Trustworthiness Attribute OutOfService

URI: OutOfService

Description: The asset is not currently engaged or being used within the system, and hence cannot be exploited by attackers.

This attribute is undermined by the misbehaviour InService

DataAsset	A base class for all assets representing Data. Used partly to provide a classifier for the palette.
DataStep	Represents the exchange of data between interacting processes (or their ability to securely exchange data).
Host	A device that can store, process, transmit or receive data.
NetworkAsset	Base class for all network assets excluding host devices, including abstract and real subnets, network interfaces, routes through gateway hosts, and extended network paths.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.
ConnectionAsset	Base class for assets representing process-process relationships, privileged communication channels, and opportunities for attacks using those channels.

LS.IS.CNCN.8

Cellular network CellularNetwork is in service: since the underlying backbone network CoreNetwork is in service, so is CellularNetwork.

D.C.HuiPiDCHS.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human enters Data via the user interface of Process on host device Host.

D.C.HuiRACHSPiD.3

Data Data entered via Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session in which Human enters Data via the user interface of Process accessed from remote access client RemoteAccessClient on host device Host.

D.C.HuiPv-iDFCHS.3

Data Data sent from FlowsFrom to Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.

D.C.HuiPv-iD-FCHS.3

Data Data displayed by Process leaks by shoulder surfing Human in space Space: if Human is not careful, someone with access to space Space could shoulder surf a session during which Human views Data via the user interface of Process on host device Host.

D.C.HuiRACv-iDFCHS.3

DB.O.DA-VDBs-pDA.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.

DB.O.DBs-pDADA-V.6

Encrypted processing of queries on Data by Service causes overload: if Service performs query processing in the encrypted domain, the performance overhead will be significant.

DB.O.DSPDFVDB.6.1

Database service Service overloaded by decryption of data Data from Process: since data Data stored on Host is encrypted with keys from Vault, query processing by Service will require retrieval and decryption of a large volume of data. The resulting computational overhead may overload database service Service.

DB.O.DSPDF-VDB.6.1

Database service Service overloaded by decryption of data Data from Process: since data Data stored on Host is encrypted, query processing by Service will require retrieval and decryption of a large volume of data. The resulting computational overhead may overload database service Service.

DB.O.DSPDFVDB.6.2

Data service Process overloaded by decryption of data Data for Service: since data Data stored on Host is encrypted with keys from Vault, query processing by Service will require decryption of a large volume of data. The resulting computational overhead may overload the data server Process.

DB.O.DSPDF-VDB.6.2

Data service Process overloaded by decryption of data Data for Service: since data Data stored on Host is encrypted, query processing by Service will require decryption of a large volume of data. The resulting computational overhead may overload the data server Process.

DF.W.HPDADF.7

Malware insertion in flow of Data to FlowsTo by Process to : if process Process is infected by self-propagating malware, it may insert the malware into the copy of Data sent to process FlowsTo.

DS.A.HDS.7

Infected host Host encrypts or deletes data Data: an attacker having infected device Host with malware exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.

DS.A.HPsACDAdDS.7

Infected process Process encrypts or deletes data Data: the process having become infected by malware is able to delete or otherwise disable access to the stored copy of Data on its host device Host.

DS.A.HsACDS.1.3

Use of user privileges at Host to control availability of Data: anyone with user privileges at Host can delete or otherwise prevent access to copies of Data stored on the Host.

DS.Auth.HsACDS-V.1.3

Use of user privileges at Host to alter Data stored on Host: anyone with user privileges at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.

DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.

DS.W.HPsACDAdDS.7

Infected process Process infects data Data stored on host Host: the process having become infected by malware is able to insert itself into the stored copy of Data on its host device Host.

Hu.U.HuirPvDF.3

User Human affected by accessing forged Data from FlowsFrom via Process: user Human interacts via Process with data Data sent from FlowsFrom, so if the incoming data contains malicious alterations, then Human may make decisions based on false information.

P.O.DA-VPpDA.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.

P.O.PpDADA-V.6

Encrypted processing of input Data by Process causes overload: if Process performs calculations in the encrypted domain, the performance overhead will be significant.

H.W.HL1H.3

Malware infection of device Host from paired device RemoteHost in Space: if RemoteHost is infected by malware, and RemoteHost connects via USB or Bluetooth with device Host then the malware may be automatically transferred to or ingested by Host.

LS.L.HL1HS.1

Access to RemoteHost in Space allows communication via USB or Bluetooth with Host: someone with access to device RemoteHost in location Space where it is paired with device Host can use the pairing connection to communicate with Host.

Sg.DA.L1SSg2AC.1

Mesh routing between FromHost and ToHost not disabled at reenabled at Gateway: if an attacker has admin rights on host Gateway, they can override a policy not to enable mesh routing between paired hosts.

Sg.TA.L1SSg2.8

Mesh routing between FromHost and ToHost via Gateway is enabled: if this route is enabled by mesh routing via non-IP connections, it could be exploited by an attacker.

Sg.TA.LTethSg2.8

Routing between Host and LogicalSubnet via Gateway is enabled: if this route is enabled by tethering between the IP and non-IP connections, it could be exploited by an attacker.

Sg.TA.LTethSg2AC.1

Tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is paired with Host and connected to LogicalSubnet, then they can tether Gateway and connect Host to LogicalSubnet.

Sg.TA.LTRevSg2.8

Routing from Host and LogicalSubnet via Gateway is enabled: if this route is enabled by reverse tethering between the IP and non-IP connections, it could be exploited by an attacker.

Sg.TA.LTRevSg2AC.1

Reverse tethering re-enabled between Gateway and Host connecting to LogicalSubnet: if an attacker has control of host Gateway in a context where it is connected to LogicalSubnet and Host is paired with it, then they can reverse tether Host and connect Host to LogicalSubnet.

H.M.SHmACRLnSAC.1

Use of login via RemoteAccessService to control Host in Space: anyone with local rights (i.e. at command shell level) for root remote access service RemoteAccessService controlling Host when it is in location Space also has admin rights on Host in the same context.

LS.IS.HprLS.8

Subnet LogicalSubnet in service: if device Gateway is in service, it will provide subnet LogicalSubnet, unless network provision is explicitly disabled.

LS.IS.WHmWS.8

Wireless hotspot Hotspot is in service: hotspot Hotspot is up and running in at least one of the spaces where the providing host may be present.

LS.L.HL3S.1

Access to Host allows local communication on subnet LogicalSubnet: someone with access to Host can send messages on LogicalSubnet to which Host is connected.

LS.L.RSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where radio subnet LogicalSubnet is accessible can connect their own device unless access is restricted by security measures. Note that access only to the local subnet serving Space.

LS.L.RSSH-P.3

LS.L.WSS-HP.3

Access to subnet LogicalSubnet from space Space: someone with access to space Space where wired subnet LogicalSubnet has connections can connect their own device unless access is restricted by security measures.

LS.L.WSSH-P.3

P.IS.HP.8

Process Process in service: if host Host is in service, then Process running on Host will also be in service and subject to attack, unless explicitly disabled.

P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.

P.J.SHP-iT.7

Malware infection installs back door in process Process: if Process is infected by malware, it may install a back door in Process, which could be accessed remotely at a later time.

P.L.SHLnSACPmAC.1

Use of login via RemoteAccessService to control Process on Host in Space: anyone with local rights (i.e. at command shell level) for remote access service RemoteAccessService controlling the collocated process Process on Host when it is in location Space also has control of Process in that context.

P.O.HP-iT.5

Software bug overloads Process: a software bug in process Process causes it to become overlaoded.

P.W.HP-iT.7

Process Process infected via its host: device Host having been infected with malware, the software installed on the host for running process Process may also become infected.

H.M.RIoH.7

Remote root access from AttackerSubnet via LogicalSubnet to back door on device Host: an attacker with access to AttackerSubnet gains access to host Host via a previously installed back door providing a reverse shell via LogicalSubnet .

H.M.RNoH.7

I.DA.I.8

Access to Host from LogicalSubnet enabled: if the network connection between Host and LogicalSubnet is in service, then messages addressed to Host will be accepted via that connection, unless blocked by a firewall policy.

I.IS.I.8

Access from Host to LogicalSubnet enabled: if Host is in service, then it will connect to LogicalSubnet by default, unless the connection is disabled.

I.IS.INC.1

Access from Host to LogicalSubnet not disabled: if an attacker has admin rights on device Host when in range of LogicalSubnet, they can override a policy to avoid connecting to subnet LogicalSubnet.

I.M.I.8

Message traffic from LogicalSubnet via Host is unconstrained: if the interface between Host and LogicalSubnet is in service, then traffic that is not blocked will not be subject to any bandwidth limits unless controls are used to impose such limits.

I.O.DDoH.3

Remote DDoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker able to orchestrate clients on subnet AttackerSubnet arranges for them to send too many messages to the network address of the target device Host on LogicalSubnet.

I.O.HIoH.3.1

Remote DoS attack from LogicalSubnet on Host: an attacker with access to subnet LogicalSubnet sends too many messages to the network address of the connected target device Host.

I.O.HIoH.3.2

Remote DDoS attack from LogicalSubnet on Host: an attacker able to orchestrate clients on subnet LogicalSubnet arranges for them to send too many messages to the network address of the connected target device Host.

I.O.IoH.3

Remote DoS attack from AttackerSubnet on Host connection to LogicalSubnet: an attacker with remote access to Layer 3 subnet LogicalSubnet sends too many messages to the network address of the target device Host on LogicalSubnet.

I.O.LoH.3

Adjacent DoS attack on Host from LogicalSubnet: an attacker with access to Layer 2 subnet LogicalSubnet sends too many messages to the hardware address of a target device Host connected to that subnet.

I.O.RoH.3

LS.C.WiFiSSoH.3

Passive snooping in WiFi subnet LogicalSubnet from Space: if an attacker has physical access to WiFi subnet LogicalSubnet from Space, they can passively snoop traffic unless the network is encrypted.

NP.DA.NPLS.8

Network path across LogicalSubnet enters service: the subnet LogicalSubnet being in service means messages can be sent across it.

NP.DA.NPmLSmSg.8

Network path from FromSubnet to ToSubnet enters service: if the logical subnets on this path are in service, and gateways do not block message routing between subnets, then messages can be sent on the end-to-end path.

Sg.DA.L3SSg2AC-b.1

Routing between FromSubnet and ToSubnet re-disabled at Gateway: if an attacker has admin rights on host Gateway in a context where it is connected to FromSubnet and ToSubnet, then they can override a default policy to drop connection being routed between those subnets.

Sg.DA.L3SSg2-b.8

Routing between FromSubnet and ToSubnet via Gateway is enabled by default: if this route between IP subnets is enabled for all communications, it could be exploited by an attacker.

Sg.IS.Sg.8

Routing from FromSubnet to ToSubnet via Gateway is in service: if device Gateway and subnets FromSubnet to ToSubnet are in service, then so is the route between the subnets provided by Gateway.

CAP.IS.NPSCCAP.8

Privileged network path(s) from Client to Process are open: if a privileged path from Client to Process is open, and an attacker can access this path from AttackerSubnet, then Process can be attacked from that subnet by exploiting firewall policy exceptions allowing access by Client along the privileged path to Process.

CAP.IS.SCmCAP.8

Privileged network path(s) from Client to Service are open: if a privileged path from Client to Service is open, then Service can be attacked from subnets along that path, by exploiting firewall policy exceptions allowing access by client Client to Service.

CC.AuA.CCAPNaS.1

Network access to service Service as Client from LogicalSubnet: an attacker with access to subnet LogicalSubnet can send messages to service Service, exploiting a privileged network path through firewalls used by client Client. This allows anonymous access to vulnerabilities or backdoors in Service.

CC.AuA.OCAPNaS.1

CC.AuC.CACHcLSS.1

Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.

CC.AuC.CACSScS.1

Possible access to Process by compromised or impersonated client Client of Service: if service Process redirects clients to service Service for authentication, an attacker able to access Service as Client will be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.1

Possible access to Process as client Client by false client of compromised service Service: if service Process redirects clients to service Service for authentication, and Service is compromised, then attackers may be able to obtain credentials from Service allowing them to authenticate to Process as Client. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.2

Possible access to Process as client Client by interception of credentials by a service imposter: if service Process redirects clients to service Service for authentication, an attacker able to impersonate service Service to Client. Since the attacker would then have access to credentials (even if limited to a single use), they can impersonate Client to Process. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CACSScS.3.3

Possible access to Process as client Client by snooping credentials between Client and authenticator Service: if service Process redirects clients to service Service for authentication, an attacker able to snoop the token issued by Service may be able to impersonate Client to Process before Client does the same, even if the credential is limited to a single use. Note that this does not necessarily mean they can access service Process, only that the client credentials are compromised.

CC.AuC.CCC-nS.3.2

Password from client Client captured by imposter of service Service: if an attacker can successfully spoof service Service to client Client, they can capture the password (or other reusable secret) used by Client to access the real service, allowing them to also impersonate the client.

CC.AuC.CCC-nS.3.3

Password snooped between Client and Service: if a communication path used by client Client at service Service is subject to snooping, and the client uses a password (or other reusable secret) to authenticate to the service, the password can be snooped, allowing impersonation of Client to Service.

CC.AuC.CCC-nS-i.1

Unauthenticated access as client Client to service Service: if an attacker has network access from the direction of Client to service Service, they can send a connection request to service Service, and if not authenticated, impersonate Client.

CC.AuC.CCCvsCC-nS.1

Unauthenticated access as client Client to service Service: if an attacker has network access between Client or Service and any intermediaries through which they communicate, they can inject a connection request through to service Service, and if not authenticated, impersonate Client.

CC.AuD.CCCPCCS-i.3

Confused deputy Client access to Process via Service: if client Client has accepted an inappropriate request from its client to gain access to back-end service Process, and Client has access to Process via reverse proxy Service, then Service will forward the request making it a confused deputy.

CC.AuD.CCCSCCS-i.3

Confused deputy as Client via Service: if service Service has access to a back-end service Process that is not normally available to Client, an untrustworthy client may send a malicious request to Service that to gain inappropriate access to Process.

CC.AuP.CCCPCCS-i.3

Access by Client to Process via reverse proxy Service: if client Client has access to service Process via reverse proxy Service, and Client is an untrustworthy client (due to impersonation or compromise), then so (in a more limited sense) is Service.

CC.AuP.PCCPCCS-i.3

Access via Client to Process via reverse proxy Service: if client Client is a reverse proxy whose client is untrustworthy, then so (in a more limited sense) is Service.

CC.AuS.CACSScS.3.1

Service Process spoofed to client Client by false redirection from Service: service Process authenticates clients by redirecting via authenticator Process. However, if Process is compromised, it may redirect clients back to the wrong service.

CC.AuS.CRoS.3

Spoofing of service Service to Client at subnet LogicalSubnet: an attacker with control of a logical subnet on the path between client Client and service Service can divert messages for Service so they go to a fake version of the service under their control.

CC.AuS.CRoSG.3

Spoofing of service Service to Client at gateway Gateway in Space: an attacker in control of gateway device Gateway in location Space where it handles messages sent from Client to Service, the attacker can divert these messages via a fake version of the service under their control.

CC.AuS.CRoSI.3

Spoofing network ToSubnet allows diversion of the connection of client Client to service Service to an imposter service: an attacker that has spoofed the network connection from Gateway to ToSubnet can divert messages from Client to Service so they go to a fake version of the service under their control.

CC.C.CCCSCSoAC.3

Communications intercepted between Client and Service: if a network communication path used by Client and Service is subject to snooping, then communications between Client and Service can be intercepted.

CC.IS.CSCCmCC.8

Client channel from Client to Service is in service: here, access is via at least one proxy, so the channel is in service and subject to threats only if all its intermediate channels are in service, and it is not disabled by a policy change preventing access to Service by Client.

CC.IS.CSCCSC.8

Client channel from Client to Service is in service: there is a service channel that is not out of service, so the client channel is in service and subject to threats unless disabled by a policy change preventing access to Service by Client.

CC.L.CSHSAC.1

Client Client affected by access to compromised service Service via LogicalSubnet: if Service can be controlled by the wrong person (i.e. an attacker) in a context where it is accessed by client Client, they can alter the behaviour of Service towards Client.

CC.R.CACvsCCS.1

Authenticated access as Client to service Service: anyone who has access to Service and can authenticate as Client can gain authenticated access to Service as Client.

CC.R.CCCS-i.1

CC.R.HuoStCCCS.1

Malicious action by insider Human using Client to access Service: if user Human of client process Client is malicious, they can abuse the right of Client to access service Service.

CC.R.HuStCCCS.1

Malicious action by employee of Employer using Client to access Service: user Human of client process Client may be persuaded by their employer Employer to abuse the right of Client to access service Service.

CP.IS.SCmCP.8

Client path(s) from Client to Service is in service: if there is an open channel from client Client to service Service, then the service may be subject to authenticated attacks from logical subnets exploiting the open channel.

DF.Auth.AC-iDF-VCS.3.2

Compromised or impersonated client Client injects fake content into the flow of data Data from FlowsFrom to FlowsTo between Client and Service: if an attacker can compromise or impersonate client Client, they can inject fake data in messages to Service.

DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

DF.Auth.CCCSDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Service: if client Client does not send data Data to its service Service, it is still possible to inject false content into the data flow via service Service using a confused deputy attack. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).

DF.Auth.CCCSPDF-VCCS-i.3

Flow of data from/via Process forged by compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not send data Data via its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.

DF.C.ACDF-VCS-i.3.1

Compromised service Service reads the flow of data Data from FlowsFrom to FlowsTo sent from Client: if an attacker can compromise or impersonate service Service, they can read data in messages from Client.

DF.C.ACDF-VTS-i.3.6

Compromised service Service reads the encrypted flow of Data from/via Client: if an attacker can compromise service Service, they can they can access its cryptographic key and read data Data flowing to Service from FlowsFrom.

DF.C.ACDFVTS-i.3.6

DF.C.AC-iDF-VCS.3.2

Imposter posing as service Service intercepts flow of Data from FlowsFrom and FlowsTo sent by Client: if an attacker can impersonate service Service, they can intercept content in the flow of data Data between FlowsFrom and FlowsTo via the service and its client Client.

DF.C.AC-iDF-VCS.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Client and Service: if communications between Client and Service are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.

DF.C.AC-iDF-VSC.3.2

Compromised or impersonated client Client reads data Data flowing from FlowsFrom to FlowsTo when sent from Service: if an attacker can compromise or impersonate Client, they can read Data sent by FlowsFrom to FlowsTo in messages from Service.

DF.C.AC-iDF-VSC.3.3

Snooped flow of data Data from FlowsFrom to FlowsTo between Service and Client: if communications between Service and Client are subject to snooping, the snooper could read data Data flowing from FlowsFrom to FlowsTo.

DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.

DF.C.AC-iDF-VTC.3.6

DF.C.CCCSCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Service: if service Service does not send data Data to its client Client , it is still possible for the client to request the data flow using a confused deputy attack against Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes).

DF.C.CCCSPCCSDF-Vi.3

Flow of data from/via Process leaked to compromised client Client via confused deputy Proxy: if client Client is compromised or impersonated, and does not receive data Data from its service Proxy, it is still possible to get the data indirectly using a confused deputy attack via Proxy and Service. The attack itself is responsible for the upstream loss of DeputyUserTW (see threat causes), in this case propagated by at least one reverse proxy.

DF.IS.CCSmDFS.8

Exchange of data is possible between Client and Service is possible: if the client-service relationship of Client with Service is in service, they can exchange data. This does not necessarily mean data is exchanged, only that the exchange is possible.

DF.IS.PDFFA.8

Flow of Data from FlowsFrom to FlowsTo is in service: if process FlowsFrom is in service and able to access the data, and all the steps in the chain of processes between FlowsFrom and FlowsTo are in service, then the flow of Data from FlowsFrom to FlowsTo will be in service and potentially subject to attack, unless disabled.

DF.O.CCDFSFC.3

Compromised client Client sends excessive data Data to/via Service: if Client is the source of a flow of data Data which is sent to or via service Service, then if an attacker or malicious user can access Service as Client, they can send too much data, aiming to overload the data flow destination FlowsTo.

DF.O.CCDFSTC.3

Compromised client Client requests excessive data Data from/via Service: if Client is the destination of a flow of data Data which is sent from or via service Service, then if an attacker or malicious user can access Service as Client, they can request too much data, aiming to overload the data flow source FlowsFrom.

DS.A.CDBSCDSF.4

Malicious query from Client via database Service deletes data Data: an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data could be expected to come via Client, so the attack cannot be prevented using database access controls at Service.

DS.A.CDBSC-DSF.4

Malicious query from Client via database Service deletes data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to delete data Data. In this scenario, an update/deletion query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.CDBSC-DSF.4

Malicious query from Client via database Service alters data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to alter data Data. In this scenario, an update query on Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.

DS.C.CDBSC-DST.4

Malicious query from Client via database Service leaks data Data : an attacker having the ability to send arbitrary queries to Service from or via Client injects a query to retrieve data Data. In this scenario, a selection query for Data would not be expected to come via Client, so the attack can be prevented using database access controls at Service.

DS.C.HPsACrDSCCV.1

I.TA.I.8.1

Access to services on Host from LogicalSubnet enabled by default: if the interface between Host and LogicalSubnet is in service and connections to Host via this interface are allowed by default, then so are connections to services running on Host.

I.TA.I.8.2

Access to services on Host from LogicalSubnet enabled by exception: if the interface between Host and LogicalSubnet is in service, then even if connections to Host via that interface are blocked by default, connections to services running on Host will be allowed unless explicitly disabled.

LS.L.HLSISC.1

Access to LogicalSubnet as CHost via EAP authenticator process Service: an attacker who can authenticate with process Service can connect to subnet LogicalSubnet.

P.L.CCCLnSAC.1

Compromise or impersonation of Client allows access to SHost via Service: if anyone can access Service as Client, then because Service is a remote access service, they can access SHost.

P.L.CCCSAC.3

Remote control of Service using a back door from Client: if a back door has previously been installed in service Service, an attacker with control of client Client can exploit the back door to gain access to the rights of Service on its host SHost.

P.L.CSAPNaS.3

Remote control of service Service using a back door from LogicalSubnet: an attacker with access to LogicalSubnet can exploit a privileged network path to Service via that subnet, and use a previously installed back door to take control of the service, gaining access to the rights of Service on SHost.

P.L.OSAPNaS.3

P.L.SPNaLnS.1

Remote access to login service Service via reverse proxy Client: a malicious user or an attacker who can authenticate with reverse proxy Client can send messages via Client to a back-end login service Service, gaining access to its rights on device SHost.

P.L.SPNaS.3

Remote control of process Service using a back door via proxy Client: a malicious user or an attacker who can send messages via reverse proxy Client to a back-end service Service could access a back door if previously installed in the software, and gain control of Service including its access to its rights on device SHost.

P.O.DDoS.3

Distributed DoS attack on service Process from subnet LogicalSubnet: an attacker with control over multiple vulnerable systems connected to LogicalSubnet can use them to send excessive messages via a privileged network paths through firewalls and overload service Process. The best defence is to arrange with your ISP to manage and restrict the traffic sent from the Internet (check threat causes for an unrestricted network interface).

P.O.DoS.3

DoS attack on service Process from subnet LogicalSubnet: an attacker with access to LogicalSubnetcan exploit a privileged network path through firewalls allowing access to service Process, sending too many messages and overloading Process. The best defence is to manage and restrict the traffic sent to the service at one of the inbound network interfaces (check threat causes for unrestricted network interfaces).

SAP.IS.CAPSAP.8

Privileged network paths to reach service Process from Client via LogicalSubnet are open: messages can be sent from LogicalSubnet to Process thanks to firewall policy exceptions created to allow access by Client, which may be exploited by an attacker.

SC.C.LSmSC.3

Snooping client-service communications in subnet LogicalSubnet: If an attacker has access to messages crossing subnet LogicalSubnet, they can intercept client-service communications that follow a network path via that subnet.

SC.IS.SCmSg.8.1

Privileged channel between Client and Service in service: if all routes via gateways plus the final interface to the service host are enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.

SC.IS.SCpSg.8.1

Privileged channel between Client and Service in service: if access to Service from LogicalSubnet is enabled despite any default firewall rules, then the network path from Client is open and could potentially be exploited in other threats.

Sg.TA.L3SSg2+b.8.2

Port forwarding from FromSubnet to ToSubnet via Gateway is enabled: if the route from public subnet FromSubnet to private subnet ToSubnet via a NAT gateway host Gateway is in service, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.

Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

CC.AuC.CACHLSS.2

Client Client on stolen host CHost used to access Service via LogicalSubnet: if an attacker in possession of stolen device CHost can control the installed client Client when CHost is connected to LogicalSubnet, the attacker can use Client to access Service using a privileged network path, thus acting as a false (impersonated) client.

DF.Auth.AC-iDFVFC.2.6

Client Client on stolen host CHost injects fake content into the encrypted flow of Data via Service: if an attacker has possession of host CHost and can access client Client, they can access its cryptographic key and inject malicious content into the flow of Data from Client to FlowsTo.

DF.Auth.AC-iDF-VFC.2.6

DF.C.AC-iDFVTC.2.6

Client Client on stolen host CHost reads the encrypted flow of Data from/via Service: if an attacker has possession of host CHost and can access client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.

DF.C.AC-iDF-VTC.2.6

I.IS.INC.2

Access from stolen host Host to LogicalSubnet re-enabled: if an attacker gains access to stolen device Host, they can override a policy not to connect it to subnet LogicalSubnet.

P.IS.HP.2

Process Process re-enabled on stolen device Host: if an attacker gains access to stolen device Host, they can restart Process, overriding the policy to disable Process.

H.IS.HVH.8

Host Host in service: virtual host Host is not disabled, so is potentially subject to threats.

HC.C.LSmHC.3

Virtual network communications snooped in physical subnet LogicalSubnet: if network traffic can be snooped in subnet LogicalSubnet, then this also applies to virtual network communications sent via this subnet.

LS.C.LSoLS.3

Passive snooping in OverlaySubnet via LogicalSubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then an attacker who can snoop messages sent over LogicalSubnet can also snoop messages in OverlaySubnet.

LS.IS.mLSoLS.8

Subnet OverlaySubnet in service: if subnet OverlaySubnet is an overlay on one or more other subnets, and they are all in service, then so is OverlaySubnet.

LS.L.LSoLS.1

Access to LogicalSubnet allows access to OverlaySubnet: if subnet OverlaySubnet is an overlay on LogicalSubnet, then an attacker with access to LogicalSubnet can also access OverlaySubnet.

LS.L.VSPS-HP.3

Access to virtual subnet LogicalSubnet via physical network PhysicalSubnet: if an attacker has access to physical subnet PhysicalSubnet, they connect to virtual subnet LogicalSubnet routed over PhysicalSubnet, unless prevented by security measures.

LS.L.VSPSH-P.3

CC.AuC.DFrXSS.3

Reflected XSS exploit on Client via Service injected via client input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Client from FlowsFrom can exploit a bug in Service to send a harmful script to the client browser. We assume this will make the browser leak authentication credentials, such as a password or session key.

CC.AuC.DFsXSS.3

Stored XSS exploit against Client by Service injected via input Data from FlowsFrom: an attacker who can inject malicious content into input Data flowing to Service from FlowsFrom can exploit a bug in Service, and send a harmful script to a trusting client browser Client. We assume this will make the browser leak authentication credentials, such as a password or session key.

CC.R.CDBSC.4

Query injection at Service into back end DB: an attacker having exploited a bug in Service when connected to DB, is able to send arbitrary queries to DB. This is modelled as an adverse behaviour in the inferred client channel representing their trust relationship, fulfilling the precondition for further threats using injected queries to access or alter data stored by DB.

DS.A.HDS.4

Attacker exploit at Host deletes Data: the attacker exploits a vulnerability in device Host and is able to delete or otherwise disable access to the stored copy of Data on the device.

DS.A.HPsACDAdDS.4

Attacker exploit at Process to delete Data: the attacker exploits a vulnerability in process Process and is able to delete or otherwise disable access to the stored copy of Data on its host device Host.

DS.Auth.HDS-V.4

Attacker exploit at Host alters stored copy of Data: the attacker exploits a vulnerability in device Host and is able to alter the stored copy of Data on the device.

DS.Auth.HPsACd-pDS-V.4

Attacker exploit at service Process alters Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data on its host device Host.

DS.Auth.HPsACdpDS-V.4

Attacker exploit at Process alters output Data stored on Host: the attacker exploits a vulnerability in process Process and is able to alter the stored copy of Data updated by the process on its host device Host.

DS.C.HDS-V.4

Attacker exploit at Host accesses stored data Data: the attacker is able to exploit a vulnerability in device Host gaining access to its stored copy of Data.

DS.C.HPsACr-pDS-V.4

Attacker exploit at Process accesses Data: the attacker is able to exploit a vulnerability in process Process and gains access to the stored copy of Data on device Host which is served by the process.

DS.C.HPsACrpDS-V.4

Attacker exploit at Process accesses its input Data: the attacker is able to exploit a vulnerability in process Process, gaining access to the stored copy of Data used by the process on its host device Host.

H.A.H.4

Attacker exploit disables Host: the attacker exploits a vulnerability in device Host and is able to crash the device.

H.J.GH.7

Malware inserts remote access back door in infected device Host: the malware infecting device Host exploits a vulnerability to insert a means for the attacker to remotely access admin privileges on Host.

H.L.HAC.4

Attacker exploit gains user privileges at Host in location Space: the attacker exploits a vulnerability in device Host when it is located in Space, and gains user level access to the device in that context.

H.M.HAC.4

Attacker exploit gains admin rights at Host when it is in location Space: the attacker exploits a vulnerability in device Host in context HostAccess and gains control over the device in that context.

H.M.HmACPAC.4

Attacker exploit at Process in location Space gains admin rights at Host: the attacker exploits a vulnerability in the process Process when its host Host is in Space, and is able to escalate privileges to gain admin rights on Host in that context.

H.V.LoH.2

Adjacent authenticated exploit on device Host from LogicalSubnet: an attacker with local access to device Host when connected to subnet LogicalSubnet can send a message containing malicious content that, after authentication, can exploit a bug in Host.

H.V.LoH.3

Adjacent anonymous exploit on device Host from LogicalSubnet: an attacker with local access to the subnet LogicalSubnet to which device Host is connected can send a message containing malicious content designed to exploit a bug in Host, without authentication.

H.W.HIoH.3

Remote malware exploit on device Host from LogicalSubnet: an attacker with access to subnet LogicalSubnet sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

H.W.HLoH.3

Adjacent malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

H.W.HRoH.3

Remote malware exploit on device Host from RemoteHost: malware on device RemoteHost sends a message containing malicious content designed to exploit a bug in Host and install itself there, without authentication.

P.A.HP-iT.4

Attacker exploit disables Process: the attacker exploits a vulnerability in the process Process and is able to crash it or otherwise prevent access to it.

P.A.HuDFrXSS.6

Service Service disabled to prevent XSS attack on Client via its input Data from FlowsFrom: if service Service is disabled by HostManager to prevent XSS attacks using malicious content injected via Data from FlowsFrom, this will make the service unavailable.

P.A.HuDFsXSS.6

Service Service disabled to prevent XSS attack on Client injected via input Data from FlowsFrom: if service Service is disabled to prevent XSS attacks on Client injected via input Data from FlowsFrom, then Service will be unavailable.

P.L.HPAC.4

Attacker exploit takes control of Process in Space: the attacker exploits a vulnerability in process Process when its host Host is located in Space, giving them control of the process behaviour and access to its privileges on Host when in that location.

P.V.CCCSACvLS.2

Adjacent authenticated exploit as Client on service Service from LogicalSubnet: an attacker able to authenticate as client Client and access Service via an adjacent subnet LogicalSubnet used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CCCS-iAC.2

Remote authenticated exploit as Client on service Service: an attacker able to authenticate as client Client and access Service from a direction used by Client can send a message with malicious content that, after authentication, can exploit a bug in Service.

P.V.CCCvsCCSAC.2

P.V.CSAPNaS.3

Remote anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can use a privileged network path to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.

P.V.OSAPLaS.3

Adjacent anonymous exploit on service Service from LogicalSubnet: an attacker with access to a subnet LogicalSubnet can exploit firewall policy exceptions enabling access to service Service and send a message containing malicious content that, without authentication, can exploit a bug in Service.

P.V.OSAPNaS.3

P.V.SPNaS.2

Remote authenticated exploit on service Service via reverse proxy Client: a malicious user or attacker able send messages to Service via reverse proxy Client can send a malicious request that can exploit a bug in Service after authentication.

P.W.CCCS.3

Worm propagation exploit on service Service from Client: an infected client Client can send a message containing malware that without authentication, can exploit a bug in Service and infect the process.