Guide for Conducting Risk Assessments
APPENDIX E

Threat Events
(Characterized by TTPs)
Description
Conduct data scavenging attacks in a cloud
environment.
Adversary obtains data used and then deleted by organizational processes running
in a cloud environment.
Conduct brute force login attempts/password guessing
attacks.
Adversary attempts to gain access to organizational information systems by random
or systematic guessing of passwords, possibly supported by password cracking
utilities.
Conduct nontargeted zero-day attacks.
Adversary employs attacks that exploit as yet unpublicized vulnerabilities. Attacks
are not based on any adversary insights into specific vulnerabilities of organizations.
Conduct externally-based session hijacking.
Adversary takes control of (hijacks) already established, legitimate information
system sessions between organizations and external entities (e.g., users connecting
from off-site locations).
Conduct internally-based session hijacking.
Adversary places an entity within organizations in order to gain access to
organizational information systems or networks for the express purpose of taking
control (hijacking) an already established, legitimate session either between
organizations and external entities (e.g., users connecting from remote locations) or
between two locations within internal networks.
Conduct externally-based network traffic modification
(man in the middle) attacks.
Adversary, operating outside organizational systems, intercepts/eavesdrops on
sessions between organizational and external systems. Adversary then relays
messages between organizational and external systems, making them believe that
they are talking directly to each other over a private connection, when in fact the
entire communication is controlled by the adversary. Such attacks are of particular
concern for organizational use of community, hybrid, and public clouds.
Conduct internally-based network traffic modification
(man in the middle) attacks.
Adversary operating within the organizational infrastructure intercepts and corrupts
data sessions.
Conduct outsider-based social engineering to obtain
information.
Externally placed adversary takes actions (e.g., using email, phone) with the intent
of persuading or otherwise tricking individuals within organizations into revealing
critical/sensitive information (e.g., personally identifiable information).
Conduct insider-based social engineering to obtain
information.
Internally placed adversary takes actions (e.g., using email, phone) so that
individuals within organizations reveal critical/sensitive information (e.g., mission
information).
Conduct attacks targeting and compromising personal
devices of critical employees.
Adversary targets key organizational employees by placing malware on their
personally owned information systems and devices (e.g., laptop/notebook
computers, personal digital assistants, smart phones). The intent is to take
advantage of any instances where employees use personal information systems or
devices to handle critical/sensitive information.
Conduct supply chain attacks targeting and exploiting
critical hardware, software, or firmware.
Adversary targets and compromises the operation of software (e.g., through
malware injections), firmware, and hardware that performs critical functions for
organizations. This is largely accomplished as supply chain attacks on both
commercial off-the-shelf and custom information systems and components.
Achieve results (i.e., cause adverse impacts, obtain information)
Obtain sensitive information through network sniffing of
external networks.
Adversary with access to exposed wired or wireless data channels that
organizations (or organizational personnel) use to transmit information (e.g., kiosks,
public wireless networks) intercepts communications.
Obtain sensitive information via exfiltration.
Adversary directs malware on organizational systems to locate and surreptitiously
transmit sensitive information.
Cause degradation or denial of attacker-selected
services or capabilities.
Adversary directs malware on organizational systems to impair the correct and
timely support of organizational mission/business functions.
Cause deterioration/destruction of critical information
system components and functions.
Adversary destroys or causes deterioration of critical information system
components to impede or eliminate organizational ability to carry out missions or
business functions. Detection of this action is not a concern.
Cause integrity loss by creating, deleting, and/or
modifying data on publicly accessible information
systems (e.g., web defacement).
Adversary vandalizes, or otherwise makes unauthorized changes to, organizational
websites or data on websites.
Cause integrity loss by polluting or corrupting critical
data.
Adversary implants corrupted and incorrect data in critical data, resulting in
suboptimal actions or loss of confidence in organizational data/services.