|
0
|
Abuse.Grooming
|
The process of deliberately building an emotional connection with a person to lower their inhibitions for the purpose of sexual abuse, exploitation, or trafficking.
|
|
1
|
Abuse.Harassment
|
A pattern of unwanted, intrusive behavior (physical, verbal, or online) directed at a specific person that causes fear, distress, or emotional harm.
|
|
2
|
Abuse.Coercion
|
The practice of compelling an individual to act against their will by using force, threats, intimidation, or extreme dependency, often for personal or financial gain.
|
|
3
|
Abuse.Trafficking
|
The act of recruiting, transporting, transferring, harboring, or receiving a person through force, fraud, or coercion for the purpose of exploitation, such as forced labor or sexual servitude.
|
|
4
|
Abuse.Extermism
|
The process of socializing an individual, often through psychological manipulation, to adopt the beliefs and goals of a violent extremist group and become willing to engage in activities that support the group.
|
|
5
|
Abuse.Other
|
Any other incident involving manipulation or coercion of people for harmful purposes that does not fit into the specific abuse subcategories.
|
|
6
|
Access.Compromise
|
An incident where a legitimate user's credentials (e.g., username/password) are stolen or guessed and used by an unauthorized individual to gain access to systems or data.
|
|
7
|
Access.Escalation
|
An incident where a user or process gains access rights, permissions, or capabilities that exceed those normally assigned, often to bypass security restrictions.
|
|
8
|
Access.Backdoor
|
The installation or discovery of a concealed method of bypassing normal authentication or encryption in a computer system, product, or embedded device.
|
|
9
|
Access.Unauthorized
|
An incident involving physical entry into a restricted building, room, or area without proper authorization.This includes physical entry into a restricted building, room, or area, as well as digital access to systems, applications, networks, or data by an individual or process lacking valid credentials or authorization.
|
|
10
|
Access.Tailgating
|
A physical security breach where an unauthorized person follows an authorized individual through a secured entry point, circumventing access control mechanisms.
|
|
11
|
Access.Forced
|
An incident involving the use of physical force to breach a barrier (e.g., lock, door, window) or the repeated systematic guessing of passwords to gain unauthorized access.
|
|
12
|
Access.Lost
|
An incident where physical or digital access credentials (e.g., keys, ID badges, login details) are misplaced, stolen, or used by an unauthorized person.
|
|
13
|
Access.Clonned
|
The act of creating an unauthorized copy of a physical or digital security credential, such as an access card, to gain illicit entry to a facility or system.
|
|
14
|
Access.Authorized
|
An incident involving legitimate, approved access to resources that may be relevant for auditing, monitoring, or establishing a baseline of normal activity.
|
|
15
|
Access.Other
|
Any other incident related to physical or digital access that does not fit into the specific access subcategories.
|
|
16
|
Availability.DoS
|
An incident where a single machine or network attempts to make a system, service, or network resource unavailable by overwhelming it with malicious requests or traffic.
|
|
17
|
Availability.DDoS
|
An incident where multiple compromised systems (a botnet) are used to target a single system with a flood of traffic, causing a denial of service.
|
|
18
|
Availability.Outage
|
An incident where essential utilities or services (such as electricity, water, or network connectivity) become unavailable, disrupting normal operations.
|
|
19
|
Availability.Failure
|
An incident caused by the unintentional malfunction of hardware or software due to errors, bugs, wear and tear, or other faults, leading to service degradation or unavailability.
|
|
20
|
Availability.Misconfiguration
|
An incident where incorrect configuration of systems, software, or networks leads to service disruptions, outages, or security vulnerabilities.
|
|
21
|
Availability.Overload
|
An incident where a system or component is subjected to a load beyond its designed capacity, leading to performance degradation or failure, even if the load is not malicious.
|
|
22
|
Availability.HeartBeat
|
A periodic signal generated by hardware or software to indicate normal operation, often used for monitoring system health, connectivity, or location tracking.
|
|
23
|
Availability.Other
|
Any other incident that impacts the availability of resources or services, not covered by the specific subcategories.
|
|
24
|
Fraud.Usage
|
The use of an organization's assets (e.g., computing power, network, email) for non-work-related, often illegal, activities without authorization.
|
|
25
|
Fraud.Copyright
|
The act of reproducing, distributing, or installing software, media, or other materials in violation of their copyright, often for personal gain or distribution (piracy).
|
|
26
|
Fraud.Masquerade
|
A type of attack where an attacker illegitimately assumes the identity of another user, process, or system to gain unauthorized access, privileges, or benefits.
|
|
27
|
Fraud.Phishing
|
A cyber attack where an attacker disguises themselves as a trustworthy entity (e.g., via email or fake website) to trick a victim into revealing sensitive information like usernames, passwords, or credit card details.
|
|
28
|
Fraud.Corruption
|
A fraudulent scheme that is made possible by the abuse of power or position by a trusted individual (e.g., employee, official) who acts for personal gain.
|
|
29
|
Fraud.Espionnage
|
The use of illegal or unethical means, such as hacking, bribery, or theft, to acquire a competitor's trade secrets, intellectual property, or other confidential business information.
|
|
30
|
Fraud.Other
|
Any other incident involving deception for financial or reputational gain that does not fit into the specific fraud subcategories.
|
|
31
|
Insider.Malicious
|
A security incident caused by a current or former employee, contractor, or other trusted insider who intentionally acts to harm the organization, its data, or its people.
|
|
32
|
Insider.Negligent
|
A security incident caused unintentionally by an insider, such as through carelessness, lack of awareness, or simple human error, leading to data exposure or system compromise.
|
|
33
|
Insider.Other
|
Any other security incident involving an insider (trusted individual) that does not fit into the specific insider threat subcategories.
|
|
34
|
Sabotage.Vandalism
|
The deliberate and malicious act of damaging, destroying, or obstructing an organization's physical assets, operations, or systems.
|
|
35
|
Sabotage.Graffiti
|
The act of willfully defacing, damaging, or marking public or private property with inscriptions, drawings, or tags without permission.
|
|
36
|
Sabotage.Destruction
|
The intentional and malicious act of destroying or severely damaging physical assets, such as windows, equipment, or buildings.
|
|
37
|
Sabotage.Tampering
|
The act of deliberately meddling with or disabling security controls (e.g., locks, alarms, cameras) to compromise their effectiveness.
|
|
38
|
Sabotage.Equipment
|
The intentional act of causing damage to operational equipment, machinery, or vehicles, often to disrupt production or operations.
|
|
39
|
Sabotage.Disruption
|
The intentional disruption of essential services or utilities, such as electricity, water, or network connectivity, to cause operational downtime.
|
|
40
|
Sabotage.Data
|
The intentional act of deleting, altering, or corrupting digital or physical data to cause harm, disrupt operations, or cover tracks.
|
|
41
|
Sabotage.Other
|
Any other incident involving the intentional damage to property or assets not covered by the specific sabotage subcategories.
|
|
42
|
Safety.Explosion
|
A sudden, violent release of energy (e.g., from gas, chemicals, or explosives) that causes a blast, fire, and potential structural damage, injury, or loss of life.
|
|
43
|
Safety.Fire
|
An incident involving uncontrolled burning (e.g., structural, wildland, or chemical fire) that threatens human safety, property, or the environment.
|
|
44
|
Safety.Agression
|
An incident where an individual uses physical force against another person, causing bodily harm, pain, or the fear of immediate harm.
|
|
45
|
Safety.Sexual
|
An incident involving any unwanted sexual act, contact, or behavior directed against an individual without their consent.
|
|
46
|
Safety.Accident
|
An unplanned, unforeseen event (e.g., vehicle crash, industrial mishap, chemical spill) that results in injury, loss of life, or damage to health.
|
|
47
|
Safety.Hostage
|
An incident where a person or group is held against their will by a captor, often to compel a third party to meet certain demands.
|
|
48
|
Safety.Other
|
Any other incident that causes or has the potential to cause injury, loss of life, or endanger citizens, not covered by specific safety subcategories.
|
|
49
|
SupplyChain.Disruption
|
An event that disrupts the normal flow of products, services, or information within a supply chain, often impacting operations and delivery.
|
|
50
|
SupplyChain.Compromise
|
A security incident where an attacker exploits a vulnerability in a third-party vendor's system to gain access to or compromise the primary target's network or data.
|
|
51
|
SupplyChain.Other
|
Any other incident affecting the supply chain that does not fit into the specific supply chain subcategories.
|
|
52
|
Theft.Equiment
|
The unlawful taking of physical hardware, such as computers, mobile phones, or servers, resulting in loss of assets and potentially the data they contain.
|
|
53
|
Theft.Data
|
The unauthorized taking or copying of sensitive or confidential documents, whether in physical or digital form.
|
|
54
|
Theft.Machinery
|
The unlawful taking of heavy equipment, vehicles, or specialized machinery, often resulting in significant operational and financial loss.
|
|
55
|
Theft.PII
|
The unauthorized acquisition of Personally Identifiable Information (PII) that can be used to identify, contact, or impersonate an individual.
|
|
56
|
Theft.IP
|
The unlawful acquisition of a company's intellectual property, including trade secrets, patents, formulas, or proprietary processes.
|
|
57
|
Theft.FinInfo
|
The theft of financial information, such as credit card numbers or bank account details, often for the purpose of fraudulent transactions.
|
|
58
|
Theft.Breaches
|
A security incident involving the unauthorized access, acquisition, or disclosure of sensitive, protected, or confidential data.
|
|
59
|
Theft.Other
|
Any other incident involving the intentional stealing of physical property or digital data not covered by specific theft subcategories.
|
|
60
|
Operational.Misuse
|
The use of an organization's assets (e.g., computers, network, time) for purposes that are not officially authorized, which may violate policy but not be malicious.
|
|
61
|
Operational.Policy Violation
|
An incident where an individual fails to comply with established organizational policies, procedures, or security rules, whether intentionally or accidentally.
|
|
62
|
Operational.Process Failure
|
An incident where a designed process, procedure, or workflow fails to achieve its intended outcome, leading to operational or security gaps.
|
|
63
|
Operational.Other
|
Any other operational issue that does not fit into the specific operational incident subcategories.
|
|
64
|
Recon.Netword
|
The practice of probing a network to discover active hosts, open ports, and services, often as a precursor to an attack or unauthorized monitoring.
|
|
65
|
Recon.Landscape
|
The act of physically observing a location to gather information about security measures, layouts, or potential vulnerabilities.
|
|
66
|
Recon.Aerial
|
The act of using aerial platforms, such as drones or satellites, to conduct surveillance or gather intelligence about a target area.
|
|
67
|
Recon.OSINT
|
The practice of collecting and analyzing information from publicly available sources (e.g., social media, public records) for intelligence purposes.
|
|
68
|
Recon.Other
|
Any other incident involving scanning, spying, or monitoring to identify resources that does not fit into specific recon subcategories.
|
|
69
|
National.Terrorism
|
An incident involving the use of violence, intimidation, or threats by non-state actors against civilians or property to achieve political, religious, or ideological objectives.
|
|
70
|
National.Conflict
|
A state of armed conflict between two or more nations, involving organized military forces and impacting national security.
|
|
71
|
National.Cyber
|
Large-scale cyber operations, including attacks, espionage, and disinformation campaigns, conducted by state-sponsored or state-affiliated groups against national interests.
|
|
72
|
National.Crime
|
Large-scale illegal activities, such as trafficking in drugs, weapons, or people, conducted by sophisticated criminal networks that pose a threat to national and international security.
|
|
73
|
National.Environemental
|
Incidents related to large-scale environmental shifts, such as climate change, resource scarcity, or global pandemics, that have significant national security implications.
|
|
74
|
National.Economical
|
An incident involving significant disruption to a nation's economy, such as market crashes, hyperinflation, or trade wars, affecting national stability.
|
|
75
|
National.Societal
|
An incident involving large-scale public disorder, such as strikes, riots, or civil unrest, that challenges social order and may require national-level response.
|
|
76
|
National.Other
|
Any other incident that has a significant impact at the national scale, not covered by specific national security subcategories.
|
|
77
|
SocialEng.Phishing
|
A type of social engineering where attackers send fraudulent emails, appearing to be from a legitimate source, to trick recipients into revealing sensitive information or installing malware.
|
|
78
|
SocialEng.Spear Phishing
|
A highly targeted phishing attack directed at a specific individual, organization, or role, often using personalized information to increase credibility.
|
|
79
|
SocialEng.Vishing
|
A social engineering attack conducted over the phone, where the attacker impersonates a legitimate entity to trick the victim into revealing sensitive information or performing actions.
|
|
80
|
SocialEng.Smishing
|
A social engineering attack conducted via SMS (text message), where the attacker sends a fraudulent message to trick the recipient into clicking a malicious link or providing information.
|
|
81
|
SocialEng.Pretexting
|
A social engineering tactic where the attacker creates a fabricated scenario or pretends to be someone they are not to engage a victim and extract information or access.
|
|
82
|
SocialEng.Baiting
|
A social engineering attack that lures victims by offering something desirable (e.g., free music, a prize) in exchange for information or by tricking them into downloading malware.
|
|
83
|
SocialEng.QuidProQuo
|
A social engineering tactic where the attacker offers a service or benefit (e.g., technical support) in exchange for information or access, often expecting something in return later.
|
|
84
|
SocialEng.Other
|
Any other incident involving psychological manipulation of people to divulge information or perform actions, not covered by specific social engineering subcategories.
|
|
85
|
Malware.Virus
|
A type of malicious software that attaches itself to a legitimate program or file and replicates itself to spread to other programs, often requiring human action to propagate.
|
|
86
|
Malware.Worm
|
A type of standalone malicious software that replicates itself to spread across networks, often exploiting vulnerabilities without requiring human interaction.
|
|
87
|
Malware.Trojan
|
A type of malware that disguises itself as legitimate or desirable software to trick users into installing it, after which it can perform malicious actions.
|
|
88
|
Malware.Ransomware
|
A type of malware that encrypts a victim's files or systems, rendering them inaccessible, and demands a ransom payment, often in cryptocurrency, for the decryption key.
|
|
89
|
Malware.Spyware
|
A type of software that secretly monitors and collects information about a user's activities, such as keystrokes, browsing habits, and personal data, without their consent.
|
|
90
|
Malware.Adware
|
A type of software that automatically displays or downloads unwanted advertisements, often in a disruptive manner, and may track user behavior.
|
|
91
|
Malware.Rootkit
|
A type of malware designed to hide its presence and grant an attacker persistent, privileged access to a compromised system while evading detection.
|
|
92
|
Malware.Other
|
Any other incident involving malicious software that does not fit into the specific malware subcategories.
|
|
93
|
Geophysical.Earthquake
|
An incident caused by a sudden, rapid shaking of the earth resulting from the movement of tectonic plates, which can cause ground shaking, surface rupture, and tsunamis.
|
|
94
|
Geophysical.MassMovement
|
An incident involving the downslope movement of rock, soil, or snow under the force of gravity, such as landslides, avalanches, or rockfalls.
|
|
95
|
Geophysical.Volcanic
|
An incident caused by the eruption of magma and volcanic gases from a volcano, which can produce lava flows, pyroclastic flows, ashfall, and lahars.
|
|
96
|
Geophysical.Other
|
Any other incident caused by solid-earth processes not covered by specific geophysical subcategories.
|
|
97
|
Meteo.Heat
|
A meteorological incident involving a prolonged period of excessively hot weather, which can cause health impacts, infrastructure stress, and environmental damage.
|
|
98
|
Meteo.Cold
|
A meteorological incident involving a rapid fall in temperature over a short period, or a prolonged period of extreme cold, posing risks to health and infrastructure.
|
|
99
|
Meteo.Fog
|
A meteorological incident where dense fog reduces visibility, potentially disrupting transportation and causing accidents.
|
|
100
|
Meteo.Rain
|
A meteorological incident involving excessive or prolonged rainfall that can lead to flooding, landslides, and transportation disruptions.
|
|
101
|
Meteo.Snow
|
A meteorological incident involving heavy snowfall and blizzard conditions, which can disrupt transportation, damage infrastructure, and pose risks to safety.
|
|
102
|
Meteo.Wind
|
A meteorological incident involving damaging or dangerous winds, such as from storms, tornadoes, or hurricanes, that can cause structural damage and power outages.
|
|
104
|
Meteo.Other
|
Any other incident caused by atmospheric processes not covered by specific meteorological subcategories.
|
|
105
|
Hydro.Flood
|
An incident where water submerges land that is normally dry, often caused by heavy rain, storm surge, or dam failure, leading to property damage and risk to life.
|
|
106
|
Hydro.Landslide
|
An incident involving the downward movement of slope materials (soil, rock) triggered by water saturation from heavy rain or snowmelt.
|
|
107
|
Hydro.Wave
|
An incident involving destructive waves, such as tsunamis or storm surges, that can cause coastal flooding, erosion, and damage.
|
|
108
|
Hydro.Other
|
Any other incident caused by the movement, distribution, and quality of water, not covered by specific hydrological subcategories.
|
|
109
|
Climat.Drought
|
A prolonged period of below-average precipitation leading to a water shortage, which can impact agriculture, ecosystems, and water supplies.
|
|
110
|
Climat.LakeOutburst
|
An incident where a glacial lake dam (often moraine or ice) fails, rapidly releasing a large volume of water and causing devastating floods downstream.
|
|
111
|
Climat.Wildfire
|
An unplanned and uncontrolled fire burning in natural or rural areas, often exacerbated by climatic conditions like drought, wind, and heat.
|
|
112
|
Climat.Other
|
Any other incident caused by long-lived atmospheric processes (climatological) not covered by specific subcategories.
|
|
113
|
Biological.Epidemic
|
The rapid and widespread occurrence of an infectious disease in a specific population or region, exceeding what is normally expected.
|
|
114
|
Biological.Insect
|
An incident involving a harmful outbreak or infestation of insects that threatens public health, agriculture, livestock, or property.
|
|
115
|
Biological.Animal
|
An incident where animals pose a direct threat to human safety, public health (e.g., zoonotic diseases), or economic stability (e.g., livestock diseases).
|
|
116
|
Biological.Zombies
|
A fictional or hypothetical scenario involving a pathogen that causes a pandemic of aggressive, infectious behavior, often used as a metaphor for worst-case outbreak scenarios in planning.
|
|
117
|
Biological.Other
|
Any other incident caused bybiological not covered by specific subcategories.
|
|
118
|
Extraterrestrial.Impact
|
An incident involving a celestial object (asteroid, meteoroid, comet) colliding with Earth, potentially causing localized or global damage.
|
|
119
|
Extraterrestrial.Aliens
|
A hypothetical incident involving the discovery of or interaction with extraterrestrial intelligent life, a theoretical scenario in scientific and security planning.
|
|
120
|
Extraterrestrial.SpaceWeather
|
An event caused by solar or cosmic activity, such as solar flares or geomagnetic storms, that can disrupt Earth's technological infrastructure.
|
|
121
|
Extraterrestrial.Other
|
Any other incident caused extraterrestrial process not covered by specific subcategories.
|
|
122
|
Other.Uncategorised
|
Any incident that does not fit into one of the predefined categories in this taxonomy.
|
|
123
|
Other.Undetermined
|
An incident whose category is currently unknown, under investigation, or cannot be determined.
|
|
124
|
Other.Test
|
An incident generated solely for the purpose of testing systems, processes, or training personnel.
|
|
125
|
Other.ext-value
|
A value used to indicate that this attribute is extended and the actual value is provided using the corresponding ext-* attribute. (see )
|