Trustworthiness Attribute Health

URI: Health

Description: Free of self-propagating malware.

This attribute is undermined by the misbehaviour MalwareInfection

Data	Represents a class of data items that can be stored on Hosts, or processed and exchanged by Processes. Note that this asset represents the presence of data in the system. Physical copies of the data are represented by inferred assets linked with Processes that serve or use them, hosts where they are stored.
DataAsset	A base class for all assets representing Data. Used partly to provide a classifier for the palette.
Host	A device that can store, process, transmit or receive data.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

DF.A.PDF.6.4

Loss of availability from suspending the flow of infected data Data from FlowsFrom to Process: if a contingency plan is used in which the flow of Data between FlowsFrom to Process is disabled if the data becomes infected with malware, then the flow of data Data from FlowsFrom to Process will become unavailable.

DF.W.HPDADF.7

Malware insertion in flow of Data to FlowsTo by Process to : if process Process is infected by self-propagating malware, it may insert the malware into the copy of Data sent to process FlowsTo.

DS.A.HDS.7

Infected host Host encrypts or deletes data Data: an attacker having infected device Host with malware exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.

DS.A.HPsACDAdDS.7

Infected process Process encrypts or deletes data Data: the process having become infected by malware is able to delete or otherwise disable access to the stored copy of Data on its host device Host.

DS.W.HPsACDAdDS.7

Infected process Process infects data Data stored on host Host: the process having become infected by malware is able to insert itself into the stored copy of Data on its host device Host.

H.W.HL1H.3

Malware infection of device Host from paired device RemoteHost in Space: if RemoteHost is infected by malware, and RemoteHost connects via USB or Bluetooth with device Host then the malware may be automatically transferred to or ingested by Host.

H.A.HumH.6.4

Loss of availability through disabling infected device Host: if device Host is vulnerable to malware infection, and the security control strategy is for its manager HostManager to disable Host if it becomes infected, this will cause a loss of availability.

P.A.HumHP-iT.6.4

Loss of availability through disabling infected process Process: if process Process may be infected by malware, and the contingency plan is that its host manager HostManager will disable Process to prevent adverse consequences, this may lead to a loss of availability.

P.J.SHP-iT.7

Malware infection installs back door in process Process: if Process is infected by malware, it may install a back door in Process, which could be accessed remotely at a later time.

P.W.HP-iT.7

Process Process infected via its host: device Host having been infected with malware, the software installed on the host for running process Process may also become infected.

H.J.GH.7

Malware inserts remote access back door in infected device Host: the malware infecting device Host exploits a vulnerability to insert a means for the attacker to remotely access admin privileges on Host.

H.W.HLoH.3

Adjacent malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

H.W.HRoH.3

Remote malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

P.W.CCCS.3

Worm propagation exploit on service Service from Client: an infected client Client can send a message containing malware that without authentication, can exploit a bug in Service and infect the process.

P.W.HPDFDI.2

Infection of Process via malware in flow of Data from FlowsFrom: if the copy of Data received from FlowsFrom is infected with malware, process Process may become infected when it consumes the data as an input.

P.W.HPsACDSrDI.2

Malware infection of Process via stored input Data: if the stored copy of Data on Host is infected with malware, then process Process may be affected when it uses the data as an input.