Focused On Your Success


The All.Net Security Database


Generated Fri Jun 27 09:58:56 PDT 2003 by fc@red.a.net

Cause/Mechanism:
  • Threat Profiles
  • Attack Methods
  • Defense Methods
    Process:
  • Prevention
  • Detection
  • Reaction
    Impact:
  • Integrity
  • Availability
  • Confidential
  • Use Control
  • Other:
  • Risk Management
  • Database Description

    Domain:
  • Physical
  • Informational
  • Systemic
    Sophistication:
  • Theoretical
  • Demonstrated
  • Widespread
  • Perspectives:
  • Management
  • Policy
  • Standards
  • Procedures
  • Documentation
  • Audit
  • Testing
  • Technical Safeguards
  • Personnel
  • Incident Handling
  • Legal
  • Physical
  • Awareness
  • Training
  • Education
  • Organization
  • Brekne's Mechanistic:
  • Input
  • Output
  • Storage
  • Processing
  • Transmission
  • Brekne's Causal:
  • Accidental
  • Malicious
  • Brekne's Method:
  • Leakage
  • Masquerade
  • Denial
  • Corruption
  • Usage
  • Mental

  • Threat16:

    Name:professional thieves

    Complexity: Professional thieves typically use the best tools they can find, practice ahead of time for major thefts, and use highly coordinated efforts to achieve their goals. They have historically tended toward physical means, but this may be changing.
    fc@red.a.net

    Related Database Material

    [Attack52 - audio/video viewing]
    [Attack68 - audit suppression]
    [Attack59 - backup theft, corruption, or destruction]
    [Attack84 - below-threshold attacks]
    [Attack78 - breaking key management systems]
    [Attack30 - bribes and extortion]
    [Attack62 - call forwarding fakery]
    [Attack3 - cable cuts]
    [Attack88 - collaborative misuse]
    [Attack91 - combinations and sequences]
    [Attack58 - content-based attacks]
    [Attack56 - data aggregation]
    [Attack48 - data diddling]
    [Attack82 - dependency analysis and exploitation]
    [Attack44 - desychronization and time-based attacks]
    [Attack17 - dumpster diving]
    [Attack50 - electronic interference]
    [Attack43 - emergency procedure exploitation]
    [Attack80 - error insertion and analysis]
    [Attack67 - error-induced mis-operation]
    [Attack1 - errors and omissions]
    [Attack36 - excess privilege exploitation]
    [Attack71 - false updates]
    [Attack18 - fictitious people]
    [Attack4 - fire]
    [Attack31 - get a job]
    [Attack61 - hangup hooking]
    [Attack70 - hardware failure - system flaw exploitation]
    [Attack64 - illegal value insertion]
    [Attack45 - imperfect daemon exploits]
    [Attack41 - implied trust exploitation]
    [Attack86 - inappropriate defaults]
    [Attack69 - induced stress failures]
    [Attack23 - infrastructure interference]
    [Attack24 - infrastructure observation]
    [Attack63 - input overflow]
    [Attack25 - insertion in transit]
    [Attack92 - kiting]
    [Attack74 - man-in-the-middle]
    [Attack39 - modeling mismatches]
    [Attack27 - modification in transit]
    [Attack72 - network service and protocol attacks]
    [Attack26 - observation in transit]
    [Attack90 - strategic or tactical deceptions]
    [Attack51 - PBX bugging]
    [Attack85 - peer relationship exploitation]
    [Attack21 - perception management a.k.a. human engineering]
    [Attack87 - piggybacking]
    [Attack2 - power failure]
    [Attack66 - privileged program misuse]
    [Attack57 - process bypassing]
    [Attack19 - protection missetting exploitation]
    [Attack81 - reflexive control]
    [Attack53 - repair-replace-remove information]
    [Attack76 - replay attacks]
    [Attack65 - residual data gathering]
    [Attack20 - resource availability manipulation]
    [Attack60 - restoration process corruption or misuse]
    [Attack55 - shoulder surfing]
    [Attack40 - simultaneous access exploitations]
    [Attack22 - spoofing and masquerading]
    [Attack13 - system maintenance]
    [Attack14 - testing]
    [Attack16 - Trojan horses]
    [Attack34 - undocumented or unknown function exploitation]
    [Attack49 - van Eck bugging]
    [Attack54 - wire closet attacks]