8 SECURITY INCIDENT IDENTIFICATION (SCHEMA)
VOCABULARY FOR EVENTS RECORDING AND INCIDENT SHARING (VERIS)
GENERAL
Ref. http://veriscommunity.net/
Use this template to identify threats uniformly:
incident_id
#
security_incident
Confirmed, Suspected, False positive, Near miss, No
confidence
High, Medium, Low, None
victim.employee_count
#
timeline.unit
Unknown, NA, Seconds, Minutes, Hours, Days, Weeks, Months, Years, Never
impact.overall_rating
Unknown, Insignificant, Distracting, Painful, Damaging, Catastrophic
impact.loss.variety
Asset and fraud, Brand damage, Business disruption, Operating costs, Legal and regulatory, Competitive advantage, Response and recovery
impact.loss.rating
Unknown, Major, Moderate, Minor, None
discovery_method
Unknown,
Ext - actor disclosure,
Ext - fraud detection,
Ext - monitoring service, Ext customer,
Ext - unrelated party,
Ext - audit, Ext unknown,
Int - antivirus,
Int - incident response,
Int - financial audit,
Int - fraud detection,
Int HIDS,
Int - IT audit,
Int - log review,
Int - NIDS,
Ext - law enforcement,
Int - security alarm,
Int reported by user,
Int - unknown,
Other
targeted
Unknown, Opportunistic, Targeted, NA
cost_corrective_action
Unknown, Simple and cheap, Difficult and expensive,
Something in-between
country
Unknown, Two Letter, Other
iso_currency_code
AED, AFN, ALL, AMD, ANG, AOA, ARS, AUD, AWG, AZN,
BAM, BBD, BDT, BGN, BHD, BIF, BMD, BND, BOB, BRL,
BSD, BTN, BWP, BYR, BZD, CAD, CDF, CHF, CLP, CNY,
COP, CRC, CUC, CUP, CVE, CZK, DJF, DKK, DOP, DZD,
EGP, ERN, ETB, EUR, FJD, FKP, GBP, GEL, GGP, GHS,
GIP, GMD, GNF, GTQ, GYD, HKD, HNL, HRK, HTG, HUF,
IDR, ILS, IMP, INR, IQD, IRR, ISK, JEP, JMD, JOD,
JPY, KES, KGS, KHR, KMF, KPW, KRW, KWD, KYD, KZT,
LAK, LBP, LKR, LRD, LSL, LTL, LVL, LYD, MAD, MDL,
MGA, MKD, MMK, MNT, MOP, MRO, MUR, MVR, MWK, MXN,
MYR, MZN, NAD, NGN, NIO, NOK, NPR, NZD, OMR, PAB,
PEN, PGK, PHP, PKR, PLN, PYG, QAR, RON, RSD, RUB,
RWF, SAR, SBD, SCR, SDG, SEK, SGD, SHP, SLL, SOS,
SPL, SRD, STD, SVC, SYP, SZL, THB, TJS, TMT, TND,
TOP, TRY, TTD, TVD, TWD, TZS, UAH, UGX, USD, UYU,
uzs, VEF, VND, vuv, WST, XAF, XCD, XDR, XOF, XPF,
YER, ZAR, ZMK, ZWD
ACTOR
actor.x.motive
Unknown, NA, Espionage, Fear, Financial, Fun,
Grudge, Ideology, Convenience, Other
actor.external.variety
Unknown, Activist, Auditor, Competitor, Customer,
Force majeure, Former employee, Nation-state,
Organized crime, Acquaintance, State-affiliated,
Terrorist, Unaffiliated, Other
actor.internal.variety
Unknown, Auditor, Call center, Cashier, End-user,
Executive, Finance, Helpdesk, Human resources,
Maintenance, Manager, Guard, Developer, System
admin, Other
ACTION
action.malware.variety
Unknown, Adware, Backdoor, Brute force, Capture app
data, Capture stored data, Client-side attack,
Click fraud, C2, Destroy data, Disable controls,
Dos, Downloader, Exploit vuln, Export data, Packet
sniffer, Password dumper, Ram scraper, Ransomware,
Rootkit, Scan network, Spam, Spyware/Keylogger, SQL
iniection, Adminware, Worm, Other
action.malware.vector
Unknown, Direct install, Download by malware, Email
autoexecute, Email link, Email attachment, Instant
messaging, Network propagation, Remote injection,
Removable media, Web drive-by, Web download, Other
action.hacking.variety
Unknown, Abuse of functionality, Brute force,
Buffer overflow, Cache poisoning, Session
prediction, CSRF, XSS, Cryptanalysis, DoS,
Footprinting, Foreed browsing, Format string
attack, Fuzz testing, HTTP request smuggling, HTTP
request splitting, HTTP response smuggling, HTTP
Response Splitting, Integer overflows, LDAP
injection, Mail command injection, MitM, Null byte
injection, Offline cracking, OS commanding, Path
traversal, RFI, Reverse engineering, Routing
detour, Session fixation, Session replay, Soap
array abuse, Special element injection, SQLi, SSI
injection, URL redirector abuse, Use of backdoor or
C2, Use of stolen creds, XML attribute blowup, XML
entity expansion, XML external entities, XML
injection, XPath injection, XQuery injection,
Virtual machine escape, Other
action.hacking.vector
Unknown, 3rd party desktop, Backdoor or C2, Desktop sharing, Physical access, Command shell, Partner, VPN, Web application, Other
action.social.variety
Unknown, Baiting, Bribery, Elicitation, Extortion, Forgery, Influence, Scam, Phishing, Pretexting, Propaganda, Spam, Other
action.social.vector
Unknown, Documents, Email, In-person, IM, Phone, Removable media, SMS, Social media, Software, Website, Other
action.social.target
Unknown, Auditor, Call center, Cashier, Customer,
End-user, Executive, Finance, Former employee,
Helpdesk, Human resources, Maintenance, Manager,
Partner, Guard, Developer, System admin, Other
action.misuse.variety
Knowledge abuse, Privilege abuse, Unknown, Embezzlement, Data mishandling, Email misuse, Net misuse, Illicit content, Unapproved workaround, Unapproved hardware, Unapproved software, Other
action.misuse.vector
Unknown, Physical access, LAN access, Remote access, Non-corporate, Other
action.physical.variety
Unknown, Assault, Sabotage, Snooping, Surveillance, Tampering, Theft, Wiretapping, Connection, Other
action.physical.location
Unknown, Partner facility, Partner vehicle, Personal residence, Personal vehicle, Public facility, Public vehicle, Victim secure area, Victim work area, Victim public area, Victim grounds, Other
action.physical.vector
Unknown, Privileged access, Visitor privileges, Bypassed controls, Disabled controls, Uncontrolled location, Other
action.error.variety
Unknown, Classification error, Data entry error,
Disposal error, Gaffe, Loss, Maintenance error,
Misconfiguration, Misdelivery, Misinformation,
Omission, Physical accidents, Capacity shortage,
Programming error, Publishing error, Malfunction,
Other
action.error.vector
Unknown, Random error, Carelessness, Inadequate
personnel, Inadequate processes, Inadequate
technology, Other
action.environmental.variety
Unknown, Deterioration, Earthquake, EMI, ESD,
Temperature, Fire, Flood, Hazmat, Humidity,
Hurricane, Ice, Landslide, Lightning, Meteorite,
Particulates, Pathogen, Power failure, Tornado,
Tsunami, Vermin, Volcano, Leak, Wind, Other
ASSET
asset.variety
Unknown, S - Authentication, S - Backup, s Database, S - DHCP, S - Directory, S - DCS, s DNS, S - File, S - Log, S - Mail, S - Mainframe, S - Payment switch, S - POS controller, S - Print, S - Proxy, S - Remote access, S - SCADA, S - Web application, S - Code repository, S - VM host, s Other N - Access reader, N - Camera, N - Firewall, N - HSM, N - IDS N - Broadband, N - PBX, N Private WAN, N - PLC, N - Public WAN, N - RTU, N Router or switch, N - SAN, N - Telephone, N - VoIP adapter, N - LAN, N - WLAN, N - Other U - Auth token, U - Desktop, U - Laptop, U - Media, u Mobile phone, U - Peripheral, U - POS terminal, u Tablet, U - Telephone, U - VoIP phone, U - Other T - ATM, T - PED pad, T - Gas terminal, T - Kiosk, T - Other M - Tapes, M - Disk media, M - Documents, M - Flash drive, M - Disk drive, M - Smart card, M Payment card, M - Other P - System admin, p Auditor, P - Call center, P - Cashier, p Customer, P - Developer, P - End-user, p Executive, P - Finance, P - Former employee, P Guard, P - Helpdesk, P - Human resources, p Maintenance, P - Manager, P - Partner, P - Other
asset.accessibility
Unknown, External, Internal, Isolated, NA
asset.ownership
Unknown, Victim, Employee, Partner, Customer, NA
asset.management
Unknown, Internal, External, NA
asset.hosting
Unknown, Internal, External shared, External
dedicated, External, NA
asset.cloud
Unknown, Hypervisor, Partner application, Hosting
governance, Customer attack, Hosting
ATTRIBUTE
attribute.confidentiality.data_disclosure
Unknown, Yes, Potentially, No
attribute.confidentiality.data.variety
Unknown, Credentials, Bank, Classified, Copyrighted,
Medical, Payment, Personal, Internal, System,
Secrets, Other
attribute.confidentiality.state
Unknown, Stored, Stored encrypted, Stored
unencrypted, Transmitted, Transmitted encrypted,
Transmitted unencrypted, Processed
attribute.integrity.variety
Unknown, Created account, Hardware tampering, Alter
behavior, Fraudulent transaction, Log tampering,
Misappropriation, Misrepresentation, Modify
configuration, Modify privileges, Modify data,
Software installation, Other
attribute.availability.variety
Unknown, Destruction, Loss, Interruption,
Degradation, Acceleration, Obscuration, Other
COURSE OF ACTION
Structured Threat Information eXp ression (STIX™ )
(Adapted)
Ref. https://stixproject.github.i
coa.type
Blocking, Redirecting, Harden·mg Patching,
Rebuilding, Monitoring, Other
coa.impact
Insignificant, Distracting, Painful, Damaging,
Catastrophic, Unknown
coa.efficacy
Not Effective, Somewhat Effective, Mostly
Effective, Completely Effective, NA
coa.stage
Prepare, Remedy, Response, Recovered
coa.hosting
Unknown, Internal, External shared, Exte mal
dedicated, External, NA
coa.objective
Detect, Deny, Disrupt, Degrade Deceive, Destroy
KILL CHAIN MAPPING
GATHER DATA FOR MAPPING KILL CHAIN
Phase
Active
Reconnaissance
Customization
Delivery
Exploitation
Installation
Command &
Control (C2)
Action on
Objectives
Identified evidence, artifact, info, or intet
Course of
Action
For Each Phase; Detect, Deny, Disrupt, Degrade, Deceive, Destroy
PRIORITIZED DEFENDED ASSET LIST (PDAL)
GATHER DATA AND PRIORITIZE ASSETS TO DEFEND
Asset:
Location:
Criticality:
Deserioption:
Vulnerability:
Purpose:
Time Prioritized:
Recoverability:
Ranking:
Priority I
Asset:
Location:
Criticality:
Description:
Vulnerability:
Purpose:
Time Prioritized:
Recoverability:
Ranking:
Priority II
Asset:
Location:
Criticality:
Description:
Vulnerability:
Purpose:
Time Prioritized:
Recoverability:
Ranking:
Priority: III