ID Threat Name Type Description Typical Impact to Data or System Identifier Confidentiality Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification An unauthorized user gains access to the audit trail and could Modification or Unavailable Audit cause audit records to be deleted or modified, or prevents future Destruction Accurate P Compromise audit records from being recorded, thus masking a security Records relevant event. An intentional explosion. Modification or Denial of Bomb P Destruction Service Communications Cut of fiber optic lines, trees falling on telephone lines. Denial of U, E Failure Service Eavesdropping can occur via electronic media directed against Disclosure Compromising P large scale electronic facilities that do not process classified Emanations National Security Information. Unauthorized user could gain access to the information systems Disclosure Modification or Denial of Cyber Brute P by random or systematic guessing of passwords, possibly Destruction Service Force supported by password cracking utilities. An attacker uses techniques that could result in the disclosure of Disclosure Data Disclosure P sensitive information by exploiting weaknesses in the design or Attack configuration. Human inattention, lack of knowledge, and failure to Modification Data Entry Error U system activities could contribute to errors becoming integrated and ingrained in automated systems. An adversary uses techniques to attack a single target rendering Denial of Denial of Service P it unable to respond and could cause denial of service for users Service Attack of the targeted information systems. Distributed An adversary uses multiple compromised information systems Denial of Denial of Service P to attack a single target and could cause denial of service for Service Attack users of the targeted information systems. E Seismic activity can damage the information system or its Destruction Denial of Earthquake facility. Refer to the following document for earthquake Service probability maps .
ID Threat Name Type Identifier Description Typical Impact to Data or System Confidentiality Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification Audit Compromise P An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. Modification or Destruction Unavailable Accurate Records Bomb P An intentional explosion. Modification or Destruction Denial of Service Communications Failure U, E Cut of fiber optic lines, trees falling on telephone lines. Denial of Service Compromising Emanations P Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. Disclosure Cyber Brute Force P Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. Disclosure Modification or Destruction Denial of Service Data Disclosure Attack P An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in the design or configuration. Disclosure Data Entry Error U Human inattention, lack of knowledge, and failure to system activities could contribute to errors becoming integrated and ingrained in automated systems. Modification Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service Distributed Denial of Service Attack P An adversary uses multiple compromised information systems to attack a single target and could cause denial of service for users of the targeted information systems. Denial of Service Earthquake E Seismic activity can damage the information system or its facility. Refer to the following document for earthquake probability maps . Destruction Denial of Service
FedRAMP-SAR-Template-v2.0_1.docx