Trustworthiness Attribute DefaultTW

URI: DefaultTW

Description: Modelling artefact: an attribute that is always set to the lowest trustworthiness level, and used as a cause for threats that are triggered entirely by the use of security controls.

This attribute is undermined by the misbehaviour LossOfDefaultTW

Data	Represents a class of data items that can be stored on Hosts, or processed and exchanged by Processes. Note that this asset represents the presence of data in the system. Physical copies of the data are represented by inferred assets linked with Processes that serve or use them, hosts where they are stored.
Host	A device that can store, process, transmit or receive data.
LogicalSubnet	A base class for any means of communication between hosts.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

DB.O.DA-VDBs-pDA.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.

DB.O.DBs-pDADA-V.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.

DF.A.CSDF-VdDA2.6

Inconsistent encryption of Data flowing from Service to Client: processes Client and Service exchange data Data in encrypted form but uses a key to encrypt or decrypt between transfer and processing, so they need a secure way to also share the cryptographic key used.

DF.A.PDF.6.1

Loss of availability in the disabled flow of data Data from FlowsFrom to Process: the flow of Data between FlowsFrom to Process has been disabled to maintain security or prevent a breach of regulations, but as a result the data flow is now unavailable.

DF.X.PDFV.6

Flow of Data from FlowsFrom to Process is encrypted: which means the inflowing copy of the data is not available for unencrypted access.

DF.X.PDF-V.6

Flow of Data from FlowsFrom to Process is encrypted: which means the inflowing copy of the data is not available for unencrypted access.

DF.Y.PDF-V.8

Flow of Data from FlowsFrom to Process is unencrypted: which means the inflowing copy of the data is not available for encrypted access.

DS.X.HDSV.6

Stored copy of Data on Host is encrypted: which means this copy is not available for unencrypted access.

DS.X.HDS-V.6

Stored copy of Data on Host is encrypted: which means this copy is not available for unencrypted access.

DS.Y.HDS-V.8

Stored copy of Data on Host is unencrypted: which means this copy is not available for encrypted access.

P.A.PcPuDS-V.6

Process Client cannot access input Data from Service due to inconsistent encryption: processes Client and Service both access a copy of Data stored in encrypted form, so they need a secure way to also share the cryptographic keys used.

P.O.DA-VPpDA.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.

P.O.PpDADA-V.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.

P.T.PcPr-uDS-V.6

Process Client cannot access updates of Data from Service due to inconsistent encryption: processes Client and Service both access a copy of Data stored in encrypted form, so they need a secure way to also share the cryptographic keys used.

Co.A.Co.6

Shutdown of physical process controlled by Controller: if IoT device Controller cannot get appropriate control inputs, it may be suspended to prevent loss of reliability, but this means shutting down the process it controls by physical means.

Sg.A.L1SSg2.6.1

Mesh routing between FromHost and ToHost via Gateway is disabled: if this route is disabled by switching off mesh routing via non-IP connections at Gateway, the route will be unavailable to legitimate users.

Sg.A.LTethSg2.6.1

Connections between Host via Gateway and LogicalSubnet are disabled: if tethering is disabled between Host and Gateway, routes between Host and LogicalSubnet will be unavailable to legitimate users.

Sg.A.LTRevSg2.6.1

Connections between Host via Gateway and LogicalSubnet are disabled: if reverse tethering is disabled between Host and Gateway, the route from Host to LogicalSubnet will be unavailable to legitimate users.

H.A.H.6.1

Loss of availability through disabled device Host: device Host is vulnerable, and the security control strategy was to disable Host, causing a loss of availability.

H.IS.PH.8

Host Host in service: device Host is not disabled, so is potentially subject to threats.

LS.A.HprLS.6.1

Disabled subnet LogicalSubnet is not available: if provisioning by host Gateway of subnet LogicalSubnet has been disabled, then LogicalSubnet will be unavailable.

LS.IS.LS-prH.8

Subnet LogicalSubnet in service: subnet LogicalSubnet is not disabled, so is potentially subject to threats and can be exploited by an attacker.

P.A.HuiHP.6

User Human cannot access device Host to operate Process: if access to device Host is restricted, and user Human lacks the means to gain access, they will be unable to log in and hence unable to interact with process Process.

P.A.HuiHPSP.6

User Human cannot access private space Space to operate Process: if access to space Space is restricted, and user Human lacks the means to gain access, they will be unable to log in to device Host and hence unable to interact with process Process.

I.A.GdHRS.6

Device Host unable to connect to radio subnet LogicalSubnet from Space: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.

I.A.GdHRSi.6

Device Host unable to connect to radio subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.

I.A.GdHWS.6

Device Host unable to connect to wired subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.

I.A.I.6.1

Disabled network connection from Host to LogicalSubnet is not available: if host Host does not in fact connect to subnet LogicalSubnet then that connection will be unavailable.

Sg.A.L3SSg2.6.1

Connections between FromSubnet and ToSubnet via Gateway are disabled: if port forwarding is disabled by closing firewall tunnels at Gateway the route via Gateway between FromSubnet and ToSubnet will be unavailable to legitimate users.

CC.AX.CCC-nmCCS.6.1.5

Client Client unable to authenticate via a trusted key pair with Service: the service Service requires that client connections are authenticated using an asymmetric cryptographic challenge against an X509 (or otherwise trusted) key pair, but here access is via a reverse proxy so there is no direct TLS connection.

CC.AX.CCC-nmSCS.6.1.5

CC.AX.CCC-nS.6.1.1

Client Client unable to authenticate via password with Service: the service Service requires that clients authenticate using a password, but this is not available to client Client.

CC.AX.CCC-nS.6.1.3

Client Client unable to use 2-factor authentication to access service Service: if service Service requires clients to authenticate using a second factor (e.g. a one time key or out of band key exchange), but this is not available to Client then access will be impossible.

CC.AX.CCCS.6.1

Disabled access by client Client to Service: access by client Client to service Service has been disabled to prevent communication threats. However, this also causes a loss of accessibility of the service from that client.

CC.AX.HuCCC-nS.6.1.7

Continuous authN false negative at Client prevents access to Service: the service Service requires that clients use continuous authentication to verify the identity of the user Human, and this is in place but produces a false negative result.

SC.A.SC.6.1

Disabled channel from Client to Service is not available: if the firewall rules allowing access by client Client to service Service have been disabled, then Client will not be able to access Service via that channel.

I.A.GdHVS.6

Device Host unable to connect to virtual subnet LogicalSubnet: if access to network subnet LogicalSubnet is restricted, device Host will be unable to connect if it does not have the necessary credentials.