Typical Impact to Data or System Type ID Threat Name Description Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification An unauthorized user gains access to the audit trail and could cause audit Modification Unavailable Audit P records to be deleted or modified, or prevents future audit records from or Accurate Compromise being recorded, thus masking a security relevant event. Destruction Records Modification Denial of Bomb P An intentional explosion. or Service Destruction Denial of U, E Cut of fiber optic lines, trees falling on telephone lines. Failure Service Eavesdropping can occur via electronic media directed against large scale Compromising P electronic facilities that do not process classified National Security Disclosure Emanations Information. Unauthorized user could gain access to the information systems by Modification Cyber Brute Denial of P random or systematic guessing of passwords, possibly supported by Disclosure or Force Service password cracking utilities. Destruction Data An attacker uses techniques that could result in the disclosure of sensitive Disclosure P Disclosure information by exploiting weaknesses in the design or configuration. Attack Human inattention, lack of knowledge, and failure to cross-check system Data Entry U activities could contribute to errors becoming integrated and ingrained in Modification Error automated systems. An adversary uses techniques to attack a single target rendering it unable Denial of Denial of P to respond and could cause denial of service for users of the targeted Service Attack Service information systems.
ID Threat Name Type Description Typical Impact to Data or System Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification Audit Compromise P An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. Modification or Destruction Unavailable Accurate Records Bomb P An intentional explosion. Modification or Destruction Denial of Service Failure U, E Cut of fiber optic lines, trees falling on telephone lines. Denial of Service Compromising Emanations P Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. Disclosure Cyber Brute Force P Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. Disclosure Modification or Destruction Denial of Service Data Disclosure Attack P An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in the design or configuration. Disclosure Data Entry Error U Human inattention, lack of knowledge, and failure to cross-check system activities could contribute to errors becoming integrated and ingrained in automated systems. Modification Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service
FedRAMP-Annual-SAR-Template-v1.11.docx