Distributed Denial of Service Attack P An adversary uses multiple compromised information systems to attack a single target and could cause denial of service for users of the targeted information systems. Denial of Service Earthquake E Seismic activity can damage the information system or its facility. Refer to the following document for earthquake probability maps . Destruction Denial of Service Interference E, P Disruption of electronic and wire transmissions could be caused by high frequency (HF), very high frequency (VHF), and ultra-high frequency (UHF) communications devices (jamming) or sun spots. Denial of Service Espionage P The illegal covert act of copying, reproducing, recording, photographing or intercepting to obtain sensitive information. Disclosure Modification Fire E, P Fire can be caused by arson, electrical problems, lightning, chemical agents, or other unrelated proximity fires. Destruction Denial of Service Floods E Water damage caused by flood hazards can be caused by proximity to local flood plains. Flood maps and base flood elevation must be considered. Destruction Denial of Service Fraud P Intentional deception regarding data or information about an information system could compromise the confidentiality, integrity, or availability of an information system. Disclosure Modification or Destruction Denial of Service Hardware or Equipment Failure E Hardware or equipment may fail due to a variety of reasons. Denial of Service Hardware Tampering P An unauthorized modification to hardware that alters the proper functioning of equipment in a manner that degrades the security functionality the asset provides. Modification Denial of Service Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane could impact the facilities that house the information systems. Destruction Denial of Service
Malicious Software P Software that damages a system such a virus, Trojan, or worm. Modification or Destruction Denial of Service Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service Power Interruptions E Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g. spike, surge, brownout, or blackout). Denial of Service Procedural Error U An error in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service Sabotage P Underhand interference with work. Modification or Destruction Denial of Service Scavenging P Searching through disposal containers (e.g. dumpsters) to acquire unauthorized data. Disclosure
Unauthorized Systems Access P An unauthorized user accesses a system or data. Disclosure Modification or Destruction Volcanic Activity E A crack, perforation, or vent in the earth’s crust followed by molten lava, steam, gases, and ash forcefully ejected into the atmosphere. For a list of volcanoes in the U.S. see: . Destruction Denial of Service Table 3-3 – Potential Threats
Inherent relationships between the system and other interconnected systems may impact the overall system security posture. A summary of the risks known for systems that connect to <Information System Name> is provided in Table 6-1. System Authorization Date/Status Date of POA&M Control Family Identifiers Table 6-1 – Risks from Interconnected Systems