Package Users

Being undermined in a way that causes a lapse in judgement regarding security risks in a Human, leaving them more open to being deceived into taking inappropriate actions.

The asset cannot (or will not) carry out its function within the system, failing to interact with other assets as expected.

Effect of external influences on a Human that introduce or foster motives or desires to cause adverse effects.

Erosion of competence in a Human, caused by changes in themselves, their role or the technology they use to carry out that role within the system.

The device, process or human is liable to make errors with an unacceptable frequency or extent. Caused by internal failings including lack of expertise, software bugs, etc., by using forged, corrupt or inaccurate information as input, or by a dependency on some other asset that is not reliable.

The Stakeholder (usually a Human) is no longer willing to fulfil their role in the system. NOT YET USED IN ANY THREAT.

The employer Employer has multiple employees able to fulfil the role Human.

Persons fulfilling the role Human are screened by their employer Employer before being given that role. This ensures they are more trustworthy than one would expect given the population or community they come from.

The human has a registered their biometric information for identification purposes.

The human has a registered chip and pin card for identification purposes.

Represents a state after manual intervention by a human to address a problem. Used in control strategies for predicting the effects of such intervention prior to alerting the human. Should be deselected once this has been determined.

A human has skills or expertise to prevent a threat, either by intervening in response to the threat, or by implementing a policy or preference that means the threat cannot occur.

The human has obtained documentation to prove their identity from a trusted source (e.g. an employer or a national authority).

The human role is staffed by individuals who have undergone a screening process to ensure they are more trustworthy than the population or community to which they belong.

The legal entity has a process for screening employees before assigning them to specific roles.

The organisation has team leadership capabilities, allowing management of teams of employees that fulfil system roles.

The role fulfiled by a Human can be handled by multiple individuals in a team, so if one Human is unable to carry out that role, it can be fulfilled by someone else.

A human who is not a Child.

A Human who is not an Adult.

A stakeholder that employs one or more individuals to act in one or more system roles.

A user role fulfilled by a human.

A user role fulfilled by a human.

A user role fulfilled by a human.

A stakeholder role fulfilled by an organisation, e.g. a company or a team.

A stakeholder role fulfilled by an human or an organisation.

A Human who is legally competent to give their consent for any process resulting from their participation in an IT based system.

A Human who is below the applicable age of consent for participation in an IT-based system.

An individual user role within the socio-technical system that uses and/or manages assets.

A group working together in pursuit of goals, which may or may not be shared by all the individuals participating in the group. An organisation need not be a legal entity with similar legal status to an individual (e.g. a limited company, charity or government department), as it may represent a loose federation or social group. If your organisation is a legal entity, make it a Legal Organisation instead.

Represents an entity with motives for engaging in the modelled system. Note that systems are modelled as socio-cyber-physical systems, so users and various organisational actors are considered part of a system they are using.

The ability to detect attempts by other agents to induce inappropriate action through deception.

The asset is able to carry out its function within the system, including being accessible by other assets that need to interact with it.

Free of malicious motives or desires to cause adverse effects without external provocation.

Ability to carry out reliably the functions of a user role within the system.

Means the asset will perform tasks correctly, with no functional errors, assuming the asset is not supplied with corrupt or inaccurate information as input (in the case of Human or Process assets).

Propensity of a Stakeholder (usually a Human) to engage with and fulfil their role in a system.