Adversary attempts to acquire sensitive information such as Disclosure Modification or Denial of usernames, passwords, or SSNs, by pretending to be Destruction Service communications from a legitimate/trustworthy source. Phishing Attack P Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Power interruptions may be due to any number of reasons such Denial of Power as electrical grid failures, generator failures, uninterruptable Service E Interruptions power supply failures (e.g. spike, surge, brownout, or blackout). An error in procedures could result in unintended consequences. Disclosure Modification or Denial of Procedural Error U Destruction Service Procedural Violations of standard procedures. Disclosure Modification or Denial of P Violations Destruction Service Resource An errant (buggy) process may create a situation that exhausts Denial of U Exhaustion critical resources preventing access to services. Service Underhand interference with work. Modification or Denial of Sabotage P Destruction Service Searching through disposal containers (e.g. dumpsters) to Disclosure Scavenging P acquire unauthorized data. Naturally occurring forces of nature could disrupt the operation Destruction Denial of Severe Weather E of an information system by freezing, sleet, hail, heat, lightning, Service thunderstorms, tornados, or snowfall. An attacker manipulates people into performing actions or Disclosure Social P divulging confidential information, as well as possible access to Engineering computer systems or facilities. Software Unauthorized modification of software (e.g. files, programs, Modification or P Tampering database records) that alters the proper operational functions. Destruction
Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service Power Interruptions E Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g. spike, surge, brownout, or blackout). Denial of Service Procedural Error U An error in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service Sabotage P Underhand interference with work. Modification or Destruction Denial of Service Scavenging P Searching through disposal containers (e.g. dumpsters) to acquire unauthorized data. Disclosure Severe Weather E Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. Destruction Denial of Service Social Engineering P An attacker manipulates people into performing actions or divulging confidential information, as well as possible access to computer systems or facilities. Disclosure Software Tampering P Unauthorized modification of software (e.g. files, programs, database records) that alters the proper operational functions. Modification or Destruction
ESRMO-SAR-Template-v1.docx