client and service connected by a client channel, which is used by at least one DataStep representing the possibility to exchange data between the two.

MP-CCtImSC

Finds a Client Channel to an Interface at the Service host with at least one associated Service Channel.

MP-CDBSC

Finds a process acting as a client to a DB with a Client Channel between them, and optionally the process host manager.

MP-CDBSCDSF

Finds a process using data served by a DB service the process is using, and the associated service channel, host and data copy assets, plus optionally the service host manager.

MP-CDBSC-DSF

Finds a process using a DB service and the associated service channel, plus the DB host and a copy of data served by the DB and flowing to it, but not from the process.

MP-CDBSC-DST

Finds a process using a DB service and the associated service channel, plus the DB host and a copy of data served by the DB and flowing from it, but not to the process.

MP-CRoS

MP-CRoSG

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface from a subnet to a Gateway host on at least one path from the Client, plus the Client Path from that subnet, and an access context for the gateway where it is on the relevant path, plus all service channels that relate to the client path, and optionally the service host manager and client user.

MP-CRoSI

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface to a subnet on at least one path from the Client, and the Client Path from that Interface, and optionally the service manager and client user.

MP-CSAPNaS

Finds a host running a service, a closed service attack path to the service from a logical subnet, the location access contexts where the service is accessible via this attack path, and optionally the managers of the service and its host.

MP-CSCCHuoSt

Finds a Human manager of a Service and a Client Channel to the Service from a Client, where the Client is managed by someone else, plus optionally the employer of the Service manager.

MP-CSCCHuSt

Finds a Human manager of a Service and their employer, and a Client Channel to the Service from a Client not operated by the employer.

MP-CSCCmCC

Finds a Client and Service with a Client Channel between them having at least one associated Client Channel indicating access is via a proxy.

MP-CSCCSC

Finds a Client and Service with a Client Channel between them and a single associated Service Channel.

MP-CSCC-SC

Finds a Client and Service running on different hosts with a ClientChannel but no ServiceChannel or ServiceProxy between them.

MP-CSCLS

Finds a client and its host and a service channel to the service via a logical subnet to which the host is connected, plus the associated network context.

MP-CSCLS+ii

Finds a client and its host and a service channel to the service via the Internet to which the host need not be connected, accessible from the World in which the host need not be located.

MP-CSCLS-ii

Finds a client and its host and a service channel to the service via a logical subnet (not a HostLAN or the Internet) to which the host need not be connected, accessible from a space in which the host need not be located.

MP-CScP-v

Finds a client directly or indirectly accessing a service which is controlled by another process, where the three processes are not in a credential forwarding or sharing chain and there is no link to say the cilent uses the third process for authentication.

MP-CSCvLS

Finds a Service Channel from a client process to a service, and a logical subnet visited by it.

MP-CSDS

Finds a client and service plus the associated client channel where there is a data step from the client to the service.

MP-CSHSAC

Finds a service accessed by a client and an associated context for access to the service, plus the two process hosts and optionally the client user and service host manager.

MP-CSL0H

Finds a client channel whose client and service are collocated on a host that is not a cluster, and an internal (socket) LAN provided by the host accessible in a space.

MP-CSL1H2

Finds a client and service whose hosts are paired, plus their interfaces to the pair.

MP-CSL3H

Finds a client channel whose client and service are collocated on a cluster host that is accessible in a space, and an L3 Subnet connecting to the cluster.

MP-CuPnS-U

Finds a client accessing a process that directly or indirectly uses a service, where the process shares or forwards client credentials and sends them to the service, and there is no link saying the client is sending shared credentials to the service.

MP-CuPuSCC

Finds a client accessing a service indirectly, via one intermediary which communicates directly with both, plus the auth channels between client and service and between each and the intermediary process.

MP-CuPvnS

Finds a client accessing a process that is in a credential forwarding chain with a service used indirectly by the client (i.e., the service is at the end of the chain).

MP-CuPvSCC

MP-CuvS

Finds a client indirectly accessing a process via a credential sharing/forwarding chain.

MP-CvPuSCC

MP-CvPvSCC

Finds a client accessing a service via at least two intermediaries, and two intermediaries that are adjacent, and the channels between client and service and between these two intermediary processes.

MP-CzS-CC

Finds a client providing authorization claims to a remote service, where there is no client channel linking the two.

MP-CzSzP

Finds a client sending an authorization token to a service which uses a separate OAuth-style process to validate and exchange the token.

MP-DDoS

Finds a service with which at least one client communicates via the Internet.

MP-DFDSCS

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service.

MP-DFDSSC

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client.

MP-DFrXSS

Finds human using a web browser that uses a service with a host, where the browser receives from another process (not the service) data not created by either the browser or its user , plus the client channel between the browser and the service which must go via an IP subnet, and optionally the service and service host managers.

MP-DFsXSS

Finds a human using a web browser that accesses a service running on a Host and using inflowing data, along with optional host and service managers. The data flow destination is matched twice so it can be referred to in CSGs using different role names.

MP-DoS

Finds a service with its host, and a service attack path to the service from a (possibly remote) subnet, and all the interfaces to which traffic would flow along this attack path.

MP-DSrXSS

Finds human using a web browser that uses a service with a host, where the browser also uses locally stored data not entered or updated by the user, along with optional host and service managers.

MP-DSsXSS

Finds a human using a web browser that accesses a service running on a host and using stored input data, along with optional host and service managers.

MP-HLSISC

Finds a host connecting to a logical subnet that is not a hotspot, by authenticating to a controlling service.

MP-HPsACdDSCCV

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data, plus any data fields included in the data copy and used by the process, the process access contexts (a non-unique sufficient match), and optionally the process host manager.

MP-HPsACrDSCCV

Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data, plus any data fields included in the data copy and used by the process, the process access contexts (a non-unique sufficient match), and optionally the process host manager.

MP-HuCAPmSC

Finds a client attack path from a subnet, plus the associated client, service process, host and manager, with service channels via the client attack path.

MP-HuCCC-nS

Finds the User of an interactive Client using a Service not managed by the same user and not using a separate authenticator, with a Client Channel between them, plus the client and service hosts and optionally the service manager.

MP-HuDFrXSS

Finds human using a web browser that uses a service with a host and a host manager, where the browser receives from another process (not the service) data not created by either the browser or its user, plus the client channel between the browser and the service which must go via an IP subnet, and optionally the service manager.

MP-HuDFsXSS

Finds a human using a web browser that accesses a service which is using inflowing data and whose host has a manager, plus optionally the service manager.

MP-HuDFTCS

Finds a Human using a Web Browser that accesses via at least one IP subnet a Service that does not use a separate authenticator service, where the browser consumes a data flow viewed but not updated by the user, plus the data access and client channel assets associated with the data use and client-service commnication.

MP-HuDSrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses locally stored data not entered nor updated by the user, plus optionally the service manager.

MP-HuDSsXSS

Finds a web browser accessing a service which is using stored input, plus the service host and manager.

MP-HuDSTCS

Finds a Human using a Web Browser that accesses via at least one IP subnet a Service that does not use a separate authenticator service, where the browser consumes a locally stored data input viewed but not updated by the user, plus the data access and client channel assets associated with the data use and client-service commnication.

MP-HuHW2ACE

Finds a Human using a web browser running on a host to access email, when the host is located in a space, plus the associated host location access context and process contexts in which access to the webmail service is possible using networks to which the host is connected when in that location.

MP-HuiHCCC-nS

Finds a Human using a Host to run a Process that is a Client of a Service, where the Client is authenticated by the Service.

MP-HuiHrCCC-nS

Finds a Human using a Host running a Remote Access Client used to access a Process that is a Client of a Service, where the Client is authenticated by the Service.

MP-HuirRACSPH

MP-HuiSP

Finds a Human interactively using a reverse proxy (which is not normally permitted).

MP-HumCCC-nS

Finds a User managing a Client that uses and authenticates directly with a Service, plus the ClientChannel between them, their hosts, and optionally the service and service host managers.

MP-HuoStCCCS

Finds a User of an interactive Client (not a transparent proxy) using a Service they do not manage, plus the ClientChannel and Client and Service hosts, and optionally the employer of the user and manager of the service.

MP-HuRACP

Finds a human interacting with a remote access client on a local host that is remotely using a process that is not a proxy.

MP-HuSAPmSC

Finds a service attack path from a subnet, plus the associated service process, host and manager, with service channels via the attack path.

MP-HuSC

Finds a service channel representing a privileged communication path to a service, plus the associated service process and service host, and the service and service host managers.

MP-HuStCCCS

Finds a User of an interactive Client using a Service they do not manage, plus the ClientChannel and Client and Service hosts, the employer of the user and optionally the manager of the service.

MP-ImSCf

Finds an interface between a host and a logical subnet where at least one service channel goes from that interface.

MP-LnSc-uP

Finds a Remote Access Service controlling access to a process that does not use the service.

MP-LnSucP-pS

Finds a remote access service using a process to which it forwards credentials, where that process does not need those credentials to access another service.

MP-LSmSC

Finds a Logical Subnet and all service channels via that subnet.

MP-NPSCCAP

Finds an off-channel Client Attack Path via Network Path into a Service Channel.

MP-OCAPNaS

Finds a service and its host accessed by a client via the associated client channel on an open client attack path from a logical subnet where messages from the attacker can be distinguished from those from the client, plus all the associated service process contexts and interfaces from which client messages come, and optionally the client user and the service and service host managers.

MP-OSAPLaS

Finds a host connected to an L2 subnet running a service, an open service attack path from the subnet to the service, plus all location access contexts in which the service is accessible via this path, and optionally the managers of the service and its host.

MP-OSAPNaS

Finds a host running a service, an open service attack path to the service from a logical subnet, the location access contexts where the service is accessible via this attack path, and optionally the managers of the service and its host.

MP-PCaFCSCCC

Finds a client channel via a service channel which is accessible to a client in a process context.

MP-PCaTSSCAP

Finds an attack path path via a service channel on which a service is accessible in a process context.

MP-PCaTSSCCC

Finds a client channel via a service channel which gives access to a service in a process context.

MP-PccCuS

Finds a client using a service for application or authentication, not via a remote access service, where both client and service are controlled by the same process.

MP-PCCPCCS-i

Finds a reverse proxy accessing another reverse proxy that uses a service, via the associated client channels, and optionally the second reverse proxy manager, where there is no credential sharing between the reverse proxies and back-end service.

MP-PcHpmS

Finds a Process in the role of transparent Proxy to at least one Service, and controlling a Host.

MP-PcLSpmS

Finds a Process in the role of transparent Proxy to at least one Service, and controlling a Logical Subnet.

MP-Pc-pPpmS

Finds a Process in the role of transparent Proxy for at least one Service, controlling another Process (not one of those Services).

MP-Pc-uCucmS

Finds a process controlling but not receiving forwarded credentials from a client that is forwarding credentials to other back-end services.

MP-PDFFA

Finds a Data Flow, its source and destination processes, a related data use element at the source, and optionally the two process managers.

MP-PILSsSC

Finds a Process running on a Host connected via an Interface to a Logical Subnet, where the Process acts as a Service to at least one client communicating over that Interface, any of which is sufficient to cause a threat.

MP-PnPnS-U

Finds a client using a service with shared or forwarded credentials, where the service uses another service in the same way, and there is no link yet indicating that the client and the second service are in a credential sharing chain.

MP-Pu-pPucmS

Finds a client that forwards credentials to at least one service, and uses another process as a service without doing the same.

MP-RACvSPHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used via a reverse proxy chain by a remote access client.

MP-RDvSPDtS

Finds a remote desktop client using a reverse proxy chain that provides access to a remote desktop service.

MP-RDvSPHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used remotely via a reverse proxy chain by a Remote Desktop client, not mediated by a collocated remote access service.

MP-RDvSPIP

Finds a remote desktop client using a reverse proxy chain that provides access to an interactive process.

MP-RTvSPCP

Finds a remote terminal client using a reverse proxy chain that provides access to a console (command line interactive) process.

MP-RTvSPHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used via a reverse proxy chain by a Remote Terminal client, not mediated by a collocated remote access service.

MP-RTvSPRAS

Finds a remote terminal client using a reverse proxy chain that provides access to a remote access service.

MP-SC

Finds a client and service connected by a service channel, and optionally the service manager.

MP-SCAPvLS

Finds a Host running a Service connected to a Subnet visited by a Service Channel via an Attack Path to the Service Process.

MP-SCCAP

Finds a service channel linked with a closed client attack path from a logical subnet to the service process.

MP-SCCHNPLS-lI

Finds a Service Channel via a Logical Path from a Client, the Client Host, Subnet and Interface, where the Service Channel has no last interface.

MP-ScDACDACCDF-c

Finds a data flow to a service from an indirect client, where the client creates the data flow from an inbound data asset controlled by a vault, which does not control the outbound data flow.

MP-ScDASDACCDF-c

Finds a data flow from a service requested by an indirect client, where the service creates the data flow by decrypting an inbound data asset controlled by a vault, which does not control the outbound data flow.

MP-SCDS

Finds a client and service plus the associated client channel where there is a data step from the service to the client.

MP-SCLPLSg

Finds a service channel via a logical path that traverses a logical segment, plus the interfaces used by the segment.

MP-SCLPvLS

Finds a service channel via a logical path that visits a subnet.

MP-SCLSg

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.

MP-SCmCAP

Finds a client and service connected by a service channel plus all associated client attack paths from subnets in the channel.

MP-SCmCP

Finds a client and service connected by a service channel, plus all client paths associated with that service channel.

MP-SCmSg

Finds a Service Channel traversing at least one logical segment, plus its Client and Service, and network interfaces.

MP-SCNSg

Finds a Service Channel traversing a NAT segment, and the subnets on either side.

MP-SCpSg

Finds a Service Channel that traverses no logical segments, plus its Client and Service, and network interfaces.

MP-SCsAPtI

MP-SgACmSC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, an access context in which the segment is active, and all assocated service channels.

MP-SgmSC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, and all assocated service channels.

MP-SOCAP

Finds a service channel linked with an open client attack path from a logical subnet to the service process, where there is no closed service attack path to the service from the same logical subnet.

MP-SP

Finds a reverse proxy process.

MP-SPNaLnS

Finds a host running a remote access service accessed by a reverse proxy, plus the associated client channel, the location and network contexts in which this can happen, and optionally the managers of the client proxy, service and service host.

MP-SPNaS

Finds a host running a service accessed via a reverse proxy, plus the associated client channel, contexts in which the service can be accessed, and optionally the managers of the client proxy, service and service host.

MP-SPuS

Finds a reverse proxy directly using a service.

MP-SSClIAP

Finds a service channel from a last interface to a service process via an attack path.

MP-SSCLS

Finds a service and its host and a service channel from a client via a logical subnet to which the host is connected, plus the associated network context.

CP-DFDSCS+f

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service. Adds a link from the DataFlow to the ClientChannel specifying this.

CP-DFDSSC+f

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client. Adds a link from the DataFlow to the ClientChannel specifying this.

CAP.IS.NPSCCAP.8

Privileged network path(s) from Client to Process are open: if a privileged path from Client to Process is open, and an attacker can access this path from AttackerSubnet, then Process can be attacked from that subnet by exploiting firewall policy exceptions allowing access by Client along the privileged path to Process.

CAP.IS.SCmCAP.8

Privileged network path(s) from Client to Service are open: if a privileged path from Client to Service is open, then Service can be attacked from subnets along that path, by exploiting firewall policy exceptions allowing access by client Client to Service.

CC.AuA.CCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.

CC.AuA.OCAPNaS.1

CC.AuC.CACHcLSS.1

Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.

CC.AuC.CACSSaS.3.2

Spoofed authorization service Service allows impersonation of Client to Process: if service Process redirects clients to service Service for authentication, and sends the client credentials to Service for validation, then if an attacker can impersonate Service to Process can falsely validate fake client credentials. Note that this does not necessarily mean they can access Process as Client, only that the client credentials are compromised. The fake token also does not give the attacker rights to other services used by Process.

CC.AuC.CACSScS.1

Possible access to Process by compromised or impersonated client Client of Service: if service Process redirects clients to service Service for authentication, an attacker able to access Service as Client will be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.1

Possible access to Process as client Client by false client of compromised service Service: if service Process redirects clients to service Service for authentication, and Service is compromised, then attackers may be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.2

Possible access to Process as client Client by interception of credentials by a service imposter: if service Process redirects clients to service Service for authentication, an attacker able to impersonate service Service to Client. Since the attacker would then have access to credentials (even if limited to a single use), they can impersonate Client to Process. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.3

Possible access to Process as client Client by snooping credentials between Client and authenticator Service: if service Process redirects clients to service Service for authentication, an attacker able to snoop the token issued by Service may be able to impersonate Client to Process before Client does the same, even if the credential is limited to a single use. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.

CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.

CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.

CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.

CC.AuC.HuDFTCS.3

Unauthentic flow of data Data from FlowsFrom directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client via FlowsFrom (e.g. via phishing), can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.

CC.AuC.HuDSTCS.3

Unauthentic stored input Data directs Client to a fake service impersonating Service: an attacker who provides malicious input to client Client by tampering with stored input Data, can induce the client to access a fake version of service Service, a one-off deception that may allow subsequent impersonation of the client through capture of its password.

CC.AuC.HuiHCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when the client is running on host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.

CC.AuC.HuiHrCCC-nS.3.3

Shoulder surfing password for Client at Service from Host in Space: if user Human enters a password to client Client to access service Service when accessing the client via remote access from host Host in insecure space Space, then an attacker could obtain the password by shoulder surfing.

CC.AuC.HumCCC-nS.3

Credential stuffing to find password used by Human to access Service from Client: this threat applies where a human user of client Client uses a weak password which can guessed or found by brute force attack and used by an attacker to access Service as the client.

CC.AuD.CCCPCCS-i.3

Confused deputy Client access to Process via Service: if client Client has accepted an inappropriate request from its client to gain access to back-end service Process, and Client has access to Process via reverse proxy Service, then Service will forward the request making it a confused deputy.

CC.AuD.CCCSCCS-i.3

Confused deputy as Client via Service: if service Service has access to a back-end service Process that is not normally available to Client, an untrustworthy client may send a malicious request to Service that to gain inappropriate access to Process.

CC.AuP.CCCPCCS-i.3

Access by Client to Process via reverse proxy Service: if client Client has access to service Process via reverse proxy Service, and Client is an untrustworthy client (due to impersonation or compromise), then so (in a more limited sense) is Service.

CC.AuP.PCCPCCS-i.3

Access via Client to Process via reverse proxy Service: if client Client is a reverse proxy whose client is untrustworthy, then so (in a more limited sense) is Service.

CC.AuS.CACSScS.3.1

Service Process spoofed to client Client by false redirection from Service: service Process authenticates clients by redirecting via authenticator Process. However, if Process is compromised, it may redirect clients back to the wrong service.

CC.AuS.CRoS.3

Spoofing of service Service to Client at subnet LogicalSubnet: an attacker with control of a logical subnet on the path between client Client and service Service can divert messages for Service so they go to a fake version of the service under their control.

CC.AuS.CRoSG.3

Spoofing of service Service to Client at gateway Gateway in Space: an attacker in control of gateway device Gateway in location Space where it handles messages sent from Client to Service, the attacker can divert these messages via a fake version of the service under their control.

CC.AuS.CRoSI.3

Spoofing network ToSubnet allows diversion of the connection of client Client to service Service to an imposter service: an attacker that has spoofed the network connection from Gateway to ToSubnet can divert messages from Client to Service so they go to a fake version of the service under their control.

CC.AX.CACSSaS.0

Client Client unable to access service Process because Process cannot access authorization service Service: the service Process requires that clients authenticate with a separate service Service, but Process cannot access Service to exchange the client token issued by Service for an access token granting rights at Process.

CC.AX.CACSScS.0

Client Client unable to authenticate with Service to access service Process: the service Process requires that clients authenticate with a separate service Service, which is inaccessible to client Client.

CC.AX.CCCmSCS.0

Communication failure between Client and Service: if there are no available network paths between client Client and service Service, Client will be unable to connect to Service.

CC.AX.CCC-nmCCS.6.1.5

Client Client unable to authenticate via a trusted key pair with Service: the service Service requires that client connections are authenticated using an asymmetric cryptographic challenge against an X509 (or otherwise trusted) key pair, but here access is via a reverse proxy so there is no direct TLS connection.

CC.AX.CCC-nmSCS.6.1.5

CC.AX.CCC-nS.6.1.1

Client Client unable to authenticate via password with Service: the service Service requires that clients authenticate using a password, but this is not available to client Client.

CC.AX.CCC-nS.6.1.3

Client Client unable to use 2-factor authentication to access service Service: if service Service requires clients to authenticate using a second factor (e.g. a one time key or out of band key exchange), but this is not available to Client then access will be impossible.

CC.AX.CCCS.1.3

Compromised service Service prevents access by Client: if service Service is compromised then the attacker can prevent Client from authenticating with the service.

CC.AX.CCCS.6.1

Disabled access by client Client to Service: access by client Client to service Service has been disabled to prevent communication threats. However, this also causes a loss of accessibility of the service from that client.

CC.AX.CCCS.6.2

Disabling access by impersonated client Client to Service affects availability: access by client Client to service Service may be disabled to prevent access by an impersonated client, but this affects the availability of client-service connections.

CC.AX.CCCS.6.3

Disabling access by untrustworthy client Client to Service affects availability: access by client Client to service Service may be disabled to prevent access by a malicious or compromised client, but this affects the availability of client-service connections.

CC.AX.CCCvCCS.0

Access by Client to Service blocked between ProxyClient and Proxy: if Client is accessing Service via a proxy, then a comms failure to or from the proxy also causes an end-to-end comms failure between Client and Service.

CC.AX.CCDFSFS.6.4

Disabling excessive access by client Client to Service affects availability: access by client Client to service Service may be disabled to prevent excessive amounts of data being requested from the service, but this affects the availability of client-service connections.

CC.AX.CCDFSTS.6.4

Disabling excessive access by client Client to Service affects availability: access by client Client to service Service may be disabled to prevent excessive amounts of data being sent to the service, but this affects the availability of client-service connections.

CC.AX.HuCCC-nS.6.1.2

User Human of client Client forgot the password to authenticate with Service: the service Service requires that clients authenticate using a strong password, but the user Human cannot remember the password.

CC.AX.HuCCC-nS.6.1.7

Continuous authN false negative at Client prevents access to Service: the service Service requires that clients use continuous authentication to verify the identity of the user Human, and this is in place but produces a false negative result.

CC.C.CCCSCSoAC.3

Communications intercepted between Client and Service: if a network communication path used by Client and Service is subject to snooping, then communications between Client and Service can be intercepted.

CC.E.CSCC-SC.9

No network path from Client to Service: processes Client and Service on different hosts are exchanging messages directly (not via a reverse proxy), but there is no network path connecting their Hosts. Either move them to the same host, or add network connections and/or devices to provide a network path to support their communications.

CC.IS.CSCCmCC.8

Client channel from Client to Service is in service: here, access is via at least one proxy, so the channel is in service and subject to threats only if all its intermediate channels are in service, and it is not disabled by a policy change preventing access to Service by Client.

CC.IS.CSCCSC.8

Client channel from Client to Service is in service: there is a service channel that is not out of service, so the client channel is in service and subject to threats unless disabled by a policy change preventing access to Service by Client.

CC.L.CSCCHuoSt.1

Malicious action by insider Human controlling Service affects Client: if the user Human controling service Service is malicious, they can make it mishandle requests sent from Client.

CC.L.CSCCHuSt.1

Malicious action by employee of Employer controlling Service affects Client: the user Human controling service Service may be persuaded by their employer Employer to make the service mishandle requests sent from Client.

CC.L.CSHSAC.1

Client Client affected by access to compromised service Service via LogicalSubnet: if Service can be controlled by the wrong person (i.e. an attacker) in a context where it is accessed by client Client, they can alter the behaviour of Service towards Client.

CC.R.CACvsCCS.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.

CC.R.CCCS-i.1

CC.R.HuoStCCCS.1

Malicious action by insider Human using Client to access Service: if user Human of client process Client is malicious, they can abuse the right of Client to access service Service.

CC.R.HuStCCCS.1

Malicious action by employee of Employer using Client to access Service: user Human of client process Client may be persuaded by their employer Employer to abuse the right of Client to access service Service.

CP.IS.SCmCP.8

Client path(s) from Client to Service is in service: if there is an open channel from client Client to service Service, then the service may be subject to authenticated attacks from logical subnets exploiting the open channel.

DF.A.CCDFCS.6.3

Flow of data Data from FlowsFrom to FlowsTo via untrustworthy Service disabled: if the system operates a policy to disable the flow of data Data from FlowsFrom if there is a perceived loss of trustworthiness in a recipient Service, then there will also be a loss of availability if Service is untrustworthy.

DF.A.CCDFSC.6.3

Flow of data Data from FlowsFrom to FlowsTo via untrustworthy process Client disabled: if the system operates a policy to disable the flow of data Data from FlowsFrom if there is a perceived loss of trustworthiness in the recipient Client, then there will also be a loss of availability if Client is untrustworthy.

DF.A.CC-iDFCS.0

Flow of data Data from FlowsFrom to FlowsTo interrupted because Client cannot access Service: if client Client cannot access service Service, the end to end flow of data Data from FlowsFrom to FlowsTo that uses this client-service connection will be interrupted.

DF.A.CC-iDFC-SS.0

Flow of data Data from FlowsFrom to FlowsTo interrupted by unavailable process Client: if process Client is not available then it will be unable to initiate or forward the flow of Data between FlowsFrom to FlowsTo.

DF.A.CC-iDFSC.0

DF.Auth.ACDF-VFS-i.3.6

Encrypted flow of data Data to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can access its cryptographic key and alter data Data flowing between Service and FlowsTo.

DF.Auth.ACDFVFS-i.3.6

DF.Auth.ACDF-VSC-i.3.1

Flow of data Data from FlowsFrom to FlowsTo altered by compromised service Service: if an attacker can compromise service Service, they can they can inject fake data via messages to Client.

DF.Auth.AC-iDF-VCS.3.2

Compromised or impersonated client Client injects fake content into the flow of data Data from FlowsFrom to FlowsTo between Client and Service: if an attacker can compromise or impersonate client Client, they can inject fake data in messages to Service.

DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

DF.Auth.AC-iDF-VSC.3.2

Imposter posing as Service injects false content into the flow of data Data from FlowsFrom to FlowsTo between Service and Client: if an attacker can impersonate service Service, they can inject false data in messages to Client.

DF.Auth.CCCSDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Service: if client Client does not send data Data to its service Service, it is still possible to inject false content into the data flow via service Service using a confused deputy attack. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).

DF.Auth.CCCSPDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not send data Data via its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.

DF.C.ACDF-VCS-i.3.1

Compromised service Service reads the flow of data Data from FlowsFrom to FlowsTo sent from Client: if an attacker can compromise or impersonate service Service, they can read data in messages from Client.

DF.C.ACDF-VFS-i.3.6

Encrypted flow of data Data from FlowsFrom leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can access its cryptographic key to decrypt data and accept a request for it from a false client acting as Client.

DF.C.ACDFVFS-i.3.6

DF.C.ACDF-VSC-i.3.2

Flow of data Data from FlowsFrom to FlowsTo leaked to false client of compromised service Service: if service Service is compromised by an attacker, they can allow a false client to request data by acting as Client.

DF.C.ACDF-VTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.

DF.C.ACDFVTS-i.3.6

DF.C.AC-iDF-VCS.3.2

Imposter posing as service Service intercepts flow of Data from FlowsFrom and FlowsTo sent by Client: if an attacker can impersonate service Service, they can intercept content in the flow of data Data between FlowsFrom and FlowsTo via the service and its client Client.

DF.C.AC-iDF-VCS.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Client and Service: if communications between Client and Service are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.

DF.C.AC-iDF-VSC.3.2

Compromised or impersonated client Client reads data Data flowing from FlowsFrom to FlowsTo when sent from Service: if an attacker can compromise or impersonate Client, they can read Data sent by FlowsFrom to FlowsTo in messages from Service.

DF.C.AC-iDF-VSC.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Service and Client: if communications between Service and Client are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.

DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.

DF.C.AC-iDF-VTC.3.6

DF.C.CCCSCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Service: if service Service does not send data Data to its client Client , it is still possible for the client to request the data flow using a confused deputy attack against Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).

DF.C.CCCSPCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not receive data Data from its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.

DF.IS.CCSmDFS.8

Exchange of data is possible between Client and Service is possible: if the client-service relationship of Client with Service is in service, they can exchange data. This does not necessarily mean data is exchanged, only that the exchange is possible.

DF.IS.PDFFA.8

Flow of Data from FlowsFrom to FlowsTo is in service: if process FlowsFrom is in service and able to access the data, and all the steps in the chain of processes between FlowsFrom and FlowsTo are in service, then the flow of Data from FlowsFrom to FlowsTo will be in service and potentially subject to attack, unless disabled.

DF.O.CCDFSFC.3

Compromised client Client sends excessive data Data to/via Service: if Client is the source of a flow of data Data which is sent to or via service Service, then if an attacker or malicious user can access Service as Client, they can send too much data, aiming to overload the data flow destination FlowsTo.

DF.O.CCDFSTC.3

Compromised client Client requests excessive data Data from/via Service: if Client is the destination of a flow of data Data which is sent from or via service Service, then if an attacker or malicious user can access Service as Client, they can request too much data, aiming to overload the data flow source FlowsFrom.

DF.O.CCDS2FC.0

Excessive flow of data Data via Client propagates via Service: if the flow of data Data from Client to Service is excessive, then Service will forward the excessive flow to StepTo.

DF.O.CCDS2TC.0

Excessive demand for data Data via Client propagates via Service: if the flow of data Data requested by Client from Service is excessive, then Service will forward the request for an excessive amount of data to StepFrom.

DS.A.CDBSCDSF.4

Malicious query from Client via database Service deletes data Data: an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data could be expected to come via Client, so the attack cannot be prevented using database access controls at Service.

DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.

DS.C.CDBSC-DST.4

Malicious query from Client via database Service leaks data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to retrieve data Data. In this scenario, a selection query for Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.C.HPsACrDSCCV.1

I.A.HLSISC.6.4

Authentication failure for device CHost at Service prevents connection to LogicalSubnet: the device CHost cannot connect to LogicalSubnet because it cannot authenticate with the authenticator service Service controlling access to the network.

I.TA.I.8.1

Access to services on Host from LogicalSubnet enabled by default: if the interface between Host and LogicalSubnet is in service and connections to Host via this interface are allowed by default, then so are connections to services running on Host.

I.TA.I.8.2

Access to services on Host from LogicalSubnet enabled by exception: if the interface between Host and LogicalSubnet is in service, then even if connections to Host via that interface are blocked by default, connections to services running on Host will be allowed unless explicitly disabled.

LS.L.HLSISC.1

Access to LogicalSubnet as CHost via EAP authenticator process Service: an attacker who can authenticate with process Service can connect to subnet LogicalSubnet.

P.A.HuirRACSPH.0

Loss of connectivity from Client to Service affects Process: because user Human interacts with Process via remote access client Client and the shell on SHost, if Client cannot connect to remote access service Service on SHost, Human will be unable to interact with Process which will be rendered non-operational.

P.E.HuiSP.9

Reverse proxy Proxy should not have interactive user Human: a reverse proxy is an automated process driven by service requests, and should not have an interactive user.

P.E.LnSc-uP.9

Remote access service LoginService cannot control process Process: A remote access service like LoginService allows users to access the shell on its host. It therefore cannot control access to other processes via some token exchange authentication and authorization workflow unless Process is a reverse proxy that simply forwards client requests to LoginService. The current arrangement is therefore an error. If Process is meant to be a reverse proxy, add a 'uses' relationship from Process to LoginService. If instead users are supposed to use LoginService to log into its host and run Process there, replace the 'controls' relationship by the 'uses' relationship. If Process runs on a different host, then a separate client process will need to be added.

P.E.LnSucP-pS.9

Remote access service LoginService cannot use and be controlled by Process: this arrangement normally implies that a client is using forwarded credentials to access a service. Since LoginService runs Process as a shell command, this makes no sense, unless Process needs credentials from the remote client of LoginService to access some other service. However, in this case there is no such other service.

P.E.PcHpmS.9

Service Process cannot control access to host Host: process Process cannot control access to a host because Process shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access host Host. The knowledge base does not support this arrangement.

P.E.PcLSpmS.9

Service Process cannot control access to network LogicalSubnet: process Process cannot control access to a network because Process shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access network LogicalSubnet. The knowledge base does not support this arrangement.

P.E.Pc-pPpmS.9

Service Proxy cannot control access to service Process: process Proxy cannot control access to a service because Proxy shares or forwards credentials from its clients. It is not enforcing access control decisions itself but leaving them to Service. It has no direct trust relationship with clients, so cannot authenticate users wishing to access service Process. The knowledge base does not support this arrangement.

P.E.Pc-uCucmS.9

Process Client cannot be controlled by service Process: Client forwards credentials from its clients, leaving access control decisions to back-end services Service. It cannot also delegate those decisions to another process Process. The knowledge base does not support this arrangement.

P.E.Pu-pPucmS.9

Process Client must forward credentials to service Process: process Client forwards credentials from its clients, leaving access control decisions to back-end services Service. It cannot also use service Process under its own credentials, unless as an authorization service. Each client must either forward credentials or operate using its own credentials. The knowledge base does not support a mixed-mode arrangement.

P.E.RTuP-hCLI.9

Remote terminal RemoteTerminal cannot be used to access process Process: since Process may be a graphical process with no command line interface, it cannot be used by logging into its host Host using a simple terminal. If the link from RemoteTerminal and Process is correct, then either Process must be a more restricted process subclass, or RemoteTerminal must be a Remote Desktop client.

P.E.RTurP-hCLI.9

P.L.CCCLnSAC.1

Compromise or impersonation of Client allows access to SHost via Service: if anyone can access Service as Client, then because Service is a remote access service, they can access SHost.

P.L.CCCSAC.3

Remote control of Service using a back door from Client: if a back door has previously been installed in service Service, an attacker with control of client Client can exploit the back door to gain access to the rights of Service on its host SHost.

P.L.CSAPNaS.3

Remote control of service Service using a back door from LogicalSubnet: an attacker with access to LogicalSubnet can exploit a privileged network path to Service via that subnet, and use a previously installed back door to take control of the service, gaining access to the rights of Service on SHost.

P.L.HuHW2ACE.3

Execution of malicious email attachment at WebBrowser on Host in Space: user Human runs a malicious file sent as an email attachment via MUA, allowing the attacker to exploit the privileges of their browser WebBrowser on device Host using network connections it has from location Space.

P.L.OSAPNaS.3

P.L.SPNaLnS.1

Remote access to login service Service via reverse proxy Client: a malicious user or an attacker who can authenticate with reverse proxy Client can send messages via Client to a back-end login service Service, gaining access to its rights on device SHost.

P.L.SPNaS.3

Remote control of process Service using a back door via proxy Client: a malicious user or an attacker who can send messages via reverse proxy Client to a back-end service Service could access a back door if previously installed in the software, and gain control of Service including its access to its rights on device SHost.

P.O.CCDFSFS.0

Excessive demand of data Data requested via Client overloads Service: if a request for an excessive amount of data Data reaches the data source Service, it may overload Service.

P.O.CCDFSTS.0

Excessive flow of data Data via Client overloads Service: if the flow of data Data reaching Service via Client is excessive, it may overload Service.

P.O.DDoS.3

Distributed DoS attack on service Process from subnet LogicalSubnet: an attacker with control over multiple vulnerable systems connected to LogicalSubnet can use them to send excessive messages via a privileged network paths through firewalls and overload service Process. The best defence is to arrange with your ISP to manage and restrict the traffic sent from the Internet (check threat causes for an unrestricted network interface).

P.O.DoS.3

DoS attack on service Process from subnet LogicalSubnet: an attacker with access to LogicalSubnetcan exploit a privileged network path through firewalls allowing access to service Process, sending too many messages and overloading Process. The best defence is to manage and restrict the traffic sent to the service at one of the inbound network interfaces (check threat causes for unrestricted network interfaces).

P.O.PILSsSC.0

Service Service running on host SHost overloaded by messages from LogicalSubnet: if the interface between SHost and LogicalSubnet is overloaded, and service Service is listening for client messages on that interface, then the overload also affects Service.

SAP.IS.CAPSAP.8

Privileged network paths to reach service Process from Client via LogicalSubnet are open: messages can be sent from LogicalSubnet to Process thanks to firewall policy exceptions created to allow access by Client, which may be exploited by an attacker.

SC.A.CCCmSCS.0

Client Client cannot access unavailable service Service: loss of availability in the service Service makes the connection from Client unavailable on all channels.

SC.A.CCfImSC.0

Connection from CHost to LogicalSubnet affects communication between Client and Service: if the connection of device CHost running Client and subnet LogicalSubnet is not available, this will affect the communication channel between client Client and service Service.

SC.A.CCtImSC.0

Connection from SHost to LogicalSubnet affects communication between Client and Service: if the connection of device SHost running Service and subnet LogicalSubnet is not available, this will affect the ccommunication hannel between client Client and service Service.

SC.A.HuSC.6.3

Suspended insecure path from Client to Service affects availability: firewall rules allowing access by Client to service Service via a network path may be suspended where communication on that path is exposed to snooping. However, this means the availability of Client-Service connections using this network path will be reduced if its communication security is under threat.

SC.A.LSmSC.0

Unavailable subnet LogicalSubnet affects client-service communication: if subnet LogicalSubnet is not available, it will interrupt client-service communications via that subnet.

SC.A.SC.6.1

Disabled channel from Client to Service is not available: if the firewall rules allowing access by client Client to service Service have been disabled, then Client will not be able to access Service via that channel.

SC.A.SgmSC.0

Unavailable route at gateway Gateway affects client-service communication: if the route via Gateway from FromSubnet to ToSubnet is not available, it will interrupt client-service communications that depends on this route.

SC.C.ImSCf.3

Snooping client-service communications by spoofing subnet LogicalSubnet to Host: if an attacker can spoof physical network LogicalSubnet to Host, they can intercept client-service communications sent via LogicalSubnet from Host.

SC.C.LSmSC.3

Snooping client-service communications in subnet LogicalSubnet: If an attacker has access to messages crossing subnet LogicalSubnet, they can intercept client-service communications that follow a network path via that subnet.

SC.C.SgACmSC.3

Client-service snooping at gateway Gateway betweenFromSubnet and ToSubnet: if an attacker has control of physical host Gateway in location Space where it is used to support client-service communication between FromSubnet and ToSubnet, then the attacker can snoop on those communications using that route through Gateway.

SC.IS.SCmSg.8.1

Privileged channel between Client and Service in service: if all routes via gateways plus the final interface to the service host are enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.

SC.IS.SCpSg.8.1

Privileged channel between Client and Service in service: if access to Service from LogicalSubnet is enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.

Sg.TA.L3SSg2+b.8.2

Port forwarding from FromSubnet to ToSubnet via Gateway is enabled: if the route from public subnet FromSubnet to private subnet ToSubnet via a NAT gateway host Gateway is in service, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.

Sg.TA.L3SSg2-b.8.1

Service connections from FromSubnet to ToSubnet via Gateway allowed by default: if the route via Gateway from FromSubnet to ToSubnet is not blocked, then service connections cannot be blocked.

Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

ClientImpersonation	The authentication credentials of a client accessing a service are no longer secure and reliable, i.e. the client could can be impersonated to the service. This does not necessarily mean an attacker can access the service, only that they have access to client credentials.
DeputyConfusion	The client is influenced by a malicious actor who is able to induce the client to send malicious requests to its service.
LossOfAccessibility	Referring to a client-service relationship, representing inability of the client to authenticate with the service.
LossOfAnonUserTW	Untrustworthy users are able to send messages to a service from the direction of a specific client. This relates to any message so it includes messages sent anonymously, prior to authentication. It is not related to which users can access the service. Consequently, a high likelihood is not in itself a cause for concern, so the impact level should never be raised for this behaviour.
LossOfClientTW	A malicious actor is able to access the related service and authenticate as the related client. This means the attacker is able to send requests to the service, and either the attacker has access to client credentials or the service fails to authenticate before allowing access.
LossOfConnectivity	There is a loss of connectivity between processes.
LossOfProxyUserTW	A malicious actor is able to send messages via a reverse proxy to a related service. The service is exposed to malicious requests, but not directly from an attacker.
LossOfServiceTW	The service accessed by a client is controlled by a malicious actor, usually (but not always) caused by the service being hacked by an external attacker.
ServiceChannelsAllowed	Applies to a communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets. Signifies that exceptions do exist allowing client-service connections and communications to tunnel through a default deny routing policy.
ServiceImpersonation	The service accessed by a client is an imposter.

CSG-ApplicationFirewall	An application firewall is used at *Proxy* to protect *Process* from remote vulnerability exploits.
CSG-ClientAddressWhitelisting	The service *Service* has a whitelist of network addresses from which it accepts client requests, and all the network interfaces from which requests may come have addresses that are fixed or in a restricted range not available to attackers.
CSG-DisableClientAccess	Access to service *Service* by client *Client* is disabled. This control strategy represents a permanent restriction introduced by design, or a temporary situation created following activation of a contingency plan. In the latter case, this control strategy should not itself be selected, because its controls will be fulfilled by the contingency plan activation strategy.
CSG-DisableServiceAccess-Runtime	Apply a default firewall rule at host *Host* to drop messages sent to services running on the host from subnet *LogicalSubnet. This strategy may represent a run-time adaptation in response to a threat, or a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction, which affect access to services running on Host* but not other uses of its connection to *LogicalSubnet*.
CSG-DisableServiceChannel	Firewall rules that normally allow access to service *Service* by clients on otherwise blocked network paths are switched off. This strategy represents a permanent restriction introduced by design or in accordance with an operational policy or user preference to avoid accessing *Service* over certain networks. It may also arise as a side effect of a run-time response to a more specific threat. In either case, it triggers threats representing side effects that would be caused by such a restriction where they affect all available network paths used by a client.
CSG-DisableServiceChannel-Runtime	Firewall rules that normally allow access to service *Service* by clients on otherwise blocked network paths are switched off to prevent an attack. This strategy may represent a run-time adaptation in response to a threat, or a permanent restriction introduced by design or in accordance with an operational policy or user preference to avoid accessing *Service* over certain networks. It also triggers threats representing side effects that would be caused by such a restriction where they affect all available network paths used by a client.
CSG-IgnoreConfusedDeputyAttack	Signifies that *Service* can be considered immune to a confused deputy attack that does not involve exploitation of a software vulnerability. This should be used when *Service* is programmed in such a way that it can only access a back-end service for specific clients. Do not use this if access to back-end services require OIDC- or OAuth-style tokens issued to the client - in that case add the OIDC/OAuth service along with the appropriate relationships from the client and to the back-end service(s).
CSG-SuspendExcessiveClientAccess	Change from: Access to service *Service* by client *Client* may be temporarily disabled by the process manager *ServiceManager* to prevent the service forwarding excessive requests or becoming overloaded itself, at the cost of some reduction in availability. This strategy represents a contingency plan, which can be used to reduce risk from some threats. However, it also triggers other threats representing side effects of the policy change, based on how likely it is that the contingency plan will need to be activated.
CSG-SuspendExcessiveClientAccess-Implementation-Runtime	Access to service *Service* by client *Client* is disabled by the process manager *ServiceManager* to prevent the service forwarding excessive requests or becoming overloaded itself. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal the process manager *ServiceManager. The Disable Client Access control should be deselected if and when access by Client* to *Service* has been enabled once again.
CSG-SuspendInsecureServiceChannel	Firewall rules that normally allow access from client *Client* to service *Service* may be temporarily switched off by manager *HostManager* of the service host *SHost* if the network path is subject to snooping. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendInsecureServiceChannel-Implementation-Runtime	Firewall rules that normally allow access from client *Client* to service *Service* have been switched off by manager *HostManager* of the service host *SHost* to prevent snooping. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, user *HostManager* who is responsible for managing *SHost* should arrange for firewall policies to be switched off. The Disable Service Channel control should be deselected only when access is enabled again.
CSG-SuspendInsecureServiceChannel-Trigger	Firewall rules that normally allow access from client *Client* to service *Service* may be temporarily switched off by manager *HostManager* of the service host *SHost* if the network path is subject to snooping. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendUnauthenticClientAccess	Access to service *Service* by client *Client* may be temporarily disabled by its manager *ServiceManager* to prevent authenticated attacks by impersonated clients, at the cost of some reduction in availability. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendUnauthenticClientAccess-Implementation-Runtime	Access to service *Service* by client *Client* is disabled by the process manager *ServiceManager* to prevent authenticated attacks by impersonated clients. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal the process manager *ServiceManager. The Disable Client Access control should be deselected if and when access by Client* to *Service* has been enabled once again.
CSG-SuspendUntrustworthyClientAccess	Access to service *Service* by client *Client* may be temporarily disabled by the process manager *ServiceManager* to prevent authenticated attacks by compromised or impersonated clients, at the cost of some reduction in availability. This strategy represents a contingency plan, which can be used to reduce risk from some threats. However, it also triggers other threats representing side effects of the policy change, based on how likely it is that the contingency plan will need to be activated.
CSG-SuspendUntrustworthyClientAccess-Implementation-Runtime	Access to service *Service* by client *Client* is disabled by the process manager *ServiceManager* to prevent authenticated attacks by compromised clients. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal the process manager *ServiceManager. The Disable Client Access control should be deselected if and when access by Client* to *Service* has been enabled once again.
CSG-SuspendVulnerableServiceChannel	Firewall rules that normally allow access to service *Service* on specific network path(s) may be temporarily switched off by its host manager *HostManager*. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.
CSG-SuspendVulnerableServiceChannel-Implementation-Runtime	Firewall rules that normally allow access to service *Service* on specific network path(s) have been switched off by its host manager *HostManager. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, user HostManager* who is responsible for managing host *SHost* should arrange for firewall policies to be switched off, ideally as close as possible to subnet *LogicalSubnet* from where the risk arises.The Disable Service Channel control should be deselected only when access is enabled again.
CSG-SuspendVulnerableServiceChannel-Trigger	Firewall rules that normally allow access to service *Service* on specific network path(s) may be temporarily switched off by its host manager *HostManager*. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it also triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.

AddressWhitelisting	Applies to a client-service relationship, and means the service accepts client connections only from a set of known network addresses.
ApplicationFW	A filter that scans the content of requests to a service, and refuses to forward any request in which malicious content is detected.
ClearDeputy	Artificial control used to specify when a Process acting as a service is immune to a confused deputy attack except by exploitation of a vulnerability.
DisableClientAccess	Signifies that access to a service in a specific client role is disabled, i.e. the policy allowing access to a service in a specific client role has been switched off. This may represent a permanent restriction introduced by design, or a temporary situation created by a run-time response to an increased risk level. Either way, it causes a loss of availability as a side effect.
DisableServiceChannel	Signifies that a service channel (i.e. a tunnel through firewall controls) which is assumed to be in place for expected client-service connections is disabled. This is not a contingency plan but a restriction introduced by design, or as a run-time threat response.
SuspendExcessiveClientAccess	Change from: Signifies that access to a service in a specific client role may be temporarily disabled if the client is compromised, i.e. the policy allowing access to a service in that client role may be dynamically switched on or off. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack. This control governs access rights for a specific client to a specific service, and so applies to the inferred Client-Service Relationship asset representing their mutual trust.
SuspendInsecureServiceChannel	Applies to an inferred Service Channel asset representing the privileged path from client to service. Signifies that the service channel may be temporarily disabled, i.e. policy exceptions allowing client-service messages to pass through default firewall rules are switched off. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.
SuspendUnauthenticClientAccess	Signifies that access to a service in a specific client role may be temporarily disabled if their means of authentication is compromised, i.e. the policy allowing access to a service in that client role may be dynamically switched on or off. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack. This control governs access rights for a specific client to a specific service, and so applies to the inferred Client-Service Relationship asset representing their mutual trust.
SuspendUntrustworthyClientAccess	Signifies that access to a service in a specific client role may be temporarily disabled if the client is compromised, i.e. the policy allowing access to a service in that client role may be dynamically switched on or off. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack. This control governs access rights for a specific client to a specific service, and so applies to the inferred Client-Service Relationship asset representing their mutual trust.
SuspendVulnerableServiceChannel	Applies to an inferred Service Channel asset representing the privileged path from client to service. Signifies that the service channel may be temporarily disabled, i.e. policy exceptions allowing client-service messages to pass through default firewall rules are switched off. This represents a contingency plan which will compromise availability, to an extent based on the likelihood of the attack.

Role_AttackPath	A privileged path through the network to a service from a subnet accessible by attackers .
Role_AuthChannel	A trust relationship between a client and a service that relates to the use of that service to authenticate the client and/or verify their access rights.
Role_AuthZChannel	A trust relationship between a client and a service that relates to the use of that service to verify third party access rights.
Role_BasePath	A network path that provides a basis for attacks on services via NAT devices.
Role_ClientAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages would be addressed in a way that is consistent with a specific client.
Role_ClientChannel	A trust relationship between a client and a service.
Role_ClientPath	A network path to a service from a subnet through which messages from a specific client would pass.
Role_ClosedClientAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages are rewritten by a NAT gateway in a way that is consistent with a specific client.
Role_ClosedServiceAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages are rewritten by a NAT gateway in a way that is consistent with at least one client.
Role_DHost	The host of a service. This role name is chosen so alphanumeric sorting puts it between client-related roles and the network path used by those clients to communicate with the service.
Role_DService	A process acting as a service. This role name is chosen so alphanumeric sorting puts it between client-related roles and the network path used by those clients to communicate with the service.
Role_EntrySubnet	A subnet on a path between client and service where messages from an attacker could join that path and benefit from newtork address translation en route to the service.
Role_FirstChannel	A client service trust relationship in a chain between a client and a service via a reverse proxy.
Role_IndirectChannel	A client service trust relationship between a client and a service that communicate indirectly.
Role_LastChannel	A client service trust relationship in a chain between a client and a service via a reverse proxy.
Role_LastSubnet	Refers to a pre-existing subnet, which (if present) changes the significance of assets matching other roles in the same pattern.
Role_OpenClientAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages are addressed in a way that is consistent with a specific client, and are not rewritten by a NAT gateway.
Role_OpenServiceAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages are addressed in a way that is consistent with at least one client, and are not rewritten by a NAT gateway.
Role_Proxy	A process acting as a reverse proxy, relating requests between a client and a service.
Role_ProxyChannel	A client-service trust relationship existing between a client or service and an intervening reverse proxy.
Role_ProxyClient	A process acting as a client to a reverse proxy.
Role_ServiceAttackPath	A privileged path through the network to a service from a subnet accessible by attackers whose messages would be addressed in a way that is consistent with at least one client.
Role_ServiceChannel	A privileged communication path through the network between a client and a service.
Role_VaultChannel	A client channel representing the relationship between a process and a key vault holding keys used by the process to access data.

AttackPath	Base class for all attack paths.
AuthChannel	Represents a trust relationship between a Client and a Service. Exists where the two exchange authorization tokens but not necessarily other credentials.
ClientAttackPath	Base class for all attack paths related to a specific client.
ClientChannel	Represents a trust relationship between a Client and a Service. Exists where the two communicate directly, or where the Service may need to know the identity of the Client.
ClientPath	Represents a path to a service from a logical subnet that is on a path from a specific legitimate client.
ClosedClientAttackPath	Path to a service from a subnet from which a message can be sent to the service that (due to network address translation) would appear to come from a source address that is indistinguishable from a specific legitimate client.
ClosedServiceAttackPath	Path to a service from a subnet from which a message can be sent to the service that (due to network address translation) would appear to come from a source address that is indistinguishable from at least one legitimate client.
ConnectionAsset	Base class for assets representing process-process relationships, privileged communication channels, and opportunities for attacks using those channels.
ConnectionChannel	Base class for client-service connection assets.
ConnectionPath	Base class for paths linked to logical subnets through which client-service connection requests are made.
OpenClientAttackPath	Path to a service from a subnet which is on a path from a legitimate client, so messages sent from this subnet can reach the service, even if default firewall rules could normally prevent it.
OpenServiceAttackPath	Path to a service from a subnet which is on a path from at least one legitimate client, so messages sent from this subnet can reach the service, even if default firewall rules could normally prevent it.
ServiceAttackPath	Base class for all attack paths not related to a specific client.
ServiceChannel	Represents a communication path through the network between a Client and a Service. This channel is privileged, in the sense that where default firewall rules would block connections from the Client to the Service, they are enabled by an exception to the default rules.
ServiceProxy	A simple reverse proxy process that provides a proxy endpoint for some other, usually HTTP(S) service.

AnonUserTW	Only trustworthy users can send messages to a service from the direction of a specific client. This relates to any message so it includes messages sent anonymously, prior to authentication. It is not related to which users can access the service. Consequently, the calculated level will often be low, and this is not necessarily a cause for concern.
ClientAuthenticity	The client accessing the related service has a reliable means of authentication which can be verified by the service. This is not related to the trustworthiness of those able to access the service, only the trustworthiness of those in possession of client credentials.
ClientTW	The client accessing the related service is not controlled by an untrustworthy actor. This pertains to the trustworthiness of those able to access the service as the client (i.e., after authentication).
DeputyUserTW	The client is clear on what requests it should send to the service on behalf of its own clients.
ProxyUserTW	Only trustworthy clients can send requests via the client (which is a reverse proxy) to the related service.
ServiceAuthenticity	The service accessed by a client is not an imposter.
ServiceChannelsBlocked	Applies to a communication route, i.e. the Interface between a Host and a Subnet, or a Logical Segment representing a route between two Subnets. Signifies that no exceptions were created to allow client-service connections and messages to tunnel through a default deny routing policy.
ServiceTW	The service accessed by a client is not controlled by a malicious actor.