Guide for Conducting Risk Assessments
APPENDIX E

Threat Events
(Characterized by TTPs)
Description
Cause integrity loss by injecting false but believable data
into organizational information systems.
Adversary injects false but believable data into organizational information systems,
resulting in suboptimal actions or loss of confidence in organizational data/services.
Cause disclosure of critical and/or sensitive information
by authorized users.
Adversary induces (e.g., via social engineering) authorized users to inadvertently
expose, disclose, or mishandle critical/sensitive information.
Cause unauthorized disclosure and/or unavailability by
spilling sensitive information.
Adversary contaminates organizational information systems (including devices and
networks) by causing them to handle information of a classification/sensitivity for
which they have not been authorized. The information is exposed to individuals who
are not authorized access to such information, and the information system, device,
or network is unavailable while the spill is investigated and mitigated.
Obtain information by externally located interception of
wireless network traffic.
Adversary intercepts organizational communications over wireless networks.
Examples include targeting public wireless access or hotel networking connections,
and drive-by subversion of home or organizational wireless routers.
Obtain unauthorized access.
Adversary with authorized access to organizational information systems, gains
access to resources that exceeds authorization.
Obtain sensitive data/information from publicly
accessible information systems.
Adversary scans or mines information on publically accessible servers and web
pages of organizations with the intent of finding sensitive information.
Obtain information by opportunistically stealing or
scavenging information systems/components.
Adversary steals information systems or components (e. g., laptop computers or
data storage media) that are left unattended outside of the physical perimeters of
organizations, or scavenges discarded components.
Maintain a presence or set of capabilities.
Obfuscate adversary actions.
Adversary takes actions to inhibit the effectiveness of the intrusion detection
systems or auditing capabilities within organizations.
Adapt cyber attacks based on detailed surveillance.
Adversary adapts behavior in response to surveillance and organizational security
measures.
Coordinate a campaign.
Coordinate a campaign of multi-staged attacks (e.g.,
hopping).
Adversary moves the source of malicious commands or actions from one
compromised information system to another, making analysis difficult.
Coordinate a campaign that combines internal and
external attacks across multiple information systems and
information technologies.
Adversary combines attacks that require both physical presence within
organizational facilities and cyber methods to achieve success. Physical attack
steps may be as simple as convincing maintenance personnel to leave doors or
cabinets open.
Coordinate campaigns across multiple organizations to
acquire specific information or achieve desired outcome.
Adversary does not limit planning to the targeting of one organization. Adversary
observes multiple organizations to acquire necessary information on targets of
interest.
Coordinate a campaign that spreads attacks across
organizational systems from existing presence.
Adversary uses existing presence within organizational systems to extend the
adversary's span of control to other organizational systems including organizational
infrastructure. Adversary thus is in position to further undermine organizational
ability to carry out missions/business functions.
Coordinate a campaign of continuous, adaptive, and
changing cyber attacks based on detailed surveillance.
Adversary attacks continually change in response to surveillance and organizational
security measures.
Coordinate cyber attacks using external (outsider),
internal (insider), and supply chain (supplier) attack
vectors.
Adversary employs continuous, coordinated attacks, potentially using all three attack
vectors for the purpose of impeding organizational operations.