Threat DF.A.HPDSDADF.0

URI: DF.A.HPDSDADF.0

Package: DataLifecycle

< prev | next >

Description: Service Process cannot serve unavailable data Data to FlowsTo: the locally stored copy of Data on Host used by Process is not available, so cannot be sent in a data flow to FlowsTo.

Threat Type: Secondary Threat

Matching Pattern:

DF.A.HPDSDADF.0
MP-HPDSDADF

Finds a Host storing a Data Copy that is read and sent in a data flow by a Process on the same Host, plus optionally the Host and Process managers.

DF.A.HPDSDADF.0
DS.A.HDS.7

Infected host Host encrypts or deletes data Data: an attacker having infected device Host with malware exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.
DF.A.HPDSDADF.0
DS.A.HPDAcDS.0

Unavailable process Process cannot create stored copy of Data on Host: if process Process is not available, then it cannot create a local stored copy of Data on Host, so that copy will not be available.
DF.A.HPDSDADF.0
DS.A.HPDOcDS-V.6

Process Process cannot create encrypted data Data: if the local copy of Data is encrypted, then process Process that creates the data will be unable to store that copy unless it has a key or can produce the data in the encrypted domain.
DF.A.HPDSDADF.0
DS.A.HPmDFDAcDS.0

Data Data cannot be stored on Host by Process due to lack of incoming data flows: service Process manages storage of data Data, but if no flows of Data to Process are available, it cannot save a copy of Data on its host Host, which will therefore be unavailable.
DF.A.HPDSDADF.0
DS.A.HPmDFDAcDS-k.6

Decrypted data Data cannot be stored on Host by Process: service Process manages storage of an encrypted copy of data Data, so if all flows of Data to Process are decrypted the stored copy cannot be created unless Process has an encryption key.
DF.A.HPDSDADF.0
DS.A.HPmDF-kDAcDS.6

Encrypted data Data cannot be stored on Host by Process: service Process manages storage of an unencrypted copy of data Data, so if all flows of Data to Process are encrypted the stored copy cannot be created unless Process has a decryption key.
DF.A.HPDSDADF.0
DS.A.HPsACDAdDS.1

Use of Process to prevent access to Data: someone with the rights of Process on its host device Host can exploit the rights of Process to delete the locally stored copy of Data.
DF.A.HPDSDADF.0
DS.A.HPsACDAdDS.7

Infected process Process encrypts or deletes data Data: the process having become infected by malware is able to delete or otherwise disable access to the stored copy of Data on its host device Host.
DF.A.HPDSDADF.0
DS.A.HPsACDOdDS-V.6

Process Process cannot create decrypted output data Data: if the local copy of Data is sypposed to be decrypted, then process Process creating the data in the encrypted domain will be unable to store the output.
DF.A.HPDSDADF.0
DS.A.HsACDS.1.2

Use of admin privileges at Host to control availability of Data: anyone with admin rights at Host can delete or otherwise prevent access to copies of Data stored on the Host.
DF.A.HPDSDADF.0
DS.A.HsACDS.1.3

Use of user privileges at Host to control availability of Data: anyone with user privileges at Host can delete or otherwise prevent access to copies of Data stored on the Host.
DF.A.HPDSDADF.0
DS.A.PHHDS.3

Stored copy of Data on AHost lost due to theft or destruction of Host in Space : an attacker with access to Space can physically steal or destroy device Host, removing it from the system, rendering data stored on AHost unavailable. The threat to data is distinct from the threat to the host, as Host could be replaced if the loss is detected, but that would not restore the lost copy of Data.
DF.A.HPDSDADF.0
DS.A.CDBSCDSF.4

Malicious query from Client via database Service deletes data Data: an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data could be expected to come via Client, so the attack cannot be prevented using database access controls at Service.
DF.A.HPDSDADF.0
DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.
DF.A.HPDSDADF.0
DS.A.HDS.4

Attacker exploit at Host deletes Data: the attacker exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.
DF.A.HPDSDADF.0
DS.A.HPsACDAdDS.4

Attacker exploit at Process to delete Data: the attacker exploits a vulnerability in process Process and is able to delete or otherwise disable access to the stored copy of Data on its host device Host.

        (empty)

        (empty)