Guide for Conducting Risk Assessments
APPENDIX E

Threat Events
(Characterized by TTPs)
Description
Insert untargeted malware into downloadable software
and/or into commercial information technology products.
Adversary corrupts or inserts malware into common freeware, shareware or
commercial information technology products. Adversary is not targeting specific
organizations, simply looking for entry points into internal organizational information
systems. Note that this is particularly a concern for mobile applications.
Insert targeted malware into organizational information
systems and information system components.
Adversary inserts malware into organizational information systems and information
system components (e.g., commercial information technology products), specifically
targeted to the hardware, software, and firmware used by organizations (based on
knowledge gained via reconnaissance).
Insert specialized malware into organizational
information systems based on system configurations.
Adversary inserts specialized, non-detectable, malware into organizational
information systems based on system configurations, specifically targeting critical
information system components based on reconnaissance and placement within
organizational information systems.
Insert counterfeit or tampered hardware into the supply
chain.
Adversary intercepts hardware from legitimate suppliers. Adversary modifies the
hardware or replaces it with faulty or otherwise modified hardware.
Insert tampered critical components into organizational
systems.
Adversary replaces, though supply chain, subverted insider, or some combination
thereof, critical information system components with modified or corrupted
components.
Install general-purpose sniffers on organization-
controlled information systems or networks.
Adversary installs sniffing software onto internal organizational information systems
or networks.
Install persistent and targeted sniffers on organizational
information systems and networks.
Adversary places within internal organizational information systems or networks
software designed to (over a continuous period of time) collect (sniff) network traffic.
Insert malicious scanning devices (e.g., wireless
sniffers) inside facilities.
Adversary uses postal service or other commercial delivery services to deliver to
organizational mailrooms a device that is able to scan wireless communications
accessible from within the mailrooms and then wirelessly transmit information back
to adversary.
Insert subverted individuals into organizations.
Adversary places individuals within organizations who are willing and able to carry
out actions to cause harm to organizational missions/business functions.
Insert subverted individuals into privileged positions in
organizations.
Adversary places individuals in privileged positions within organizations who are
willing and able to carry out actions to cause harm to organizational
missions/business functions. Adversary may target privileged functions to gain
access to sensitive information (e.g., user accounts, system files, etc.) and may
leverage access to one privileged capability to get to another capability.
Exploit and compromise.
Exploit physical access of authorized staff to gain
access to organizational facilities.
Adversary follows ("tailgates") authorized individuals into secure/controlled locations
with the goal of gaining access to facilities, circumventing physical security checks.
Exploit poorly configured or unauthorized information
systems exposed to the Internet.
Adversary gains access through the Internet to information systems that are not
authorized for Internet connectivity or that do not meet organizational configuration
requirements.
Exploit split tunneling.
Adversary takes advantage of external organizational or personal information
systems (e.g., laptop computers at remote locations) that are simultaneously
connected securely to organizational information systems or networks and to
nonsecure remote connections.
Exploit multi-tenancy in a cloud environment.
Adversary, with processes running in an organizationally-used cloud environment,
takes advantage of multi-tenancy to observe behavior of organizational processes,
acquire organizational information, or interfere with the timely or correct functioning
of organizational processes.
Exploit known vulnerabilities in mobile systems (e.g.,
laptops, PDAs, smart phones).
Adversary takes advantage of fact that transportable information systems are
outside physical protection of organizations and logical protection of corporate
firewalls, and compromises the systems based on known vulnerabilities to gather
information from those systems.
Exploit recently discovered vulnerabilities.
Adversary exploits recently discovered vulnerabilities in organizational information
systems in an attempt to compromise the systems before mitigation measures are
available or in place.