Trustworthiness Attribute User TW

URI: UserTW

Description: Trustworthiness of users with access to the shell or having the rights of a process on a host while the host is connected to the system and fulfilling its system role (i.e. in some context).

This attribute is undermined by the misbehaviour LocalLossOfUserTW

AccessContext	Model of access rights, restricted to specific contexts.
Host	A device that can store, process, transmit or receive data.
Process	Represents a process (usually implemented by software running on a Host) that can read, update or create data, or exchange data with other processes.

DS.A.HPsACDAdDS.1

Use of Process to prevent access to Data: someone with the rights of Process on its host device Host can exploit the rights of Process to delete the locally stored copy of Data.

DS.A.HsACDS.1.3

Use of user privileges at Host to control availability of Data: anyone with user privileges at Host can delete or otherwise prevent access to copies of Data stored on the Host.

DS.Auth.HPsACd-pDS-V.1

Use of Process to alter Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to serve and update the locally stored copy of Data.

DS.Auth.HPsACdpDS-V.1

Use of Process to alter Data on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to process and update the locally stored copy of Data.

DS.Auth.HPsACd-pDS-V.1.6

Use of compromised key at Process to alter Data stored on Host: someone with the rights of Process on its host device Host can alter the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.

DS.Auth.HsACDS-V.1.3

Use of user privileges at Host to alter Data stored on Host: anyone with user privileges at Host can alter copies of Data stored on the Host, introducing malicious content designed to subvert anyone or anything using the data.

DS.C.HPsACr-pDS-V.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host can exploit the rights of Process to read and serve the locally stored copy of Data.

DS.C.HPsACrpDS-V.1

DS.C.HPsACr-pDS-V.1.6

Use of compromised key at Process to access Data stored on Host: someone with the rights of Process on its host device Host can access the local encrypted copy of data Data by using a cryptographic key assigned to Process allowing it to serve the data.

DS.C.HsACDS-V.1.3

Use of user privileges at Host to access stored data Data: anyone with user privileges at Host can read copies of Data stored on the Host.

LS.L.HL1HS.1

Access to RemoteHost in Space allows communication via USB or Bluetooth with Host: someone with access to device RemoteHost in location Space where it is paired with device Host can use the pairing connection to communicate with Host.

H.L.HmAC.1

Access to Host by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host, it must be assumed they can use Host in any context.

H.L.SHmACPAC.1

Use of privileges at Process to access Host in Space: anyone with local rights (i.e. at command shell level) for process Process when the host is in location Space also has user level access to its host Host in the same context.

H.M.SHmACRLnSAC.1

Use of login via RemoteAccessService to control Host in Space: anyone with local rights (i.e. at command shell level) for root remote access service RemoteAccessService controlling Host when it is in location Space also has admin rights on Host in the same context.

LS.L.HL3S.1

Access to Host allows local communication on subnet LogicalSubnet: someone with access to Host can send messages on LogicalSubnet to which Host is connected.

P.A.HP-iT.1.3

Use of privileges at Process to control availability: anyone with local user rights (i.e. local control) of a process Process can shut it down. However, this does not prevent access where there are other instances of Process running on independent instances of Host.

P.IS.HPsAC.1

Process Process running on Host not disabled: if an attacker has the rights of Process on its host Host, then they can override a policy to disable Process by restarting it.

P.L.HPmAC.1

Access to Process by an unauthorized agent: if it is believed that an unauthorized and possibly unknown actor has access to Host with the rights of Process, then they could exploit those rights in any context.

P.L.SHLnSACPmAC.1

Use of login via RemoteAccessService to control Process on Host in Space: anyone with local rights (i.e. at command shell level) for remote access service RemoteAccessService controlling the collocated process Process on Host when it is in location Space also has control of Process in that context.

CC.AuC.CACHcLSS.1

Compromised client Client on host CHost used to access Service via LogicalSubnet: if Client is controlled by an attacker when its host CHost is on LogicalSubnet, the attacker can use Client to access Service via a privileged network path, thus acting as a false (impersonated) client.

CC.L.CSHSAC.1

Client Client affected by access to compromised service Service via LogicalSubnet: if Service can be controlled by the wrong person (i.e. an attacker) in a context where it is accessed by client Client, they can alter the behaviour of Service towards Client.

DF.Auth.AC-iDFVFC.3.6

Compromised client Client injects fake content into the encrypted flow of Data to/via Service: if an attacker can compromise client Client, they can access its cryptographic key and alter data Data flowing between Client and FlowsTo.

DF.Auth.AC-iDF-VFC.3.6

DF.C.AC-iDFVTC.3.6

Compromised client Client reads the encrypted flow of Data from/via Service: if an attacker can compromise client Client, they can they can access its cryptographic key and read data Data flowing to Client from FlowsFrom.

DF.C.AC-iDF-VTC.3.6

DS.Auth.HPsACdDSCCV.1

Use of Process to access Data stored on Host: someone with the rights of Process on its host device Host, and able to obtain a key from Vault can exploit the rights of Process to alter the locally stored copy of Data.

DS.C.HPsACrDSCCV.1

H.V.HAC.2

Local authenticated exploit on device Host when in location Space: an attacker with local user level access to device Host in location Space exploits a bug in Host.

H.V.HL1HS.2

Authenticated exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, after authentication, can exploit a bug in Host.

H.V.HL1HS.3

Anonymous exploit on device Host in Space via connection with RemoteHost: an attacker with access to RemoteHost in location Space can send a malicious message via its pairing connection with Host that, without authentication, can exploit a bug in Host.

H.V.IoH.2

Remote authenticated exploit on device Host from AttackerSubnet via LogicalSubnet: an attacker with access to the subnet AttackerSubnet can send a malicious message via the network to device Host via LogicalSubnet that, after authentication, can exploit a vulnerability in Host.

H.V.LoH.2

Adjacent authenticated exploit on device Host from LogicalSubnet: an attacker with local access to device Host when connected to subnet LogicalSubnet can send a message containing malicious content that, after authentication, can exploit a bug in Host.

H.V.NoH.2

P.V.HACPmAC.2

Local authenticated exploit on process Process in Space: an attacker with local user access to device Host in space Space can exploit a bug in Process.