Detailed Attacks

Identifier	Adm_Err_Crypto
Descriptive Name	Accidental mismanagement of cryptographic functions
Description	An administrator misconfigures cryptographic functions or stores plaintext keys in insecure areas.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Audit_Account - Auditing for user accountability Crypto_Key_Man - Cryptographic Key Management Crypto_Manage_Roles - Management of cryptographic roles `Objective Application` - Limit cryptographic management to specially authorized administrators. I&A_User_Action - User-action identification and authentication
Identifier	Adm_Hstl_Audit_Dstr
Descriptive Name	Destruction or modification of audit data
Description	An administrator seeks to cover up misbehavior by destroying and/or falsifying audit data.
Selection Guidance	This attack is relevant to multi-user systems with an auditing mechanism where some administrators may not be fully trustworthy.
Countermeasure Application	Choose O.Audit_Protect, O.Security_Roles, and O.Audit_Admin_Role to prevent this attack. Environmental support may include operational requirements for security roles and proper handling of audit data. The protection provided is dependent upon specializing the objectives as provided guidance indicates.
Editorial	Access is limited to those authorized for the Audit Administrator role, per Objective O.Audit_Admin_Role.
Attack-Countering Objectives Audit_Admin_Role - Audit-administration role duties `Objective Rationale` - Deter modification or destruction of audit data through the creation of an audit-administration role. This objective attempts to prevent misuse of audit data by limiting access to it. Purpose: Prevent modification or destruction of audit data by limiting possible threat sources. Only the audit administrator can control the audit trail per FMT_SMR.2 and FMT_MTD.1. Environmental support for this objective application could include the creation of procedures for the duties of the Audit Administration role. Audit_Protect - Protect stored audit records `Objective Application` - Select either variant to prevent this attack. The Availability is more effective because a maximum number of audit records lost can be specified and because it potentially addresses other failure scenarios for the audit mechanism. I&A_User - Identify and authenticate each user
Identifier	Adm_Hstl_Mod_Data_AC
Descriptive Name	Administrator maliciously modifies or deletes data access control attributes
Description	An administrator maliciously modifies access control attributes, allowing the administrator or other perpetrator to gain access and manipulative capability to organizational assets, contrary to organizational policy.
Selection Guidance	This attack is relevant to multi-user systems with individualized access controls where some administrators may be untrustworthy. This attack is also relevant when single user systems have a centralized administrative policy which precludes users from administrative authority.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Admin_Limit - Limitation of administrative access control `Objective Application` - Consider preventing administrators from modifying user-defined access control attributes. `Objective Rationale` - This objective is a preventive measure that - with some exceptions - allows the TOE to prevent unauthorized administrative access to user objects. Audit_Account - Auditing for user accountability `X-Ray Application` - FAU_GEN.1: Auditable actions: modification of access-control attributes by administrators. Auditable objects: all objects. `Objective Rationale` - Auditing administrators serves as an identification measure that can help prevent future similar attacks. It also serves as a deterrent, reducing threat-agent motivation. Audit_Loss_Respond - Respond to possible loss of stored audit records `Objective Rationale` - The O.Audit_Loss_Respond objective helps counter the case where administrators take actions that result in the loss of incriminating audit records. Audit_Protect - Protect stored audit records `Objective Application` - Consider preventing administrators who control object attributes from modifying audit data. `Objective Rationale` - The O.Audit_Protect objective deters the administrator from modifying the audit data storage.
Identifier	Adm_Hstl_Mod_DataAps
Descriptive Name	Administrator modifies or destroys user data or applications
Description	The administrator abuses IT or user trust, as being the administrator and without changing the user imposed data security attributes, by destroying data or applications for malicious reasons or to cover up misappropriate behavior.
Selection Guidance	This attack is relevant when an administrator might attempt to circumvent user imposed data access controls.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Admin_Limit - Limitation of administrative access control `Objective Application` - Consider preventing privileged access to user data, except as necessary. `Objective Rationale` - The O.AC_Admin_Limit objective has been imposed to stop the administrator from having access to the user's data. Audit_Admin_Role - Audit-administration role duties `Objective Rationale` - The O.Audit_Admin_Role objective should be considered when the administrator would cover his tracks when accessing a user's data to make the unauthorized modifications. I&A_User - Identify and authenticate each user Trusted_Path&Channel - Trusted path and channel `Objective Rationale` - The objective O.Trusted_Int_Path should be selected when an administrator might attempt to gain user imposed data access information or user authentication data within the TSC.
Identifier	Adm_Hstl_Mod_IFC
Descriptive Name	The administrator maliciously modifies information flow control.
Description	The administrator maliciously alters information flow control policy to allow information to flow to inappropriate locations for unauthorized users access or modification.
Selection Guidance	This attack would most likely be relevant to a network administrator that would not necessarily be trustworthy. An example of this attack is the changing of routing tables or access control lists on a router.
Countermeasure Application
Editorial
Attack-Countering Objectives Audit_Admin_Role - Audit-administration role duties `Objective Rationale` - O.Audit_Admin_Role should be considered as a potential deterant to an administrator who may attempt any malicious modification of the information flow control policy. Audit_Protect - Protect stored audit records `Objective Application` - Access is limited to those authorized for the Audit Administrator role, per Objective O.Audit_Admin_Role. `Objective Rationale` - O.Audit_Protect should be provided in a manner to stop an administrator from destroying the audit data collected on this attack. I&A_User - Identify and authenticate each user Info_Flow_Ctrl_Admin - Provide information flow control administration `X-Ray Application` - FDP_IFC.1: This component should be implemented to provide a policy that would eliminate an administrator from redirecting traffic to an unauthorized location. FDP_IFF.1: This component should implement the information flow to authorized location only.
Identifier	Adm_Hstl_Mod_SEP
Descriptive Name	Administrator maliciously modifies system entry parameters
Description	An administrator or user masquerading as an administrator maliciously modifies system entry parameters which would allow unauthorized access to an organization's protected assets.
Selection Guidance	This attack is most likely to be prevalent where outsiders wanting unauthorized access can sway an administrator. An example of this attack is the modification of the system's defined limit for unsuccessful logins, allowing unlimited password guessing. Unlimited password guessing would be very likely to eventually succeed in gaining unauthorized system (TOE) access.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Admin_Limit - Limitation of administrative access control Aud_Sys_Entry_Parms - Audit changes of system entry parameters Audit_Admin_Role - Audit-administration role duties I&A_User - Identify and authenticate each user
Identifier	Adm_Hstl_Mod_TSFCode
Descriptive Name	Administrator maliciously modifies security-critical code
Description	The administrator modifies the security-critical (TSF) code to weaken the security effectiveness of the TSF or introduce a new security breech.
Selection Guidance	An example of this attack is when an administrator modifies the login implementation to capture user names and passwords.
Countermeasure Application
Editorial
Attack-Countering Objectives Obj_Protection - Object domain protection Sys_Self_Protection - Protection of system security function TSF_Mod_Limit - Limit administrator's modification of security-critical code or data
Identifier	Adm_Hstl_Mod_USB
Descriptive Name	Administrator maliciously modifies user/subject bindings
Description	The administrator modifies a user/subject binding which would allow a user to act on an object without creating an audit trail.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Adm_Limits_Bindings - Limit an administrator's ability to modify user-subject bindings
Identifier	Adm_Hstl_Mod_UsrAttr
Descriptive Name	Administrator maliciously modifies user attributes and/or roles
Description	The administrator modifies or mishandles the users attributes or roles which allows users, unauthorized or authorized, to have the ability to perform inappropriate actions or could prevent a user from performing an authorized action.
Selection Guidance	An example of this attack is when an administrator inappropriately gives a user "super user" status. The user can then change security attributes and gain unauthorized access to the organization assets.
Countermeasure Application
Editorial
Attack-Countering Objectives Adm_User_Att_Mod - Limit administrator's modification of user attributes
Identifier	Adm_Misconfig_User
Descriptive Name	User privileges and/or authorizations are not updated upon reassignment
Description	A change in the status of users duties do not get reflected in administratively controlled privileges and/or authorizations.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives User_Auth_Management - User authorization management
Identifier	Admin_Err_AC_Policy
Descriptive Name	Administrator error modifies access control or information flow policy
Description	An administrator's error in data entry changes the access control or information flow policy enforced by the system in such a way that it no longer serves its intended purpose.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - Administrator guidance shall address administrator errors that change the access control or information flow policy enforced by the system or application in such a way that it no longer serves its intended purpose. Security_Attr_Mgt - Manage security attributes `Objective Application` - Disallow access control or information flow policies that are unsafe in any environment. Security_Data_Mgt - Manage security-critical data `Objective Application` - Security management functions shall provide a well-defined correspondence between available parameter settings and potentially desired access control or information flow policies. Security_Func_Mgt - Manage behavior of security functions Security_Roles - Security roles `Objective Application` - Provide an administrative role specifically for managing access control or information flow policy. `X-Ray Application` - FMT_SMR.1, FMT_SMR.2: The authorised identified role: identified audit role.
Identifier	Admin_Err_Audit
Descriptive Name	Administrator error changes audit behavior
Description	An administrator's error in data entry changes the audit behavior of the system in such a way that auditing no longer serves its intended purpose.
Selection Guidance	For example, an administrator's error modifies or deletes audit data. Another example is when an administrator's error sets audit attributes in such a way as to allow inadmissible activities to go unaudited.
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - Administrator guidance shall address errors that change the audit policy enforced by the TSF. Audit_Admin_Role - Audit-administration role duties `Objective Application` - Provide an administrative role specifically for managing the audit mechanism. Audit_Loss_Respond - Respond to possible loss of stored audit records Audit_Protect - Protect stored audit records I&A_User - Identify and authenticate each user Security_Data_Mgt - Manage security-critical data Security_Roles - Security roles `X-Ray Application` - FMT_SMR.1, FMT_SMR.2: The authorised identified role: identified audit role.
Identifier	Admin_Err_Authentic
Descriptive Name	Administrator error modifies authentication enforcement
Description	An administrator's error in data entry changes the authentication-enforcement mechanism of the system in such a way that it no longer serves its intended purpose.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - AGD_ADM.1: Administrator guidance shall address errors that change the authentication policy enforced by the TSF. Limit_Actions_Auth - Restrict actions before authentication Security_Data_Mgt - Manage security-critical data
Identifier	Admin_Err_Info
Descriptive Name	Administrator error makes information unavailable
Description	An administrator's error in data entry makes system or application information unavailable.
Selection Guidance	For example, an administrator erroneously sets an object's security attributes, which prevents legitimate access to the object. Another example is when an administrator erroneously sets performance-related parameters, which makes information unavailable.
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - AGD_ADM.1: Administrator guidance shall address errors that interfere with availability of user information. Priority_Of_Service - Provide priority of service Resource_Quotas - Resource quotas for users and services Security_Data_Mgt - Manage security-critical data Security_Roles - Security roles `Objective Application` - Restrict activities that could have a general impact on availability of information to an administrative role. `X-Ray Application` - FMT_SMR.1, FMR_SMR.2: The authorised identified role: identified audit role.
Identifier	Admin_Err_Omit_Trap
Descriptive Name	Back door left open
Description	An administrator inadvertently leaves a back door port open after routine maintenance, allowing continuing unauthorized access by the service organization.
Selection Guidance	Many vendors and service organizations provide update and maintenance services to customers by installing code in the systems to be serviced. In general, this code is enabled and disabled by the administrator as service is required. If an administrator inadvertently leaves the port open, the service organization may continue to use this open port for unauthorized entry to the system.
Countermeasure Application
Editorial
Attack-Countering Objectives Maintenance_Access - Controlled access by maintenance personnel Maintenance_Recover - Expiration of maintenance privileges Prvlg_IF_Status - Privileged-interface status
Identifier	Admin_Err_Resource
Descriptive Name	Administrator error makes resource unavailable
Description	An administrator's error in data entry makes system or application resources unavailable.
Selection Guidance	For example, an administrator erroneously modifies security attributes of non-user resources (e.g., communications channels, TOE data files, etc.), which makes the resources unavailable.
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - AGD_ADM.1: Administrator guidance shall address errors that interfere with availability of computing resources. Security_Attr_Mgt - Manage security attributes
Identifier	Admin_Err_Sys_Entry
Descriptive Name	Administrator error modifies entry policy
Description	An administrator's error in data entry changes the intended entry policy of the system or application.
Selection Guidance	For example, an administrator's error modifies entry parameters, which permits access to the system or application in violation of entry policy.
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - AGD_ADM.1: Administrator guidance shall address errors that lead to inappropriate system-entry policies. Security_Data_Mgt - Manage security-critical data
Identifier	Admin_Err_Update
Descriptive Name	Administrator fails to update security configuration
Description	The organizational security policies changes but these changes are not reflected in all system configurations, resulting in circumvention and/or incorrect application of security policies.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation Audit_Account - Auditing for user accountability Secure_Configuration - Security-relevant configuration management
Identifier	Admin_Err_User_Attr
Descriptive Name	Administrator error modifies user security attributes
Description	An administrator's error in data entry modifies a user's security attributes, which makes the attributes inappropriate under the security policy of the system or application.
Selection Guidance	For example, an administrator's error modifies a user's security attributes, which prevents the user from carrying out the user's responsibilities. Another example is when an administrator's error modifies a user's security attributes, which gives the user authorization greater than the authorization dictated by the security policy of the system or application.
Countermeasure Application
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation Security_Attr_Mgt - Manage security attributes Security_Data_Mgt - Manage security-critical data Security_Func_Mgt - Manage behavior of security functions Security_Roles - Security roles `X-Ray Application` - FMT_SMR.1, FMT_SMR.2: The authorised identified role: identified audit role. User_Attributes - Maintain user attributes
Identifier	Admin_UserPriv_Agg
Descriptive Name	Administrator aggregates privacy information
Description	An administrator aggregates information that indirectly reveals the identity (or other privacy related information) of user(s) in violation of user privacy policy.
Selection Guidance	An example of this attack is when a telephone smart card is issued with a unique number, a telephone company system administrator can determine the behavior of the user of this telephone card. When a telephone profile of the user is known, the card can be linked to a specific user.
Countermeasure Application	Choose the O.Prevent_Observe, O.Limit_ObserveRoles, and O.Prevent_Link objectives to prevent this attack. The protection provided is dependent upon specializing the objective as provided guidance indicates. --- Because this is an administrator attack, it is difficult to prevent the attack with high effectiveness. The O.Prevent_Observe objective limits who can observe service usage. However, it is expected that some administrative roles would still be able to observe some service usage in order to perform their duties. O.Limit_ObserveRoles provides a limit on which roles are able to observe service usage, thereby minimizing the opportunity for the attack. O.Prevent_Link limits administrators' ability to profile service usage.
Editorial
Attack-Countering Objectives Limit_ObserveRoles - Limit observation of service usage to authorized users `Objective Application` - The authorized users are the administrator roles that you wish to constrain. `X-Ray Application` - FPR_UNO.4: List the administrator roles that you wish to constrain. Prevent_Link - Prevent linking of multiple service use `Objective Application` - Include administrators in the list of users who are unable to link multiple uses of a service or resource by a user. `Objective Rationale` - This objective constrains the administrative roles identified in the attack as the threat agent. Prevent_Observe - Prevent observation of service use `Objective Application` - Choose the [Distribution] variant of this objective for higher effectiveness in countering this attack. Limit administrators' ability to observe operations to those which are necessary to perform their duties. `X-Ray Application` - FPR_UNO.1, FPR_UNO.2: Include administrators as appropriate to their duties in the list of users who are unable to observe operations. Tailor the lists of operations, objects, and protected users associated with each administrator role as required by your goals for privacy within the specific TOE environment. `Objective Rationale` - The [Distribution] variant of this objective makes it more difficult for administrators to gather privacy information. Administrators typically have greater access than users. Distributing privacy information is additional step to make collect the data more difficult. This objective is more effective if all administrators are constrained under this objective.
Identifier	Admin_UserPriv_Col
Descriptive Name	Administrator reads collected user privacy information
Description	An administrator reads information collected by the IT system or product that reveals the identity (or other privacy related information) of user(s) in violation of user privacy policy.
Selection Guidance	For example, an online registration form for a software application collects the home telephone number of the application's buyer and subsequently an administrator reads the buyer's home telephone number.
Countermeasure Application	Choose the O.Prevent_AskPrivInfo objective to prevent this attack.
Editorial
Attack-Countering Objectives Prevent_AskPrivInfo - Prevent system from collecting user privacy information `Objective Rationale` - This objective helps prevent the attack by prohibiting the system from collecting privacy-related information in the first place. Administrators are thereby prevented from ever seeing the privacy-related information because it never exists on the system.
Identifier	Admin_UserPriv_Gen
Descriptive Name	Administrator reads system generated privacy information
Description	An administrator reads information generated by the IT system or product that directly reveals the identity (or other privacy related information) of user(s) in violation of user privacy policy.
Selection Guidance	For example, a system administrator reads a process table to learn the identity of the user associated with a particular process.
Countermeasure Application	Choose the O.Permit_Aliases or O.Permit_Anonymity objectives prevent this attack, but not both. If user accountability is a concern, O.Permit_Aliases may be preferable. The protection provided is dependent upon specializing the objective as provided guidance indicates. --- Either objective prevents the attack by obscuring the identity of the user. (Note that by definition privacy-related information is associated with user identity.)
Editorial
Attack-Countering Objectives Permit_Aliases - Permit users to use services under aliases `Objective Application` - Select the [Basic] variant unless there is a need for accountability. `X-Ray Application` - FPR_PSE.1, FPR_PSE.2, FPR_PSE.3: Include administrators in the list of users who are unable to determine the real user identity associated with protected subjects. `Objective Rationale` - Any variant of the objective prevents the attacker from associating privacy-related information with a user. Permit_Anonymity - Permit users to use services anonymously `Objective Application` - Choose the [Enhanced] variant of this objective for higher effectiveness in countering this attack `X-Ray Application` - FPR_ANO.1, FPR_ANO.2: Include administrators in the list of users who are unable to determine the real user identity associated with protected subjects. `Objective Rationale` - The [Enhanced] variant of this objective helps prevent the attack by prohibiting the system from collecting privacy-related information in the first place. Administrators are thereby prevented from ever seeing the privacy-related information because it never exists on the system.
Identifier	Dev_FC_Attr_Interp
Descriptive Name	Inconsistent interpretation of audit data attributes
Description	The security-critical (TSF) components inconsistently interpret audit data attributes exchanged with another trusted IT product.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Integrity_Attr_Exch - Correct attribute exchange with another trusted product
Identifier	Dev_FC_Buff_Not_Clr
Descriptive Name	Buffers not cleared by the system
Description	The system leaves user information in a system buffer for view by another unauthorized user.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives No_Residual_Info - Eliminate residual information
Identifier	Dev_FC_Ctrl_Data
Descriptive Name	Incorrect modification of control data
Description	A security-critical (TSF) component incorrectly modifies control data regarding a user process.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Integ_Sys_Data_Int - Integrity of system data transferred internally
Identifier	Dev_FC_Data_Export
Descriptive Name	System data incorrectly exchanged
Description	The system incorrectly exchanges system data with another trusted system.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Integ_Sys_Data_Ext - Integrity of system data transferred externally
Identifier	Dev_FC_Recovery
Descriptive Name	Non-secure recovery
Description	A system failure may alter the behavior of the system's security functions in such a way that, upon recovery, it no longer properly enforces its security policy (TSP).
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Secure_State - Protect and maintain secure system state
Identifier	Dev_FC_Replication
Descriptive Name	Inaccurate system-data replication
Description	The system does not accurately replicate system data to different parts of the system where replication is required.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Integrity_Data_Rep - Integrity of system data replication
Identifier	Dev_FC_Self_Protect
Descriptive Name	System modification by unauthorized source
Description	Software developer or hacker modifies system security functions resulting in a loss of security protection.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Correct_Operation - Verify correct operation as designed Sys_Self_Protection - Protection of system security function
Identifier	Dev_FC_Trap_Door
Descriptive Name	Malicious developer creates secret trapdoor in system
Description	The system developer creates a secret back door in the system (TOE) that allows covert access by the developer. This allows the developer to collect information, monitor user actions, modify the operation of the TOE, or just make unauthorized use of the TOE.
Selection Guidance	This attack is relevant when a developer might be suspected of placing a trapdoor in the code. In this context, the terms trapdoor and back door are very similar. Trap doors have the connotation of being created inadvertantly by a software design flaw or secretly by an intruder. Back doors are vendor-created but do not necessarily reflect malicious intent.
Countermeasure Application	Select O.Code_Signing to deter the attack with moderate effectiveness. Select O.Audit_Account to provide detection after the attack with low effectiveness (since the back door might bypass the audit mechanism). Supplement O.Audit_Account with O.Audit_Admin_Role to counter the case where the developer uses the back door to obtain administrative privilege. Supplement O.Audit_Admin_Role with O.I&A_User to prevent unauthorized use of the audit-administration role. --- Note that the included safeguards address the primary threat of placing the back door but do not counter the exploitation attacks that the back door would allow.
Editorial
Attack-Countering Objectives Audit_Account - Auditing for user accountability `Objective Application` - Audit all external communication, especially that not explicitly associated with legitimate user activity. `Objective Rationale` - [Detection of trapdoors after installation.] Objectives: O.Audit_Account - in using this objective you would be concerned with the audit trail being accountable so if the developer got in you could discover the entry. This objective provides low effectiveness against this attack. Audit_Admin_Role - Audit-administration role duties `Objective Rationale` - [Detection of trapdoors after installation.] O.Audit_Admin_Role - this objective would be needed if the developer could get in as an administrator. This objective provides low effectiveness against this attack. Code_Signing - Code signing and verification `Objective Rationale` - [Deterrence from writing trapdoors.] Objectives: O.Code_Signing - this objective would potentially deter the developer as potential legal action could possibly hinge on verification of code from alteration after leaving developer site. (See the T.Repudiate_Send threat.) I&A_User - Identify and authenticate each user Source_Code_Exam - Examine the source code for developer flaws `Objective Application` - Require a search of the source code for evidence of trap-door functionality. `Objective Rationale` - [Detection of trapdoors before installation.] Objectives: O.Source_Code_Exam - this objective would capture the source code assurance examination to prove no trapdoor exists from vendor.
Identifier	Ext_Crypto_Failure
Descriptive Name	Failure of external crypto support functions
Description	The TOE fails to provide adequate key management or operation due to failure of external cryptographic support
Selection Guidance
Countermeasure Application	This problem is best dealt with by applying relevant TOE crypto objectives to the environment.
Editorial
Attack-Countering Objectives Crypto_Extern_Depend - Cryptographic external dependencies `Objective Application` - This objective is not directly implemented and is best dealt with by applying relevant TOE crypto objectives to the environment.
Identifier	Failure_DS_Comm
Descriptive Name	Communications function failure
Description	Failure of a communications function severs communications between security-critical (TSF) components.
Selection Guidance
Countermeasure Application	Apply O.Fault_Tolerance and O.Integrity_Data_Rep to prevent the attack. Apply O.Integrity_Data_Rep and O.Trusted_DS_Recov to recover from the attack (and to prevent further damage after the initial attack). --- Fault tolerance is much more difficult to achieve for a distributed system and requires other objectives to supplement the protection it provides. O.Fault_Tolerance has to be applied with the idea that transient component failures will occur during normal system operations.
Editorial
Attack-Countering Objectives Fault_Tolerance - Provide fault tolerant operations for critical components `Objective Application` - Apply Fault_Tolerance to faults that sever communication between security-critical components of the distributed system. `X-Ray Application` - Specify security-critical functions that are to prevail, specify severed communicaitons among security-critical components as failures that are to be tolerated. Integrity_Data_Rep - Integrity of system data replication Trusted_DS_Recov - Trusted distributed system recovery
Identifier	Hack_AC_Code_Vul
Descriptive Name	Hacker gains access through a vulnerability in code
Description	The hacker can use vulnerabilities found in system or application code to break into a system undetected.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Apply_Code_Fixes - Apply patches to fix the code Audit_Deter_Misuse - Audit system access to deter misuse
Identifier	Hack_AC_Weak
Descriptive Name	Weak system access control mechanism or system access control implementation
Description	The system access control mechanism(s) or user attributes are weak and can be broken or the implementation methods of the system access control causes the weakness.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Hack_Limit_Sessions - Limit sessions to outside users Trusted_Path - Provide a trusted path
Identifier	Hack_Comm_Overload
Descriptive Name	Hacker causes overload of communication resources
Description	The unauthorized use of communication resources by a hacker causes a denial or delay in service to legitimate operations within the TOE scope of control. This would include the excess bandwidth utilization, leading to the TOE's inability to perform it's security functions.
Selection Guidance
Countermeasure Application	Apply O.Audit_Generation to detect the attack. Apply O.Data_Imp_Exp_Control and/or O.Hack_Traffic_Control to detect attempts and prevent success. This approach is useful when there is a specific policy against various classes of communication. Apply O.Hack_Limit_Sessions, O.Priority_Of_Service, and/or O.Resource_Quotas to limit the extent of an attack without necessarily detecting specific occurrences.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Record actions likely to be result in overload of communication resources. `Objective Rationale` - Audit data should be generated when a threat agent uses services in manner that causes multiple attempts to exceed resource quotas. Data_Imp_Exp_Control - Data import/export to/from system control `Objective Application` - For example, provide export of user data from the TOE with security attributes that limit the number of locations and specify which locations that the data can be sent to. `Objective Rationale` - Allowing data to or from locations not specified by the organization's policy could put excessive strain on bandwidth of communication lines and cause legitimate data flows to be delayed or denied. Hack_Limit_Sessions - Limit sessions to outside users Hack_Traffic_Control - Control hacker communication traffic `Objective Rationale` - O.Hack_Traffic_Control can be used to prevent communications overload by discarding the hacker traffic when a hacker causes overload on communication channels. Priority_Of_Service - Provide priority of service `Objective Application` - Heuristically give priority to those users that are least likely to cause a communications overload. Resource_Quotas - Resource quotas for users and services
Identifier	Hack_CommEaves_Eman
Descriptive Name	The communication mechanism emanates data
Description	An outsider uses special equipment to capture emanations off the communications line.
Selection Guidance	The relevance of this attack is directly proportional to the degree of emanation by the communication medium. This attack is inherent to broadcast communication techniques, where the emanations are intentional. An example of this attack is when an outsider intercepts microwave transmissions or broadcast wireless transmissions using specialized devices.
Countermeasure Application
Editorial
Attack-Countering Objectives Data_Exchange_Conf - Enforce data exchange confidentiality
Identifier	Hack_CommEaves_Intrc
Descriptive Name	Outsider intercepts user communications
Description	An outsider who is not an intended recipient intercepts user data communications.
Selection Guidance	For example, an outsider may install a sniffer device at a remote system. The outsider may need to be privileged with respect to the remote system in order to carry out this attack. However, lax controls at the remote system may allow circumvention of this constraint.
Countermeasure Application
Editorial
Attack-Countering Objectives Data_Exchange_Conf - Enforce data exchange confidentiality
Identifier	Hack_CommEaves_Tap
Descriptive Name	An outsider taps a communications line
Description	An outsider uses a device to physically tap the communications line.
Selection Guidance	The relevance of this attack is directly related to the exposure of communications lines to unconstrained threat sources. The outsider must be relatively sophisticated and possess substantial resources to carry out this attack. Some communications line (e.g., fiber optics) may be relatively immune to this attack. When applied to communications lines, the effectiveness of these objectives will vary greatly as a function of both the sophistication of the attack and the capability to detect or resist those attacks, which depends on the physical properties of the communications lines. Complete, physical protection of external communications lines will be almost impossible to provide when the communications destination is a remote site. Some additional protection might be provided by a second party (e.g., the owners of the communications lines). An example of this attack is when an outsider taps into either unprotected communications lines within the system enclave or into wide area communications lines that cannot be protected.
Countermeasure Application	Choose O.Tamper_ID to detect the attack. Choose O.Tamper_Resistance to prevent the attack.
Editorial
Attack-Countering Objectives Comm_Line_Protection - Physical protection of the communications line Tamper_ID - Tamper detection `Objective Rationale` - The effectiveness of this objective when applied to the communications lines will vary greatly as a function of both the sophistication of the attack as well as the capability to detect those attacks (which depends on the physical properties of the communications lines). Complete, physical protection of external communications lines will be almost impossible to provide when the communications destination is a remote site. Some additional protection of this nature might be provided by a second party (e.g., the owners of the communications lines). Tamper_Resistance - Tamper resistance
Identifier	Hack_Crypto_ChsnCy
Descriptive Name	Chosen ciphertext cryptoanalysis
Description	The attacker discovers an unknown encryption key.
Selection Guidance	In this attack, the attacker knows the encryption algorithm and has ciphertext of his own choosing, together with its decrypted plaintext.
Countermeasure Application
Editorial
Attack-Countering Objectives Encryption_Access - Protection of ciphertext `X-Ray Application` - FDP_ACC.1: `Objective Rationale` - O.Encryption_Access makes cryptoanalysis more difficult. Encryption_Prohibit - Protection of corresponding plaintext-ciphertext pairs `Objective Rationale` - O.Encryption_Prohibit prevents this specific attack. Robust_Encryption - Robust encryption `Objective Rationale` - O.Robust_Encryption makes cryptoanalysis more difficult.
Identifier	Hack_Crypto_ChsnPln
Descriptive Name	Chosen plaintext cryptoanalysis
Description	An attacker discovers an unknown encryption key by choosing a set of plaintexts and causing the corresponding set of ciphertexts to be generated.
Selection Guidance	In this attack, the hacker knows the encryption algorithm.
Countermeasure Application
Editorial
Attack-Countering Objectives Encryption_Access - Protection of ciphertext `Objective Rationale` - O.Encryption_Access makes cryptoanalysis more difficult. Encryption_Prohibit - Protection of corresponding plaintext-ciphertext pairs `Objective Rationale` - O.Encryption_Prohibit prevents this specific attack. Robust_Encryption - Robust encryption `Objective Rationale` - O.Robust_Encryption makes cryptoanalysis more difficult.
Identifier	Hack_Crypto_ChsnTxt
Descriptive Name	Chosen text cryptoanalysis
Description	An attacker discovers an encryption key by choosing samples of both plaintext and ciphertext, and causing them to be encrypted and decrypted, respectively, using a known algorithm and the unknown key.
Selection Guidance	This attack is a combination of the chosen plaintext and chosen ciphertext attacks.
Countermeasure Application
Editorial
Attack-Countering Objectives Crypto_Data_Sep - Separation of cryptographic data Encryption_Access - Protection of ciphertext `Objective Rationale` - O.Encryption_Access prevents this specific attack. Encryption_Prohibit - Protection of corresponding plaintext-ciphertext pairs `Objective Rationale` - O.Encryption_Prohibit prevents this specific attack. Robust_Encryption - Robust encryption `Objective Rationale` - O.Robust_Encryption makes cryptoanalysis more difficult.
Identifier	Hack_Crypto_Cypher
Descriptive Name	Ciphertext-only cryptoanalysis
Description	An attacker discovers the plaintext that corresponds to the given ciphertext, knowing only the encryption algorithm being used. The attacker has no plain-text examples to work from, nor does he/she know the encryption key that was used.
Selection Guidance	The objective of the attack is normally to discover the plaintext that corresponds to the given ciphertext. However, the attacker would be glad to discover the key that was used. The Brute-Force Attack, in which all possible keys are tried, is an example of this attack.
Countermeasure Application	If the cryptography is sufficiently strong, O.Robust_Encryption suffices. Otherwise, supplement O.Robust_Encryption suffices with O.Encryption_Access for additional protection.
Editorial
Attack-Countering Objectives Encryption_Access - Protection of ciphertext Robust_Encryption - Robust encryption
Identifier	Hack_Crypto_PlnTxt
Descriptive Name	Known plaintext cryptoanalysis
Description	An attacker discovers an encryption key by comparing corresponding plaintext and ciphertext samples.
Selection Guidance	The attacker knows the encryption algorithm. In a variation of this attack, the attacker knows or guesses standardized parts of the plaintext that are in fixed locations. Another variation attempts to exploit probable words that are likely to be contained in the plaintext.
Countermeasure Application
Editorial
Attack-Countering Objectives Encryption_Access - Protection of ciphertext `Objective Rationale` - O.Encryption_Access makes cryptoanalysis more difficult. Robust_Encryption - Robust encryption `Objective Rationale` - O.Robust_Encryption makes cryptoanalysis more difficult.
Identifier	Hack_Ext_CryptoAsset
Descriptive Name	Accidental or deliberate mishandling of cryptographic assets external to the TOE
Description	Cryptographic assets are mishandled after the leave the TOE, either in transit or while residing on stored media.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Crypto_Import_Export - Cryptographic import, export, and inter-TSF transfer Crypto_Manage_Roles - Management of cryptographic roles
Identifier	Hack_Masq_Hijack
Descriptive Name	A hacker assumes the identity of an authorized user
Description	A hacker captures the interactive session of an authorized user. The hacker now appears as a legitimate user and can perform any action allowed to that user, including reading or modifying sensitive data.
Selection Guidance	This attack is relevant to multi-user systems with remote users who access the system (TOE) via network connections.
Countermeasure Application	Choose O.Audit_Gen_User to detect the attack after the fact. Choose O.Trusted_Path to prevent the attack.
Editorial
Attack-Countering Objectives Audit_Gen_User - Individual accountability `Objective Rationale` - O.Audit_Gen_User, User identity association is clearly necessary for user accountablility and is equally clearly violated by a successful session capture attack. Trusted_Path - Provide a trusted path `Objective Rationale` - O.Trusted_Path: masquerade threats are threats against the trusted path objective whose purpose is to ensure that I&A is done in a reliable way.
Identifier	Hack_Masq_Uwkstn
Descriptive Name	A user assumes the identity of an authorized user
Description	An individual takes advantage of an unattended but active workstation to perform operations in the name of the logged-in user. Such operations may include some operations that the attacker is not normally allowed to perform.
Selection Guidance	This attack is relevant to multi-user systems with individualized access controls where some users may be untrustworthy and others careless.
Countermeasure Application	Choose O.Screen_Lock to prevent the attack by allowing users or the TOE to lock unattended workstations. Choose O.Session_Termination to provide additional capability to prevent the attack. Choose O.User_Guidance to support these mechanisms.
Editorial
Attack-Countering Objectives Audit_Gen_User - Individual accountability Screen_Lock - User screen locking Session_Termination - System terminates session for inactivity Trusted_Path - Provide a trusted path User_Guidance - User guidance documentation `X-Ray Application` - AGD_USR.1: Provide user guidance in order to reduce the risk of an active workstation being left unattended and to provide instructions for use of screen locking mechanisms.
Identifier	Hack_Masq_Wauth
Descriptive Name	Masquerading due to weak authentication
Description	Services are provided to a user application without adequate authentication of the client requesting the service. This would permit someone to receive services for which they are not authorized. However, the server would see them as a legitimate user, which is why this is classified as a masquerade attack.
Selection Guidance
Countermeasure Application	Choose O.User_Auth_Multiple or O.User_Auth_Enhanced to strengthen authentication, preventing the attack. Choose O.Audit_Generation to detect the attack after the fact.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity User_Auth_Enhanced - Enhanced user authentication User_Auth_Multiple - Require multiple authentication mechanisms `Objective Application` - Specialize this objective so that a user must use several mechanisms together to gain access to critical resources.
Identifier	Hack_MsgData_RcvTSF
Descriptive Name	Modification of security-critical data in transit from a remote trusted site
Description	Security-critical (TSF) data is modified in transit from a remote trusted site, either accidentally by the communications infrastructure or deliberately by a hostile outsider.
Selection Guidance	Several kinds of modification are possible in this attack: modification of a single message, deletion or reordering of selected messages, insertion of bogus messages, replay of previous messages, and modification of accompanying message security attributes. This could be accomplished as a man-in-the-middle attack.
Countermeasure Application
Editorial
Attack-Countering Objectives TSF_Rcv_Err_ID_Loc - Local detection of received security-critical data modified in transit TSF_Rcv_Err_ID_Rem - Remote detection of received security-critical data modified in transit TSF_Rcv_Err_Rcvr_Loc - Local correction of received security-critical data that is modified in transit TSF_Rcv_Err_Rcvr_Rem - Remote correction of security-critical data that is received by the system and modified in transit
Identifier	Hack_MsgData_RcvUsr
Descriptive Name	Modification of user data in transit from a remote site
Description	A hostile outsider modifies message data in route to the system. Alternatively, errors in the communications infrastructure modify the message.
Selection Guidance	Several kinds of modification are possible in this attack: modification of a single message, deletion or reordering of selected messages, insertion of bogus messages, replay of previous messages, and modification of accompanying message security attributes. This could be accomplished as a man-in-the-middle attack.
Countermeasure Application	Choose O.Rcv_MsgMod_ID to detect the attack. Choose O.Rcv_MsgMod_Rcvr to detect, recover from, and minimize adverse consequences of the attack.
Editorial
Attack-Countering Objectives Rcv_MsgMod_ID - Identify message modification in messages received Rcv_MsgMod_Rcvr - Recovery from modification of received messages
Identifier	Hack_MsgData_SndTSF
Descriptive Name	Modification of security-critical data in transit to a remote site
Description	Security-critical (TSF) data is modified in transit to a remote site, either accidentally by the communications infrastructure or deliberately by a hostile outsider.
Selection Guidance	Several kinds of modification are possible in this attack: modification of a single message, deletion or reordering of selected messages, insertion of bogus messages, replay of previous messages, and modification of accompanying message security attributes. This could be accomplished as a man-in-the-middle attack.
Countermeasure Application
Editorial
Attack-Countering Objectives TSF_Snd_Err_ID_Loc - Local detection of sent security-critical data modified in transit TSF_Snd_Err_ID_Rem - Remote detection of sent security-critical data modified in transit. TSF_Snd_Err_Rcvr_Loc - Local Correction of sent security-critical data modified in transit TSF_Snd_Err_Rcvr_Rem - Remote correction of sent security-critical data modified in transit
Identifier	Hack_MsgData_SndUsr
Descriptive Name	Modification of user data in transit to a remote site
Description	A hostile outsider modifies message data in route to a remote site. Alternatively, errors in the communications infrastructure modify the message.
Selection Guidance	Several kinds of modification are possible in this attack: modification of a single message, deletion or reordering of selected messages, insertion of bogus messages, replay of previous messages, and modification of accompanying message security attributes. This could be accomplished as a man-in-the-middle attack.
Countermeasure Application	Choose O.Snt_MsgMod_ID to support detection of the attack. Choose O.Snt_MsgMod_Rcvr to support detection of, and recovery from the attack.
Editorial
Attack-Countering Objectives Snt_MsgMod_ID - Identify message modification in messages sent Snt_MsgMod_Rcvr - Support recovery from modification of sent messages
Identifier	Hack_Phys_Avl_Eman
Descriptive Name	Emissions interference
Description	System emissions, typically electromagnetic radiation, disrupt electronic circuits in nearby equipment, causing them to fail or behave erratically.
Selection Guidance	This attack is relevant if sensitive devices must operate in the vicinity of the TOE.
Countermeasure Application	Choose O.InterferEman_Control to prevent the attack.
Editorial
Attack-Countering Objectives InterferEman_Control - Emissions interference control
Identifier	Hack_Phys_Cnf_Eman
Descriptive Name	Hacker collects information via emanations analysis
Description	An attacker collects unintended system emanations, interprets them, and thus retrieves information that is being processed by the system.
Selection Guidance	Unintended system emanations include electromagnetic signals (including radio transmissions, heat, light) as well as sound emanations. In one variant of this attack, collected information is used to assist in cryptoanalysis.
Countermeasure Application	Choose O.IntelEman_Control to prevent the attack via TOE requirements. Choose O.IntelEman_Contain to prevent the attack via environmental requirements. Choose O.EMSEC_Design as an alternative to O.IntelEman_Control. Specialize these objectives in such a way that any intelligible emanations escaping from the TOE are sufficiently weak that they do not get past barriers in the environment, at least not with sufficient strength to be detected and interpreted.
Editorial
Attack-Countering Objectives EMSEC_Design - Provide physical emanations security IntelEman_Contain - Emanations containment IntelEman_Control - Emanations control
Identifier	Hack_Phys_Crypto
Descriptive Name	Physical attack on cryptographic assets
Description	Physical attack causes damage to cryptographic functions and/or release of cryptographic assets
Selection Guidance	Choose O.Tamper_Resistance to prevent the attack. Choose O.Tamper_ID to detect the attack.
Countermeasure Application
Editorial
Attack-Countering Objectives Tamper_ID - Tamper detection Tamper_Resistance - Tamper resistance `Objective Application` - It may be appropriate to zeroize cryptographic registers and partially encrypted data, in order to prevent adverse consequences of the attack.
Identifier	Hack_Phys_Damage
Descriptive Name	Hacker physically attacks the system
Description	Hacker physically attacks the system, causing physical damage and loss of security protection.
Selection Guidance	This attack is particularly relevant in environments where non-users have physical access to the system.
Countermeasure Application	Choose O.Tamper_ID to detect the attack. Choose O.Tamper_Resistance to prevent the attack.
Editorial
Attack-Countering Objectives Tamper_ID - Tamper detection Tamper_Resistance - Tamper resistance
Identifier	Hack_Prcsr_Overload
Descriptive Name	Hacker causes system task overload resulting in denial of service
Description	Hacker causes system task overload resulting in denial of service. The system (TOE) has been over-tasked and can not complete the assigned tasking at all or in an expected amount of time. The hacker invokes processing functions in association with unauthorized activity that leads to overburdening processing resources on the TOE.
Selection Guidance	This attack is relevant when processing resources may not be adequate to handle all potential authorized and hacker initiated processes. Therefore if processing capability will never be overburdened or limited hacker activity is authorized do not include this attack. Hacker activity may be authorized in limited amounts to analyze the hacker's present activity and to predict the hacker's potential future attack methods.
Countermeasure Application	Choose O.Hack_Traffic_Control to prevent processor overload by discarding the hacker traffic when hacker traffic puts undue strain on the processor.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `Objective Application` - Apply O.Audit_Generation to the collection of audit records that are likely to be associated with task overloading. `X-Ray Application` - FAU_GEN.1: Audit data should be generated when a threat agent uses services in manner that causes multiple attempts to exceed resource quotas. Hack_Limit_Sessions - Limit sessions to outside users Hack_Traffic_Control - Control hacker communication traffic Priority_Of_Service - Provide priority of service `Objective Application` - Heuristically give priority to those users that are least likely to cause task overloading. React_Discovered_Atk - React to discovered attacks `Objective Application` - Specialize O.React_Discovered_Atk to the reporting of task overload. Resource_Quotas - Resource quotas for users and services
Identifier	Hack_SocEng_Password
Descriptive Name	Social engineering to steal password
Description	A hacker persuades a user or administrator to reveal his password, giving the hacker access to the person's account privileges.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Limit_Mult_Sessions - Limit multiple sessions User_Auth_Enhanced - Enhanced user authentication
Identifier	Hack_SocEng_SysInfo
Descriptive Name	Hacker uses social engineering to learn system information
Description	A hacker persuades a user or administrator to reveal information about system operational procedures, auditing and known flaws.
Selection Guidance
Countermeasure Application	PP authors should also consider writing non-IT objectives to address social engineering attacks.
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - ADG_ADM.1: Address social engineering attacks. Audit_Unusual_User - Audit unusual user activity Identify_Unusual_Act - Identify unusual user activity User_Guidance - User guidance documentation `X-Ray Application` - ADG_USR.1: Address social engineering attacks.
Identifier	Hack_Spoof_Login
Descriptive Name	Login program replicated to capture authentication data
Description	An attacker simulates the system's login program and runs it at an open terminal or workstation in order to capture a legitimate user's authentication data.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Trusted_Path - Provide a trusted path User_Auth_Enhanced - Enhanced user authentication
Identifier	Hack_Spoof_MsgHdr
Descriptive Name	Attacker modifies protocol headers
Description	An attacker may modify protocol headers such that a user believes the communication is coming from a source that is different from where it was actually sent.
Selection Guidance	Examples include TCP/IP headers that are modified at a remote (e.g., hacker-controlled) site, as well as false information placed in e-mail header fields.
Countermeasure Application	Not all objectives are relevant in all environments: O.Comm_Trusted_Channel assumes the remote system is trusted. O.Repudiate_Send_Local assumes the remote system is trusted. O.Security_Data_Ext assumes the remote system is trusted.
Editorial
Attack-Countering Objectives Comm_Trusted_Channel - Trusted channel to remote trusted system Crypto_Comm_Channel - Encrypted communications channel `Objective Application` - Require that any clear-text headers be duplicated inside the encryption "envelope". Integrity_Attr_Exch - Correct attribute exchange with another trusted product NonRepudiate_Sent - Non-repudiation for sent information
Identifier	Hack_Stg_Overload
Descriptive Name	Hacker activities cause storage overload
Description	A hacker initiates processes that tax the amount of storage available in the system (TOE). Such would be the case when a hacker floods the TOE with e-mails.
Selection Guidance	This attack is applicable if the hacker dumps unwanted data into TOE storage.
Countermeasure Application	Choose O.Hack_Traffic_Control to prevent storage overload by discarding or rerouting the hacker traffic when a hacker causes overload on storage resources.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `Objective Application` - Specialize O.Audit_Generation to the collection of audit records that are likely to be associated with storage overloading. `X-Ray Application` - FAU_GEN.1: Audit data should be generated when a threat agent uses services in manner that causes multiple attempts to exceed resource quotas. Guarantee_Audit_Stg - Guarantee the availability of audit storage space Hack_Limit_Sessions - Limit sessions to outside users Hack_Traffic_Control - Control hacker communication traffic Manage_TSF_Data - Manage security-critical data to avoid storage space being exceeded Priority_Of_Service - Provide priority of service Resource_Quotas - Resource quotas for users and services
Identifier	Hardware_Flaw
Descriptive Name	System hardware fails during system operation
Description	System use uncovers a hardware flaw in a critical system component.
Selection Guidance	The flaw may be a result of design or implementation errors. In some cases the provision of security protection depends upon specific functionality being present, as in the case of audit record storage.
Countermeasure Application	Choose O.Fail_Secure to prevent the loss of security protection. Choose both O.Fail_Secure and O.Fault_Tolerance to prevent the loss of security protection and to provide availability. Objectives that counter this attack should be supplemented with assurance requirements commensurate with the desired degree of protection.
Editorial
Attack-Countering Objectives Fail_Secure - Preservation of secure state for failures in critical components `Objective Application` - This objective prevents the loss of security protection by preserving the TOE's secure state in the presence of specific hardware failures. `X-Ray Application` - FPT_FLS.1: List the types of hardware failures for which the TOE guarantees it will "fail safe" (i.e., protect its secure state). The definition of secure state should capture critical aspects of the security design that could be violated as a result of the identified hardware failures. `Objective Rationale` - The definition of a secure state may regard missing functionality or TOE inoperability as "secure," unless availability is a concern. Fault_Tolerance - Provide fault tolerant operations for critical components `Objective Application` - Both variants are capable of protecting security-relevant functionality and may address availability in the general sense. The [Resistant] variant provides more comprehensive protection. Some hardware components are intrinsic to TSF enforcement, while others may affect TOE functional capabilities. Both examples should be considered when specializing the objective. `X-Ray Application` - FRU_FLT.1: Specify the relevant hardware components and list the associated failures to which each must be tolerant. FRU_FLT.2: List the associated failures to which all TOE hardware capabilities must be resistant. `Objective Rationale` - Explain the identified hardware components and the failures to which they are tolerant and/or resistant, with regard to the nature of protection being provided. If the [Basic] variant is used, protection is provided by avoiding the consequences of the attack. If the [Resistant] variant is used, the attack is prevented for the specified cases.
Identifier	Mal_Code_Hack_Downld
Descriptive Name	Malicious code perpetrator dissemination
Description	A perpetrator disseminates malicious code via push or pull mechanism.
Selection Guidance	The human can effect the dissemination of the code by using push or pull technologies (email, ftp, http gets, Java applets, etc.). The human can be a person who is destructive in nature and has malicious intent. This may include the programmer of the code or someone who has knowledge of the code's existence. Therefore this malicious human is deliberate in their actions and in this case is called a perpetrator.
Countermeasure Application	Choose O.Obj_Protection and/or O.Remote_Execution to limit opportunities. Choose O.Code_Signing to deter the attack and facilitate detection. Choose O.Input_Inspection to detect and prevent the attack before it can succeed. Choose O.General_Integ_Checks to detect the attack after it has occurred. Choose O.Clean_Obj_Recovery to recover from the attack after it has occurred.
Editorial
Attack-Countering Objectives Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification General_Integ_Checks - Periodically check integrity Input_Inspection - Require inspection for absence of malicious code. `Objective Application` - Specify inspection for absence of malicious code. Obj_Protection - Object domain protection Remote_Execution - Disable remote execution `X-Ray Application` - FDP_ACF.1: Rules governing access: Limit ability to modify trusted objects to a trusted role
Identifier	Mal_Code_Hack_Exe
Descriptive Name	Malicious code perpetrator execution
Description	A perpetrator executes malicious code either remotely or locally.
Selection Guidance	If the human is the threat agent and is the perpetrator, the likelihood of attack being accidental is low. This attack execution can be at the time of the download or later after the code has been downloaded. The perpetrator would have to have to gain access to the system to execute the code if it is at a later time then the original download.
Countermeasure Application	Choose O.Admin_Code_Val and/or O.Remote_Execution to prevent execution of potentially malicious code; choose O.I&A_User_Action, and perhaps O.Trusted_Path or O.Trusted_Path&Channel to support O.Admin_Code_Val. Choose O.Code_Signing and O.General_Integ_Checks to detect the attack. Choose O.Isolate_Executables to limit results of the attack. Choose O.Clean_Obj_Recovery to recover from the attack after it has occurred.
Editorial
Attack-Countering Objectives Admin_Code_Val - Administrative validation of executables Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification General_Integ_Checks - Periodically check integrity I&A_User_Action - User-action identification and authentication Isolate_Executables - Isolate untrusted executables `Objective Rationale` - These controls offer the user protection against maliciously executed code: (a) by constraining those individuals that can execute code, and/or (b) by constraining what damage maliciously executed code may do to protected data. Remote_Execution - Disable remote execution Trusted_Path - Provide a trusted path Trusted_Path&Channel - Trusted path and channel
Identifier	Mal_Code_IT_Download
Descriptive Name	Malicious code accidental IT download
Description	An IT device accidentally transfers or downloads malicious code to itself or other device that it can influence.
Selection Guidance	The dissemination of the malicious code can be done by an IT device automatically (email server, router, etc.). Also, an IT device can either push or pull the malicious code using processes that are designed to perform such actions. To determine the attitude of the IT device one would have to look at the intent of the OS and application software programmers, the system administrators and operators. But by normal design these devices are not maliciously derived. Therefore, an IT device is normally disseminating malicious code in a neglectful or unintentional manner. The devices do not normally include functionality to detect malicious code.
Countermeasure Application	Choose O.Code_Signing and O.General_Integ_Checks to detect the attack. Choose O.Input_Inspection and O.Obj_Protection to detect the attack before it can lead to harm. Choose O.Clean_Obj_Recovery to recover from the attack after it has occurred.
Editorial
Attack-Countering Objectives Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification General_Integ_Checks - Periodically check integrity Input_Inspection - Require inspection for absence of malicious code. `Objective Application` - Specify inspection for absence of malicious code. Obj_Protection - Object domain protection
Identifier	Mal_Code_IT_Exe
Descriptive Name	Malicious code IT execution
Description	An IT device under normal operations enters a state required to execute the malicious code.
Selection Guidance	The execution of malicious code is done through a triggering event. If the triggering event were automatically triggered through some state of the infected system, the potential threat agent would be the system itself.
Countermeasure Application	Choose O.Admin_Code_Val to prevent execution of potentially malicious code; choose O.I&A_User_Action to support O.Admin_Code_Val. Choose O.Code_Signing and O.General_Integ_Checks to detect the attack. Choose O.Isolate_Executables to limit results of the attack. Choose O.Clean_Obj_Recovery to recover from the attack after it has occurred.
Editorial
Attack-Countering Objectives Admin_Code_Val - Administrative validation of executables Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification General_Integ_Checks - Periodically check integrity I&A_User_Action - User-action identification and authentication Isolate_Executables - Isolate untrusted executables
Identifier	Mal_Code_Usr_Downld
Descriptive Name	Malicious code accidental user download
Description	An authorized user accidentally downloads malicious code.
Selection Guidance	For example, the user can effect the dissemination of the code by using push or pull technologies (email, ftp, http gets, Java applets, etc.). The nature of the user that disseminates the code can be a person who is performing normal day-to-day functions and accidentally disseminates the code.
Countermeasure Application	Choose O.Obj_Protection to limit opportunities. Choose O.Code_Signing to limit opportunities for the attack. Choose O.Input_Inspection to detect and prevent the attack before it lead to damage.
Editorial
Attack-Countering Objectives Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification Input_Inspection - Require inspection for absence of malicious code. Obj_Protection - Object domain protection
Identifier	Mal_Code_Usr_Exe
Descriptive Name	Malicious code user execution
Description	An authorized user executes malicious code accidentally.
Selection Guidance	For example, an authorized user may complete an action that triggers the execution of malicious code. This triggering event could be either by starting an executable piece of code, causing the IT system to get to a state upon which the execution takes place, or where an object that has been modified is accessed.
Countermeasure Application	Choose O.Admin_Code_Val to prevent execution of potentially malicious code; choose O.I&A_User_Action to support O.Admin_Code_Val. Choose O.Code_Signing and O.General_Integ_Checks to detect the attack. Choose O.Isolate_Executables to limit results of the attack. Choose O.Clean_Obj_Recovery to recover from the attack after it has occurred.
Editorial
Attack-Countering Objectives Admin_Code_Val - Administrative validation of executables Clean_Obj_Recovery - Object and data recovery free from malicious code Code_Signing - Code signing and verification General_Integ_Checks - Periodically check integrity I&A_User_Action - User-action identification and authentication Isolate_Executables - Isolate untrusted executables
Identifier	Phys_CompFail_Res
Descriptive Name	Resource depletion failure
Description	A system allocates so many resources that not enough are left for a critical component to function correctly.
Selection Guidance	For example, a user starts so many processes that the process table fills and a critical system process cannot start, or claims so much disk space that not enough is left for audit storage.
Countermeasure Application
Editorial
Attack-Countering Objectives Priority_Of_Service - Provide priority of service Resource_Quotas - Resource quotas for users and services
Identifier	Power_Disrupt_Reset
Descriptive Name	Unexpected power reset
Description	An unintentional, malicious, or environmentally caused power reset occurs, resulting in the loss of critical information or the system to enter a non-secure state.
Selection Guidance	For example, a system administrator may accidentally hit the system "reset" button while operating on a TSF database, and have its contents corrupted with insecure values.
Countermeasure Application	Choose either O.Trusted_Recovery or O.Atomic_Functions, or both. --- For both alternatives, O.Trusted_Recovery provides the capability to recover from power failures and O.Atomic_Functions automatically recovers and prevents the loss of security protection.
Editorial
Attack-Countering Objectives Atomic_Functions - Complete security functions or recover to previous state `X-Ray Application` - FPT_RCV.4: Specify the applicable security functions for which the PP will provide protection, and specify failures resulting from disruption of the power supply. `Objective Rationale` - If a power disruption or unintential system reset were to occur without the protection provided here, the contents of security attributes or other TSF-critical data could be corrupted. This objective addresses environmental power disruptions and unintentional system resets by providing automatic recovery from those failures. This also prevents the loss of security protection by avoiding insecure states that could result from partially completed, security-critical operations. Trusted_Recovery - Trusted recovery of security functionality `Objective Application` - Any variant of this objective is applicable to this attack. Each variant addresses system recovery to a secure state and may prevent security violations that would result from operating the system in an insecure state. `X-Ray Application` - FPT_RCV.1: No operations. FPT_RCV.2: Specify failures that correspond to unexpected power disruption. FPT_RCV.3: Specify failures that correspond to unexpected power disruption. `Objective Rationale` - The degree of functionality chosen should justify the claim that the effects of power disruptions to the TOE have been adequately addressed.
Identifier	Repudiate_Rcvr_Int
Descriptive Name	Denial of having received data from another local user
Description	A local, authorized user receives a message from another local user via the system, and then denies having received it. This typically affects the sender of the message who is counting on responsibilities associated with receipt of the message.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of receiving the message (e.g., payment for information received).
Countermeasure Application	O.NonRepud_Locals_Rcvd not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in user documentation.
Editorial
Attack-Countering Objectives NonRepud_Locals_Rcvd - Non-repudiation for received information, local users
Identifier	Repudiate_Rcvr_Local
Descriptive Name	Denial of having received information from a remote user
Description	A local, authorized user receives a message from another user at a remote trusted product, and then denies having received it.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of receiving the message (e.g., payment for information received).
Countermeasure Application	Choose O.NonRepud_Gen_Recd and allocate this objective to the TOE. This objective not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in user documentation. In the event that the nonrepudiation evidence is generated for a remote user or administrator, also choose objective O.NonRepud_Assess_Recd, allocating this objective to the environment.
Editorial
Attack-Countering Objectives NonRepud_Assess_Recd - Non-repudiation support for received information by a nonlocal sender's TSF `Objective Application` - This objective is allocated to the environment and addresses the case where those who handle nonrepudiation evidence are not associated with the TOE (e.g., the remote sender or a remote third party). In the statement of the objective, these people are referred to as "remote". NonRepud_Gen_Recd - Non-repudiation support for received information by the recipient's TSF `Objective Application` - This objective is allocated to the TOE, since the receiving user is local. When applying this objective, the term "receiving user" is interpreted to be the local user of the TOE that is repudiating receipt of the message.
Identifier	Repudiate_Rcvr_Rem
Descriptive Name	Denial of having received information by a remote user
Description	A local, authorized user sends a message to another user at a remote trusted product who then denies having received it.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of receiving the message (e.g., payment for information received).
Countermeasure Application	Choose O.NonRepud_Gen_Recd and allocate this objective to the IT environment. This objective not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in remote user documentation. In the event that the nonrepudiation evidence is generated for a local user or administrator, also choose objective O.NonRepud_Assess_Recd, allocating this objective to the TOE.
Editorial
Attack-Countering Objectives NonRepud_Assess_Recd - Non-repudiation support for received information by a nonlocal sender's TSF `Objective Application` - This objective is allocated to the TOE and addresses the case where those who handle nonrepudiation evidence are associated with the TOE (e.g., the local sender or a local third party). In the statement of the objective, however, these people are referred to as "remote". NonRepud_Gen_Recd - Non-repudiation support for received information by the recipient's TSF `Objective Application` - This objective is allocated to the environment, since the receiving user is remote. When applying this objective, the term "receiving user" is interpreted to be the user of a remote trusted system who is repudiating receipt of the message.
Identifier	Repudiate_Send_Int
Descriptive Name	Denial of having sent information to another local user
Description	A local, authorized user sends a message to another local user via the system, and then denies having done it. This affects the recipient of the message as well as any resources allocated or modified by the recipient in response to the message.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of sending the message (e.g., retaliation for sending false or confidential information).
Countermeasure Application	O.NonRepud_Locals_Sent not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in user documentation.
Editorial
Attack-Countering Objectives NonRepud_Locals_Sent - Non-repudiation for sent information, local users
Identifier	Repudiate_Send_Local
Descriptive Name	Denial of having sent information to a remote user
Description	A local, authorized user sends a message to another user at a remote trusted product, and then denies having done it. This affects the recipient of the message as well as any resources allocated or modified by the recipient in response to the message.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of sending the message (e.g., retaliation for sending false or confidential information).
Countermeasure Application	Choose O.NonRepud_Gen_Sent and allocate this objective to the TOE. This objective not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in user documentation. In the event that the nonrepudiation evidence is generated for a remote user or administrator, also choose objective O.NonRepud_Assess_Sent, allocating this objective to the environment.
Editorial
Attack-Countering Objectives NonRepud_Assess_Sent - Non-repudiation support for sent information by the nonlocal receiving TSF. `Objective Application` - This objective is allocated to the environment and addresses the case where those who handle nonrepudiation evidence are not associated with the TOE (e.g., the remote recipient or a remote third party). In the statement of the objective, these people are referred to as "remote". NonRepud_Gen_Sent - Non-repudiation support for sent information by the sender's TSF. `Objective Application` - This objective is allocated to the TOE, since the sending user is local. When applying this objective, the term "sending user" is interpreted to be a local user of the TOE that is repudiating sending of the message.
Identifier	Repudiate_Send_Rem
Descriptive Name	Denial of having sent data by a remote user
Description	A local, authorized user receives a message from another user at a remote trusted product who then denies having sent it. This affects the recipient of the message as well as any resources allocated or modified by the recipient in response to the message.
Selection Guidance	Typically, the denial is made in order to evade responsibilities incurred as a result of sending the message (e.g., retaliation for sending false or confidential information).
Countermeasure Application	Choose O.NonRepud_Gen_Sent and allocate this objective to the IT Environment. This objective not only detects repudiation but prevents avoidance of accountability. The preventive effect may be more effective if it is advertised in user documentation for the remote user. In the event that the nonrepudiation evidence is generated for the recipient or a local administrator, also choose objective O.NonRepud_Assess_Sent, allocating this objective to the TOE.
Editorial
Attack-Countering Objectives NonRepud_Assess_Sent - Non-repudiation support for sent information by the nonlocal receiving TSF. `Objective Application` - This objective is allocated to the TOE and addresses the case where those who handle nonrepudiation evidence are associated with the TOE (e.g., the remote recipient or a remote third party). In the statement of the objective, these people are referred to as "remote" despite being "local" in the context of this attack. NonRepud_Gen_Sent - Non-repudiation support for sent information by the sender's TSF. `Objective Application` - This objective is allocated to the environment, since the sending user is remote. When applying this objective, the term "sending user" is interpreted to be a remote user in the TOE environment that is repudiating sending of the message.
Identifier	Repudiate_Trans_Loc
Descriptive Name	Circumvent non-repudiation in a transaction involving a user and a local system
Description	An authorized user participates in a transaction by responding to system/application prompts and then denies that the dialogue took place. The user and system/application are collocated.
Selection Guidance	An example of such a transaction is a user that updates a local database.
Countermeasure Application	Choose O.NonRepud_Locals_Rcvd, O.NonRepud_Locals_Sent, and O.I&A_Transaction. Be careful to use consistent component applications (e.g., so that the same administrator is cognizant of all nonrepudiation evidence for events in a given transaction).
Editorial
Attack-Countering Objectives I&A_Transaction - Transaction identification and authentication NonRepud_Locals_Rcvd - Non-repudiation for received information, local users NonRepud_Locals_Sent - Non-repudiation for sent information, local users
Identifier	Repudiate_Trans_Uloc
Descriptive Name	Circumvent non-repudiation in a transaction involving a local user and a remote system
Description	An authorized user participates in a transaction by responding to remote system/application prompts and then denies that the dialogue took place.
Selection Guidance	This attack is seen from the perspective of the potential threat agent, who may require credibility in order to perform the transaction. An example of such a transaction is a user that performs a purchase over the Internet and the seller requires protection from repudiation by the buyer who doesn't want to pay.
Countermeasure Application	Choose O.I&A_Transaction. Choose the following objectives allocated to TOE or environment as indicated: O.NonRepud_Gen_Recd allocated to the TOE O.NonRepud_Gen_Sent allocated to the TOE O.NonRepud_Assess_Recd allocated to the environment O.NonRepud_Assess_Sent allocated to the environment. Be careful to use consistent component applications (e.g., so that the same user or administrator is cognizant of all nonrepudiation evidence for events in a given transaction).
Editorial
Attack-Countering Objectives I&A_Transaction - Transaction identification and authentication NonRepud_Assess_Recd - Non-repudiation support for received information by a nonlocal sender's TSF `Objective Application` - This objective is allocated to the environment and addresses the likely case where those who handle nonrepudiation evidence are associated with the remote system/application defining the transaction. In this case, the sending "user" is the system or application that defines the transaction. NonRepud_Assess_Sent - Non-repudiation support for sent information by the nonlocal receiving TSF. `Objective Application` - This objective is allocated to the environment and addresses the likely case where those who handle nonrepudiation evidence are not associated with the TOE (e.g., the remote recipient or a remote third party). The remote recipient, in this case, is the remote system/application defining the transaction. NonRepud_Gen_Recd - Non-repudiation support for received information by the recipient's TSF `Objective Application` - This objective is allocated to the TOE, since the receiving user is local. In this case, the sending "user" is the system or application that defines the transaction. NonRepud_Gen_Sent - Non-repudiation support for sent information by the sender's TSF. `Objective Application` - This objective is allocated to the TOE, since the sending user is local. In this case, the recipient is the system/application that defines the transaction.
Identifier	Repudiate_Trans_Urem
Descriptive Name	Circumvent non-repudiation in a transaction involving a remote user and a local system
Description	An authorized remote user participates in a transaction by responding to local system/application prompts and then denies that the dialogue took place.
Selection Guidance	An example of such a transaction is a remote user who performs a purchase over the Internet, and the local seller requires protection from repudiation by the buyer who doesn't want to pay.
Countermeasure Application	Choose O.I&A_Transaction. Choose the following objectives allocated to TOE or environment as indicated: O.NonRepud_Gen_Recd allocated to the environment O.NonRepud_Gen_Sent allocated to the environment O.NonRepud_Assess_Recd allocated to the TOE O.NonRepud_Assess_Sent allocated to the TOE Be careful to use consistent component applications (e.g., so that the same user or administrator is cognizant of all nonrepudiation evidence for events in a given transaction).
Editorial
Attack-Countering Objectives I&A_Transaction - Transaction identification and authentication NonRepud_Assess_Recd - Non-repudiation support for received information by a nonlocal sender's TSF `Objective Application` - This objective is allocated to the TOE and addresses the likely case where those who handle nonrepudiation evidence are associated with the TOE (e.g., the local sender or a local third party). NonRepud_Assess_Sent - Non-repudiation support for sent information by the nonlocal receiving TSF. `Objective Application` - This objective is allocated to the TOE and addresses the case where those who handle nonrepudiation evidence are associated with the TOE (e.g., the remote recipient or a remote third party). NonRepud_Gen_Recd - Non-repudiation support for received information by the recipient's TSF `Objective Application` - This objective is allocated to the environment, since the receiving user is remote. NonRepud_Gen_Sent - Non-repudiation support for sent information by the sender's TSF. `Objective Application` - This objective is allocated to the environment, since the sending user is remote.
Identifier	Software_Flaw
Descriptive Name	System use uncovers an intrinsic software flaw in a critical system component
Description	An authorized user performs an operation or set of operations, exercising a software flaw in a security-critical component.
Selection Guidance	The flaw may be a result of design or implementation errors. An example of this attack is when a hostile user performs stress testing that causes an operating system to enter an unsecure state.
Countermeasure Application	Choose O.Fail_Secure to prevent the loss of security protection. Choose both O.Fail_Secure and O.Fault_Tolerance to prevent the loss of security protection and to provide availability. Objectives that counter this attack should be supplemented with assurance requirements commensurate with the desired degree of protection.
Editorial
Attack-Countering Objectives Fail_Secure - Preservation of secure state for failures in critical components `Objective Application` - Specialize this objective to prevent the loss of security protection by preserving the TOE's secure state in the presence of specific software failures. `X-Ray Application` - FPT_FLS.1: List the types of software failures for which the TOE guarantees it will "fail safe" (i.e., protect its secure state). The definition of secure state should capture critical aspects of the security design that could be violated as a result of the identified software failures. `Objective Rationale` - The definition of a secure state may regard missing functionality or TOE inoperability as "secure," unless availability is a concern. Fault_Tolerance - Provide fault tolerant operations for critical components `Objective Application` - Both variants are capable of protecting security-relevant functionality and may address availability in the general sense. The [Resistant] variant provides more comprehensive protection. Some software components are intrinsic to TSF enforcement, while others may affect TOE functional capabilities. Both examples should be considered when specializing the objective. `X-Ray Application` - FRU_FLT.1: Specify the relevant software components and list the associated failures to which each must be tolerant. FRU_FLT.2: List the associated failures to which all TOE software capabilities must be resistant. `Objective Rationale` - Explain the identified software components and the failures to which they are tolerant and/or resistant, with regard to the nature of protection being provided. If the [Basic] variant is used, protection is provided by avoiding the consequences of the attack. If the [Resistant] variant is used, the attack is prevented for the specified cases.
Identifier	TSF_Err_Conf_Crypto
Descriptive Name	Accidental release of cryptographic assets due to TSF flaw or malfunction
Description	The TSF accidentally releases sensitive plaintext data, red keys, or other cryptographic assets to an inappropriate audience.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Crypto_Data_Sep - Separation of cryptographic data Crypto_Dsgn_Impl - Cryptographic Design and Implementation Crypto_Key_Man - Cryptographic Key Management Crypto_Modular_Dsgn - Cryptographic Modular Design Crypto_Operation - Cryptographic function definition Crypto_Self_Test - Cryptographic self test Crypto_Test_Reqs - Test cryptographic functionality Fail_Secure - Preservation of secure state for failures in critical components `Objective Application` - Preserve secure state in case of cryptographic failure. To do this, it may be necessary to zeroize all cryptographic registers that contain red keys or partially encrypted data. Secure_State - Protect and maintain secure system state `Objective Application` - Define secure state so as to facilitate detection of: a) Any failure that may allow the TOE to output unencrypted cryptographic keys, plaintext sensitive data, or other secret cryptographic security parameters; b) Failure of a cryptographic function; c) TOE physical tampering (including environmental failure). To maintain a secure state, it may be necessary to halt cryptographic operations and related I/O activity. It may also require the zeroizing of critical registers and keys.
Identifier	User_Abuse_Conf_Disk
Descriptive Name	User smuggles data using removable media
Description	A user collects sensitive or proprietary information and improperly removes it from the system by putting it on removable media.
Selection Guidance
Countermeasure Application	Choose O.Audit_Account objective to provide user accountability. Choose O.User_Defined_AC and/or O.Info_Flow_Control to prevent the gathering of arbitrary user data. Choose O.Data_Imp_Exp_Control to prevent the attack by restricting what can be written to removable media. Choose O.Admin_Guidance to support O.Data_Imp_Exp_Control.
Editorial
Attack-Countering Objectives Admin_Guidance - Administrator guidance documentation `X-Ray Application` - AGD_ADM.1: Provide the administrator with the guidacne need to restrict access to removable media devices. Audit_Account - Auditing for user accountability `X-Ray Application` - FAU_GEN.1: Include in the list of auditable events writing to removable media. Data_Export_Control - Control user data exportation `Objective Application` - Choose the [Unmarked] variant of this objective. `X-Ray Application` - FDP_ETC.1: Include rules in the information flow control policy that exclude writing sensitive or proprietary information to removable media.
Identifier	User_Abuse_Conf_Steg
Descriptive Name	Steganographic data smuggling
Description	An authorized user hides sensitive information in an innocuous-appearing file, for the purpose of covertly passing it to an unauthorized party. The hidden data is undetectable to anyone using the file for its intended purpose, but can be recovered using special techniques.
Selection Guidance	This attack is relevant to systems that contain data of varying sensitivities and provide greater opportunity for disseminating less sensitive information. In a typical attack, the user embeds sensitive information in a digitally encoded picture or audio file, where the added bits do not significantly modify the perceived image or sound track. Another example is to embed information in unused or under-populated fields in a message header. Document processors provide still more examples by providing hidden fields that give information about the document processor's software license number, the document's author, or the identity of the computer being used. In particular, word processors are providing an increasing array of information-hiding techniques for their users to employ, including hidden comment tags, hidden text, autotext, conditional text, document variables, hidden macros, previous-version data, uncollected "garbage," and more. This attack is traditionally considered to be deliberate, as good steganographic techniques are unlikely to be accidental. However, word processors are increasingly making accidental steganography easy, if not unavoidable. Steganographic smuggling can be difficult to detect on the basis of direct evidence. Without knowing the decryption technique, it is usually not feasible to tell steganographicly encrypted data from unencrypted data. However, there are some defenses against it.
Countermeasure Application	Choose O.Admin_Code_Val_Sten to avoid the use of programs that might be capable of performing steganographic hiding. Choose O.Data_Export_Control to sanitize outputs to make steganography more difficult. Choose O.Standard_Output_Pres to require the use of highly structured objects in which all data is both visible and needed, leaving no place for steganographic data to hide.
Editorial
Attack-Countering Objectives Admin_Code_Val - Administrative validation of executables Admin_Code_Val_Sten - Software validation for absence of steganography Export_Control - Sanitize data objects containing hidden or unused data Standard_Output_Pres - Standard presentation of output values
Identifier	User_Collect_Browse
Descriptive Name	User collects data by browsing
Description	An authorized user abuses granted authorizations by browsing files in order to collect data.
Selection Guidance
Countermeasure Application	To detect this attack, choose the O.Audit_Generation objective. To prevent this attack, choose the O.User_Defined_AC and O.Info_Flow_Control objectives.
Editorial
Attack-Countering Objectives Audit_Account - Auditing for user accountability `X-Ray Application` - FAU_GEN.1: Specify the generation of audit records that record user data-collection activities. Info_Flow_Control - System enforced information flow User_Defined_AC - User-defined access control
Identifier	User_Collect_Deceive
Descriptive Name	User collects authentication data by deception
Description	An authorized user steals authentication data by emulating a login procedure on an active terminal.
Selection Guidance	For example, a user programs a terminal or workstation to simulate an inactive status, allowing that user to intercept authentication data or other confidential data that other users exchange with the terminal when they attempt to log in.
Countermeasure Application	To detect this attack, choose the O.Access_History objective. To prevent this attack, choose the O.Trusted_Path objective.
Editorial
Attack-Countering Objectives Access_History - Access history for user session Trusted_Path - Provide a trusted path
Identifier	User_Collect_Deduce
Descriptive Name	User collects data by deduction
Description	An authorized user abuses granted authorizations by repeatedly accessing aggregate data in order to deduce specific, sensitive data.
Selection Guidance	For example, a user with access to aggregated data, employing carefully planned queries, can compute or otherwise deduce the value of specific data elements to which he is not authorized. The user may ask for the average cost of a certain collection of nine projects and then for the average cost of those nine plus a tenth project. Each response gives no specific information about any of the projects and a user with a minimal right to know may be allowed this information. However, it is a simple task for him to use the two responses to compute the exact cost of the tenth project, information he may not be authorized to obtain.
Countermeasure Application	To detect this attack, choose the O.Audit_Generation objective. To prevent this attack, choose the O.User_Defined_AC and O.Info_Flow_Control objectives.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity Info_Flow_Control - System enforced information flow User_Defined_AC - User-defined access control
Identifier	User_Collect_Eaves
Descriptive Name	User collects data by eavesdropping
Description	An authorized user abuses granted authorizations by eavesdropping on communication lines in order to collect data.
Selection Guidance	For example, a user configures network software to collect network packets not addressed to the user's workstation.
Countermeasure Application	To prevent this attack, choose O.Data_Exchange_Conf, O.Security_Roles, and O.Integ_User_Data_Int objectives.
Editorial
Attack-Countering Objectives Data_Exchange_Conf - Enforce data exchange confidentiality Integ_User_Data_Int - Protect user data during internal transfer Security_Roles - Security roles `X-Ray Application` - FMT_SMR.1, FMT_SMR.2: The authorised identified role: identified audit role.
Identifier	User_Collect_Residue
Descriptive Name	User collects residual data
Description	An authorized user collects residual data from public objects after prior usage.
Selection Guidance
Countermeasure Application	To prevent this attack, choose O.No_Residual_Info.
Editorial
Attack-Countering Objectives No_Residual_Info - Eliminate residual information
Identifier	User_Comm_Overload
Descriptive Name	User's unauthorized use causes overload of communication resources
Description	An authorized user exceeds the authorized use of communication resources during the system (TOE) operation. This causes a denial or delay in service to legitimate operations within the TOE scope of control.
Selection Guidance	This attack covers the case where excess use interferes with the TOE's ability to perform its security functions. Such would be the case if multiple user-generated concurrent communications sessions cause bandwidth overload. See also attack DA.Hack_Comm_Overload
Countermeasure Application
Editorial	1. When a user has the ability to give out information that could cause an outsider to send data that is not deemed acceptable by the organization's policy or from a location unacceptable by the organization's policy this objective should be considered (e.g. adult only web sites). 2. When a user has the ability to send data to inappropriate locations or to more locations than the organization's policy allows this objective should be considered. 3. When a hacker can flood the system (TOE) with illicit data, import control should be enforced.
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Record actions likely to result in overload of communication resources. `Objective Rationale` - Audit data should be generated when a threat agent uses services in manner that causes multiple attempts to exceed resource quotas. Data_Imp_Exp_Control - Data import/export to/from system control `Objective Application` - A user could send and/or receive unauthorized information. Therefore limits should be placed on the types of acceptable information flows and the limits on information flows. This would reduce bandwidth utilization and enforce organizational policy. `Objective Rationale` - Allowing data to or from locations not specified by the organization's policy could put excessive strain on bandwidth of communication lines and cause legitimate data flows to be delayed or denied. Limit_Comm_Sessions - Limit the number of user initiated communication sessions Priority_Of_Service - Provide priority of service Resource_Quotas - Resource quotas for users and services
Identifier	User_Err_AttrXpt
Descriptive Name	Falsification of information quality in data export
Description	An authorized user presents incorrect information, indicating to the recipient that it is correct, thereby encouraging the recipient to make unwarranted use of the information.
Selection Guidance	For example, user may misrepresent the authorship of the data or misrepresent the extent of review and approval behind it. This is an error of commission.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Label_Export - Object security attributes and exportation `X-Ray Application` - FDP_ACC.1: Choose SFPs dealing with information quality
Identifier	User_Err_Conf_Class
Descriptive Name	Under-classification of data sensitivity on export
Description	An authorized user presents confidential or classified information to a recipient, indicating that it is less sensitive than it really is, thereby encouraging the recipient to pass it along to other potentially inappropriate recipients.
Selection Guidance	For example, the user may misrepresent a copyright statement, military security classification, or public-release status. This may be an error of commission or omission depending on whether the information is properly labeled to begin with.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Label_Export - Object security attributes and exportation `Objective Application` - Specify an access control or information flow policy in which data is labeled according to its confidentiality or secrecy. `Objective Rationale` - Effectiveness depends on accuracy of stored security attributes, on user compliance with procedural constraints on the use of output devices, and on correct functioning of TSF access control mechanisms.
Identifier	User_Err_Conf_Crypto
Descriptive Name	Accidental release of cryptographic assets due to user error
Description	User error causes release of cryptographic assets to unauthorized recipients.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Crypto_AC - Cryptographic access control policy Crypto_Key_Man - Cryptographic Key Management I&A_Domain - Identify and authenticate a user to support accountability `Objective Application` - Specify role-related user attributes to assist in controlling user access to cryptographic assets. I&A_User_Action - User-action identification and authentication
Identifier	User_Err_Conf_Exp
Descriptive Name	Confidentiality violation of export control policy
Description	An authorized user exposes or exports data in violation of export control policy. The data may be private or classified, the recipient is not authorized to receive it.
Selection Guidance	Depending on the degree of automated support for confidentiality, this attack may well be accidental.
Countermeasure Application
Editorial
Attack-Countering Objectives User_Conf_Prevention - Basic confidentiality-breach prevention `Objective Rationale` - This is essentially just Bell-LaPadula star and simple security, no bells or whistles.
Identifier	User_Err_Delete
Descriptive Name	User error deletes data
Description	An authorized user accidentally deletes user data.
Selection Guidance	Examples include the following: User accidentally deletes data by striking the wrong key on the keyboard or by striking the enter key as an automatic response. User does not understand the implications of the prompt at hand and inadvertently gives a response that deletes user data. User misunderstands a system command and issues a command that unintentionally deletes user data.
Countermeasure Application
Editorial
Attack-Countering Objectives Rollback - Rollback User_Guidance - User guidance documentation `X-Ray Application` - AGD_USR.1: User documentation shall address user errors that lead to loss of data.
Identifier	User_Err_Mod_Attr
Descriptive Name	User error modifying attributes availability
Description	An authorized user erroneously modifies the initial security attributes of user data, which makes the data inaccessible.
Selection Guidance	Examples include the following: User accidentally modifies data attributes incorrectly by striking the wrong key on the keyboard or by striking the enter key as an automatic response and thus makes the data inaccessible. User does not understand the implications of the prompt at hand and inadvertently gives a response that modifies data attributes incorrectly. The resulting attributes make the data inaccessible. User misunderstands a system command and issues a command that unintentionally modifies data attributes incorrectly. The resulting attributes make the data inaccessible.
Countermeasure Application
Editorial
Attack-Countering Objectives Security_Attr_Mgt - Manage security attributes User_Guidance - User guidance documentation `X-Ray Application` - AGD_USR.1: User documentation shall address user errors that lead to inaccessibility of user data.
Identifier	User_Err_MsngAttrXpt
Descriptive Name	Failure to provide object security attributes in data export
Description	An authorized user deliberately or accidentally exports data so that the data is not accompanied by required handling information.
Selection Guidance	Examples of required handling information include copyright statement, military security classification, authorship, and review status. This attack may also cause integrity and confidentiality breaches: The user may present incorrect information without warning the recipient that it may be incorrect, thereby causing the recipient to make unwarranted use of the information. The user may present confidential or classified information without mentioning its sensitivity, thereby causing the authorized recipient to pass the information along to unauthorized recipients.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Label_Export - Object security attributes and exportation
Identifier	User_Err_Object_Attr
Descriptive Name	Incorrectly set object attributes
Description	An authorized user sets an object's security attributes inappropriately, misdirecting its use. The misdirection may allow unauthorized reading or modification, or it may prohibit authorized reading or modification.
Selection Guidance	The error may occur either through ignorance or accidentally as a side-effect of other actions.
Countermeasure Application
Editorial
Attack-Countering Objectives AC_Label_Export - Object security attributes and exportation Obj_Attr_Integrity - Basic object attribute integrity
Identifier	User_Err_Set_Attr
Descriptive Name	User error setting attributes availability
Description	An authorized user erroneously sets the initial security attributes of user data, which makes the data inaccessible.
Selection Guidance	Examples include the following: User accidentally sets initial data attributes incorrectly by striking the wrong key on the keyboard or by striking the enter key as an automatic response and thus makes the data inaccessible. User does not understand the implications of the prompt at hand and inadvertently gives a response that sets initial data attributes incorrectly. The resulting attributes make the data inaccessible. User misunderstands a system command and issues a command that unintentionally sets initial data attributes incorrectly. The resulting attributes make the data inaccessible.
Countermeasure Application
Editorial
Attack-Countering Objectives Security_Attr_Mgt - Manage security attributes User_Guidance - User guidance documentation `X-Ray Application` - AGD_USR.1: User documentation shall address user errors that lead to inaccessibility of user data.
Identifier	User_ErrAvl_AudExhst
Descriptive Name	Denial of service due to exhausted audit storage
Description	An authorized user's actions generate so many audit records that audit storage space is exhausted and the system subsequently denies further service until audit storage becomes available.
Selection Guidance	The relevancy in this attack is a product of a user using resources, storage area (memory or disk space) to an extent that the area designated for use by audit data is no longer available. This would happen when the OS does dynamic allocation of storage area for multiple needs.
Countermeasure Application
Editorial
Attack-Countering Objectives Audit_Loss_Respond - Respond to possible loss of stored audit records Guarantee_Audit_Stg - Guarantee the availability of audit storage space Manage_TSF_Data - Manage security-critical data to avoid storage space being exceeded
Identifier	User_Modify_Audit
Descriptive Name	User modifies audit trail
Description	An authorized user modifies audit data or audit attributes to avoid accountability.
Selection Guidance	Examples include the following: A user frames another user by modifying audit data in such a way that it seems to prove misconduct on the part of the user being framed. User sets audit attributes in such a way as to allow inadmissible activities to go unaudited.
Countermeasure Application	To detect this attack, consider O.Audit_Generation and O.Audit_Gen_User. To prevent this attack, consider O.Audit_Protect and O.Security_Roles.
Editorial
Attack-Countering Objectives Audit_Gen_User - Individual accountability Audit_Generation - Audit records with identity Audit_Protect - Protect stored audit records Security_Roles - Security roles `X-Ray Application` - FMT_SMR.1, FMT_SMR.2: The authorised identified role: identified audit role.
Identifier	User_Modify_Auth
Descriptive Name	User improperly modifies authentication data
Description	An authorized user changes the authentication data of another user without first masquerading as that user, in a manner that is not consistent with organizational security policy.
Selection Guidance
Countermeasure Application	To detect this attack, consider the O.Audit_Account objective. To prevent this attack, consider O.Security_Data_Mgt objective applied to authentication data.
Editorial
Attack-Countering Objectives Audit_Account - Auditing for user accountability `X-Ray Application` - FAU_GEN.1: Specify auditing of changes to authentication data. Security_Data_Mgt - Manage security-critical data `Objective Application` - Choose the [Basic] variant of this objective. `X-Ray Application` - FMT_MTD.1: Ensure that authentication data is included in the list of TSF data and is protected from unauthorized modification.
Identifier	User_Modify_Data
Descriptive Name	User improperly modifies user data
Description	An authorized user modifies or deletes user data in violation of organizational policy.
Selection Guidance	For example, a user erroneously or deliberately overwrites data so that erroneous data is now marked as correct.
Countermeasure Application	To detect this attack, consider the O.Audit_Generation. To prevent this attack, consider the O.User_Defined_AC or O.Info_Flow_Control.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Specify auditing of modifications to user data. Info_Flow_Control - System enforced information flow User_Defined_AC - User-defined access control
Identifier	User_Modify_TSFData
Descriptive Name	User improperly modifies TSF data
Description	User modifies or deletes TSF data undermining security protection.
Selection Guidance	For example, a user gains access to the TSF and modifies TSF data.
Countermeasure Application	Choose O.General_Integ_Checks and O.Audit_Generation to detect this attack. Choose O.User_Defined_AC or O.Info_Flow_Control, together with O.Maintain_Sec_Domain and O.Reference_Monitor to prevent this attack. Choose O.Config_Management, O.Integ_Sys_Data_Int, and O.Integrity_Practice to recover from this attack.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity Config_Management - Implement operational configuration management General_Integ_Checks - Periodically check integrity Info_Flow_Control - System enforced information flow Integ_Sys_Data_Int - Integrity of system data transferred internally Integrity_Practice - Operational integrity system function testing Maintain_Sec_Domain - Maintain security domain Reference_Monitor - Provide reference monitor User_Defined_AC - User-defined access control
Identifier	User_Obst_Res_Use
Descriptive Name	User obstructs legitimate use of resources.
Description	An authorized user obstructs the use resources by unauthorized modification of data file, communication channel, or object security attributes.
Selection Guidance	This attack is relevant when a user has the ability to modify a data file, communication channel, or object security attributes that could deny the affected resource to a legitimate user.
Countermeasure Application	Choose O.Tamper_Resistance or O.Tamper_ID if the resource is subject to physical attack. Choose O.Manage_Res_Sec_Attr if incorrect or missing security attributes can result in loss of object availability. Choose O.Priority_of_Service if potential threat agents include legitimate users.
Editorial
Attack-Countering Objectives Manage_Res_Sec_Attr - Manage resource security attributes Priority_Of_Service - Provide priority of service Tamper_ID - Tamper detection Tamper_Resistance - Tamper resistance
Identifier	User_Prcsr_Overload
Descriptive Name	User's unauthorized actions over-task the system causing processor overload
Description	The system (TOE) has been over-tasked and can not complete the assigned tasking at all or in an expected amount of time. The user invokes processing functions in association with unauthorized activity that leads to overburdening processing resources on the TOE.
Selection Guidance	This attack is only relevant when processing resources may not be adequate to handle all potential processes. Therefore if processing capability will never be overburdened do not include this attack.
Countermeasure Application	Choose O.Limit_Comm_Sessions if the user can cause processor overload by use of multiple sessions. Choose O.Priority_Of_Service if non-priority services can use processor resources that critical services need. Choose O.Resource_Quotas if particular services or applications the user starts should be given resource quotas to allow them to run as expected. Choose O.Audit_Generation to detect the attack.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Those events that are likely to be associated with task overloading. Limit_Comm_Sessions - Limit the number of user initiated communication sessions Priority_Of_Service - Provide priority of service `Objective Application` - Heuristically give priority to those users that are least likely to cause task overloading. Resource_Quotas - Resource quotas for users and services
Identifier	User_Send_Conf
Descriptive Name	User sends data violating confidentiality
Description	An authorized user abuses granted authorizations and violates export control policy by sending data to a recipient who is not authorized to receive the data.
Selection Guidance
Countermeasure Application	Choose O.Audit_Generation to detect this attack. Choose O.Integ_Data_Mark_Exp to prevent this attack.
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Specify auditing of exported data. Integ_Data_Mark_Exp - Data marking integrity export `Objective Application` - Specify labels that reflect data confidentiality or secrecy.
Identifier	User_Send_Integrity
Descriptive Name	User sends data violating integrity
Description	An authorized user deliberately exports data inappropriately, with the result that there is a lack of required quality control on the exported data.
Selection Guidance
Countermeasure Application
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Specify auditing of exported data. Integ_Data_Mark_Exp - Data marking integrity export `Objective Application` - Specify labels that reflect integrity of data or information content.
Identifier	User_Stg_Overload
Descriptive Name	User's unauthorized actions cause storage overload
Description	An authorized user's unauthorized use of data storage causes a shortage of disk space for other users.
Selection Guidance	For example, a user continues to store unauthorized objects and data until storage limits are exceeded and the system can no longer operate correctly. This attack is not applicable if the user will never exceed the storage limits available for all possible operations during the system's lifetime.
Countermeasure Application
Editorial
Attack-Countering Objectives Audit_Generation - Audit records with identity `X-Ray Application` - FAU_GEN.1: Those events that are likely to be associated with storage overloading. `Objective Rationale` - Audit data should be generated when a threat agent uses services in manner that causes multiple attempts to exceed resource quotas. Limit_Comm_Sessions - Limit the number of user initiated communication sessions Priority_Of_Service - Provide priority of service `Objective Application` - Heuristically give priority to those users that are least likely to cause a storage overload. Resource_Quotas - Resource quotas for users and services