T-19 Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane could impact Destruction Denial of Service the facilities that house the information systems. T-20 Malicious P Software that damages a system such a virus, Trojan, or Modification Denial of Service Software worm. or Destruction T-21 Phishing Attack P Adversary attempts to acquire sensitive information such as Disclosure Modification Denial of Service usernames, passwords, or SSNs, by pretending to be or Destruction communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to web sites that appear to be legitimate sites, while actually stealing the entered information. T-22 Power E Power interruptions may be due to any number of reasons Denial of Service Interruptions such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g., spike, surge, brownout, or blackout). T-23 Procedural U An error in procedures could result in unintended Disclosure Modification Denial of Service Error consequences. or Destruction T-24 Procedural P Violations of standard procedures. Disclosure Modification Denial of Service Violations or Destruction T-25 Resource U An errant (buggy) process may create a situation that Denial of Service Exhaustion exhausts critical resources preventing access to services. T-26 Sabotage P Underhand interference with work. Modification Denial of Service or Destruction T-27 Scavenging P Searching through disposal containers (e.g., dumpsters) to Disclosure acquire unauthorized data. T-28 Severe Weather E Naturally occurring forces of nature could disrupt the Destruction Denial of Service operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall.
T-19 Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane could impact the facilities that house the information systems. Destruction Denial of Service T-20 Malicious Software P Software that damages a system such a virus, Trojan, or worm. Modification or Destruction Denial of Service T-21 Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service T-22 Power Interruptions E Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g., spike, surge, brownout, or blackout). Denial of Service T-23 Procedural Error U An error in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service T-24 Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service T-25 Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service T-26 Sabotage P Underhand interference with work. Modification or Destruction Denial of Service T-27 Scavenging P Searching through disposal containers (e.g., dumpsters) to acquire unauthorized data. Disclosure T-28 Severe Weather E Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. Destruction Denial of Service
FedRAMP-SAR-Template-v3.3-2.docx