Trustworthiness Attribute Control

URI: Control

Description: Trustworthiness of the actor or process managing a host (including control over access to the host) while it is connected to the system and fulfilling its system role (i.e. in some context).

This attribute is undermined by the misbehaviour LocalLossOfControl

AccessContext	Model of access rights, restricted to specific contexts.
Host	A device that can store, process, transmit or receive data.

DS.A.HsACDS.1.2

Use of admin privileges at Host to control availability of Data: anyone with admin rights at Host can delete or otherwise prevent access to copies of Data stored on the Host.

DS.Auth.HsACDS-V.1.2

Use of admin privileges at Host to alter Data stored on Host: anyone with admin rights at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.

DS.C.HsACDS-V.1.2

Use of admin privileges at Host to access stored data Data: anyone with admin rights at Host can read (unencrypted) copies of Data stored on the Host.

Sg.DA.L1SSg2AC.1

Mesh routing between FromHost and ToHost not disabled at reenabled at Gateway: if an attacker has admin rights on host Gateway, they can override a policy not to enable mesh routing between paired hosts.

Sg.TA.LTethSg2AC.1

Tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is paired with Host and connected to LogicalSubnet, then they can tether Gateway and connect Host to LogicalSubnet.

Sg.TA.LTRevSg2AC.1

Reverse tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is connected to LogicalSubnet and Host is paired with it, then they can reverse tether Host and connect Host to LogicalSubnet.

H.A.HsAC.1.2

Use of privilege to control Host availability: an attacker who has gained admin rights for a device Host can crash or deny access to it. For mobile hosts, we assume the host can be permanently locked down, so access in any context is sufficient, causing loss of availablity unless independent instances of class Host are available.

H.L.SHAC.1

Use of admin privilege to control access to Host when in Space: someone with admin rights at device Host when in location Space can control user level access to the device in that context.

H.M.HmAC.1.2

Root access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has admin rights on Host, it must be assumed they could exploit those rights in any context.

LS.A.HprLSAC.1.2

Provisioning of LogicalSubnet prevented at Gateway: someone with admin rights for device Gateway can prevent access to subnet LogicalSubnet provided by Gateway, unless other independent instances are available.

LS.IS.HprLSAC.1

Provision of subnet LogicalSubnet by Gateway not disabled: if an attacker has admin rights on host Gateway, they can override a policy to disable provision by Gateway of network LogicalSubnet.

LS.L.RSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing radio subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device wirelessly to the subnet.

LS.L.WSSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from Space: if someone has control of device Gateway providing wired subnet LogicalSubnet, and physical access to location Space where LogicalSubnet is accessible, they can connect their own device to the subnet.

LS.M.HprL3SAC.1

Use of admin privilege at Gateway to control LogicalSubnet: someone with admin rights at device Gateway can control the subnet LogicalSubnet provided by device Gateway.

P.A.HsACP.1.2

Use of rights at Host to control availability of Process : anyone with admin rights on device Host can shut down process Process. For mobile hosts, we assume the process can be permanently disabled, so access in any context is sufficient, causing Process to become unavailable in any context unless there are instances running on independent instances of class Host.

P.L.SHACPmAC.1

Use of admin privilege at Host via Space to control Process: someone with admin rights at device Host in location Space can control process Process hosted by that device in that context.

I.IS.INC.1

Access from Host to LogicalSubnet not disabled: if an attacker has admin rights on device Host when in range of LogicalSubnet, they can override a policy to avoid connecting to subnet LogicalSubnet.

Sg.DA.L3SSg2AC-b.1

Routing between FromSubnet and ToSubnet re-disabled at Gateway: if an attacker has admin rights on host Gateway in a context where it is connected to FromSubnet and ToSubnet, then they can override a default policy to drop connection being routed between those subnets.

CC.AuS.CRoSG.3

Spoofing of service Service to Client at gateway Gateway in Space: an attacker in control of gateway device Gateway in location Space where it handles messages sent from Client to Service, the attacker can divert these messages via a fake version of the service under their control.

SC.C.SgACmSC.3

Client-service snooping at gateway Gateway betweenFromSubnet and ToSubnet: if an attacker has control of physical host Gateway in location Space where it is used to support client-service communication between FromSubnet and ToSubnet, then the attacker can snoop on those communications using that route through Gateway.

Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.

HC.C.INCmHCf.3

Snooping virtual network comms from host Host via LogicalSubnet: if an attacker has control of physical host Host when it is connected to LogicalSubnet, they can snoop virtual communications sent from Host over LogicalSubnet.

HC.C.INCmHCt.3

Snooping virtual network comms to host Host via LogicalSubnet: if an attacker has control of physical host Host when it is connected to LogicalSubnet, they can snoop virtual communications sent to Host via LogicalSubnet.

HC.C.SgACmHC.3

Virtual network snooping at gateway Gateway betweenFromSubnet and ToSubnet: if an attacker has control of physical host Gateway in location Space where it is used to support communication between FromSubnet and ToSubnet, then the attacker can snoop on virtual subnet communications using that route through Gateway.

LS.L.VSPSH.1

Using admin rights at Gateway to enable access to LogicalSubnet from PhysicalSubnet: if someone has control of device Gateway providing virtual subnet LogicalSubnet, and access to the underlying physical subnet PhysicalSubnet, they can connect their own device to the virtual subnet.

VH.M.HACVHmAC.1

Use of admin rights on Host when in Space to control VirtualHost: those with admin rights at device Host when in location Space can control virtual host VirtualHost provisioned on Host.