Guide for Conducting Risk Assessments
APPENDIX E

Threat Events
(Characterized by TTPs)
Description
Exploit vulnerabilities on internal organizational
information systems.
Adversary searches for known vulnerabilities in organizational internal information
systems and exploits those vulnerabilities.
Exploit vulnerabilities using zero-day attacks.
Adversary employs attacks that exploit as yet unpublicized vulnerabilities. Zero-day
attacks are based on adversary insight into the information systems and applications
used by organizations as well as adversary reconnaissance of organizations.
Exploit vulnerabilities in information systems timed with
organizational mission/business operations tempo.
Adversary launches attacks on organizations in a time and manner consistent with
organizational needs to conduct mission/business operations.
Exploit insecure or incomplete data deletion in multi-
tenant environment.
Adversary obtains unauthorized information due to insecure or incomplete data
deletion in a multi-tenant environment (e.g., in a cloud computing environment).
Violate isolation in multi-tenant environment.
Adversary circumvents or defeats isolation mechanisms in a multi-tenant
environment (e.g., in a cloud computing environment) to observe, corrupt, or deny
service to hosted services and information/data.
Compromise critical information systems via physical
access.
Adversary obtains physical access to organizational information systems and makes
modifications.
Compromise information systems or devices used
externally and reintroduced into the enterprise.
Adversary installs malware on information systems or devices while the
systems/devices are external to organizations for purposes of subsequently infecting
organizations when reconnected.
Compromise software of organizational critical
information systems.
Adversary inserts malware or otherwise corrupts critical internal organizational
information systems.
Compromise organizational information systems to
facilitate exfiltration of data/information.
Adversary implants malware into internal organizational information systems, where
the malware over time can identify and then exfiltrate valuable information.
Compromise mission-critical information.
Adversary compromises the integrity of mission-critical information, thus preventing
or impeding ability of organizations to which information is supplied, from carrying
out operations.
Compromise design, manufacture, and/or distribution of
information system components (including hardware,
software, and firmware).
Adversary compromises the design, manufacture, and/or distribution of critical
information system components at selected suppliers.
Conduct an attack (i.e., direct/coordinate attack tools or activities).
Conduct communications interception attacks.
Adversary takes advantage of communications that are either unencrypted or use
weak encryption (e.g., encryption containing publically known flaws), targets those
communications, and gains access to transmitted information and channels.
Conduct wireless jamming attacks.
Adversary takes measures to interfere with wireless communications so as to
impede or prevent communications from reaching intended recipients.
Conduct attacks using unauthorized ports, protocols and
services.
Adversary conducts attacks using ports, protocols, and services for ingress and
egress that are not authorized for use by organizations.
Conduct attacks leveraging traffic/data movement
allowed across perimeter.
Adversary makes use of permitted information flows (e.g., email communication,
removable storage) to compromise internal information systems, which allows
adversary to obtain and exfiltrate sensitive information through perimeters.
Conduct simple Denial of Service (DoS) attack.
Adversary attempts to make an Internet-accessible resource unavailable to intended
users, or prevent the resource from functioning efficiently or at all, temporarily or
indefinitely.
Conduct Distributed Denial of Service (DDoS) attacks.
Adversary uses multiple compromised information systems to attack a single target,
thereby causing denial of service for users of the targeted information systems.
Conduct targeted Denial of Service (DoS) attacks.
Adversary targets DoS attacks to critical information systems, components, or
supporting infrastructures, based on adversary knowledge of dependencies.
Conduct physical attacks on organizational facilities.
Adversary conducts a physical attack on organizational facilities (e.g., sets a fire).
Conduct physical attacks on infrastructures supporting
organizational facilities.
Adversary conducts a physical attack on one or more infrastructures supporting
organizational facilities (e.g., breaks a water main, cuts a power line).
Conduct cyber-physical attacks on organizational
facilities.
Adversary conducts a cyber-physical attack on organizational facilities (e.g.,
remotely changes HVAC settings).