Ontology
version info: $Id: AHz-06.7-2.5.owl,v 1.6 2006/05/30 10:51:32 almhe Exp almhe $
imports: http://purl.org/dc/elements/1.1/
publisher: Dept. of Computer and Information Science, Linköpings universitet, Sweden
imports: SecurityLiterature.owl
comment: An ontology that describes security technologies as a taxonomy and as countermeasures to protection goals. Typical starting points for browsing should be the classes Asset, Countermeasure, Threat.
creator: Almut Herzog, almhe@ida.liu.se

TripleDES
type: Class
subclass of: BlockCipher
subclass of: Restriction
  on property: uses
  some values from: DES
description: Uses three rounds of DES. Different variants exist, see subclasses.
subclass of: SymmetricAlgorithm

BlockCipher
type: Class
comment: Block ciphers do typically also protect the integrity of data. It is hard to modify the cryptotext so that the recipient does not detect the change.
disjoint with: EncryptionHardware
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
description: A cipher in which a fixed-length block of data is encrypted, or decrypted, at each iteration of the algorithm: each block is input, encrypted, and output, with no memory (to retain message-dependent information) between blocks. (ODoc)
subclass of: EncryptionAlgorithm
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Detection
        intersection of: Integrity
      union of: Class
        intersection of: Prevention
        intersection of: Confidentiality
    intersection of: Data
  on property: protects
disjoint with: StreamCipher

uses
type: ObjectProperty
inverse of: usedBy
range: Class
  union of: Countermeasure
  union of: Credential
domain: Class
  union of: Countermeasure
  union of: Credential
type: TransitiveProperty
comment: A countermeasure or a credential can use one or more countermeasures or credentials.

DES
type: Class
subclass of: SymmetricAlgorithm
comment: Data Encryption Standard, predecessor of AES.
description: A US government standard for a block cipher which employs a 56-bit secret key. (ODoC)
subclass of: Standard
subclass of: BlockCipher

SymmetricAlgorithm
type: Class
description: [...] The same key is used to encrypt and decrypt the text that is to be sent. This means that the sender and the receiver must have exchanged this key some time before the message has been sent and that this transfer must occur over a secure channel. The key used for symmetric key encryption is often known as a SECRET KEY. (ODoC)
disjoint with: Public-KeyEncryption
subclass of: Restriction
  some values from: SymmetricKey
  on property: uses
subclass of: EncryptionAlgorithm
disjoint with: EncryptionHardware

NaryRelation
type: Class
comment: Helper class
disjoint with: Vulnerability

MD2
type: Class
subclass of: Restriction
  has value: RFC 1319
  on property: hasStandardReference
description: Message digest algorithm. (ISD)
subclass of: Standard
subclass of: CryptographicHashFunction
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects

hasStandardReference
type: DatatypeProperty
domain: Standard
range: string
comment: Supplies a reference to the standard.

CryptographicHashFunction
type: Class
disjoint with: EncryptionHardware
subclass of: SignatureAlgorithm
description: A cryptographic hash function is a hash function with certain additional security properties (impossible to find a (previously unseen) message that matches a given digest, impossible to find "collisions", wherein two different messages have the same message digest). A hash function takes a long string (or message) of any length as input and produces a fixed length string as output, sometimes termed a message digest or a digital fingerprint. (summarised from Wikipedia)

protects
type: InverseFunctionalProperty
comment: Links a countermeasure to asset, security goal and mechanism type by using the pattern of n-ary relationship as class. This class is represented by CountermeasureProtectsGoalOfAssetThroughMechanismtype.
range: CountermeasureProtectsGoalOfAssetThroughType
inverse of: hasCountermeasure
domain: Countermeasure
type: ObjectProperty

ScanningAttack
type: Class
description: Randomly contact hosts to find interesting hosts, may e.g. use war dialling (adapted from ODotI)
subclass of: BruteForceAttack
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: Host
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: Host
  on property: threatens

BruteForceAttack
type: Class
description: Any criminal attempt to access a computer system by the repeated execution of some action. (ODotI)
subclass of: ActiveAttack

threatens
type: ObjectProperty
comment: Links a threat to asset and security goalby using the pattern of n-ary relationship as class. This class is represented by ThreatThreatensGoalOfAsset.
domain: Threat
type: InverseFunctionalProperty
range: ThreatThreatensGoalOfAsset

StatisticalAttack
type: Class
description: An attack on a database to which users are allowed limited access: for example, access in order to calculate information such as averages. A statistical attack uses this information to discover data that is secret. (ODotI) Is this really a passive attack? Even if it leaves data unmodified? (my)
subclass of: PassiveAttack
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: Data
  on property: threatens
subclass of: Restriction
  some values from: Data
  on property: threatens

PassiveAttack
type: Class
subclass of: Threat
equivalent class: Disclosure
subclass of: Restriction
  some values from: Confidentiality
  on property: threatens
description: Classification from ODotI, together with ActiveAttack Also fits NP7: Passive misuse of resources Confidentiality of the asset is violated but nothing is modified.

Anti-VirusSoftware
type: Class
subclass of: AccessControl
subclass of: Restriction
  some values from: Availability
  on property: protects
subclass of: Monitoring
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Prevention
      union of: Detection
      union of: Recovery
    intersection of: Technology
    intersection of: Class
      union of: Integrity
      union of: Availability
      union of: PolicyCompliance
  on property: protects
comment: At best AV software provides prevention, detection and recovery. At least, it provides detection.
subclass of: Restriction
  on property: protects
  some values from: Technology
description: Software which monitors a computer and its files in order to detect any virus intrusions that have occurred (or is occuring(my def)) (ODotI)
subclass of: Restriction
  on property: protects
  some values from: Detection
subclass of: Restriction
  some values from: Integrity
  on property: protects

AccessControl
type: Class
description: The process of ensuring that only authorized subjects are allowed access to a resource. (generalised from ODoC)
subclass of: Countermeasure
subclass of: Restriction
  some values from: Prevention
  on property: protects
description: The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorised manner. (CCITT)
subclass of: Restriction
  on property: protects
  some values from: PolicyCompliance
comment: This is the enforcement part. The authentication part of access control is handled in AuthenticationService/Loginsystem. Access control does prevent bad things from happening.

Monitoring
type: Class
subclass of: Countermeasure
description: Used for checking the status, progress and operation of a system (inspired from ODoC)

Product
type: Class
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: Goal
disjoint with: User
disjoint with: Model
disjoint with: AssetLifeCyclePhase
disjoint with: Vulnerability
disjoint with: DefenseStrategy
comment: A product that contains countermeasures.

Phishing
type: Class
description: A form of fraud, often using forged e-mails or Web sites, that tries to persuade users to disclose usernames and passwords for on-line bank accounts or other valuable resources. (ODoc)
subclass of: Masquerading
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: Data
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: Data
  on property: threatens

Masquerading
type: Class
equivalent class: Impersonation
equivalent class: Deception
description: NP3: Impersonation, playback, spoofing ISD: Spoofing, impersonation, masquerading are synonyms. Use of legitimate identification and authentication by an unauthorised individual to impersonate a legitimate user, i.e., to appear to have a different identity from one's own. (ISD) Spoofing: Assuming the identity of an existing user in order to discover information associated with that user or information that the user is allowed to access. (ODotI) Masquerade: The pretence by an entity to be a different entity. (CCITT)
equivalent class: Spoofing
subclass of: ActiveAttack

DigitalSigning
type: Class
subclass of: Restriction
  on property: verifiesCredential
  some values from: MessageDigestData
subclass of: Restriction
  some values from: Data
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Authentication
subclass of: Restriction
  some values from: Integrity
  on property: protects
subclass of: Restriction
  some values from: CryptographicHashFunction
  on property: uses
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Detection
    intersection of: Data
    intersection of: Class
      union of: Integrity
      union of: Authentication
comment: This class denotes the first meaning of the definition, namely the signing part. The verification part is called DigitalSignatureValidation in this ontology.
subclass of: MessageDigest
subclass of: Restriction
  some values from: Detection
  on property: protects
description: The process of (1) signing digital data, typically before deployment, typically performed by the data owner or producer and (2) verifying the digital signature at a later stage, typically after deployment, typically performed by the data consumer.
subclass of: Restriction
  on property: verifiesCredential
  some values from: DigitalSignatureData

verifiesCredential
type: ObjectProperty
inverse of: credentialVerifiedBy
sub property of: uses
domain: Countermeasure
range: Credential
comment: A countermeasure may verify one or more credentials. For example: DigitalSignatureValidation verifies DigitalSignature.

CertificateData
type: Class
description: A document with a digital signature. Such a certificate is used to authenticate identity. Digital certificates are often signed by a trusted third party known as a certificate authority. (ODotI)
description: A data structure signed with a public key digital signature stating that a specified public key belongs to someone or something with a specified identification. (ISD)
subclass of: Restriction
  some values from: SigningWithCertificate
  on property: credentialVerifiedBy
subclass of: DigitalSignatureData
description: A certificate authority (CA) issues an encrypted digital certificate containing the applicant's public key and a variety of other identification information. The CA makes its own public key readily available through print publicity or perhaps on the Internet. The recipient of an encrypted message uses the CA's public key to decode the digital certificate attached to the message, verifies it as issued by the CA and then obtains the sender's public key and identification information held within the certificate. With this information, the recipient can send an encrypted reply. (Webopedia)

SessionHijacking
type: Class
description: An attack on a computer network where the intruder monitors the activity of a user of the network. When the user issues a log out the intruder cancels it and then proceeds to masquerade as the user. (ODotI)
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: Data
  on property: threatens
subclass of: Masquerading
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: Data
subclass of: Restriction
  all values from: Class
    union of: Class
      intersection of: Confidentiality
      intersection of: Data
    union of: Class
      intersection of: Integrity
      intersection of: Data
  on property: threatens

Tripwire
type: Class
subclass of: Host-BasedIntrusionDetectionSystem
source: http://sourceforge.net/projects/tripwire
description: Host-based intrusion detection system. Free and open source.

Host-BasedIntrusionDetectionSystem
type: Class
subclass of: ByAuditSourceLocation
description: The IDS examines the activity on each individual computer or host. (Webopedia)

SSL (Secure Sockets Layer)
type: Class
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Class
        intersection of: ApplicationLayerPacket
      union of: Class
        intersection of: Authentication
        intersection of: Host
    intersection of: Prevention
subclass of: Restriction
  some values from: Class
    intersection of: Authentication
    intersection of: Host
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Prevention
subclass of: Standard
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: ApplicationLayerPacket
  on property: protects
description: Secure Sockets Layer, a protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system that uses two keys to encrypt data ? a public key known to everyone and a private or secret key known only to the recipient of the message. (Webopedia) It is a flexible protocol that is able to use a variety of encryption schemes. (ODotI)
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Confidentiality
    intersection of: ApplicationLayerPacket
subclass of: Restriction
  on property: uses
  some values from: Public-KeyEncryption
subclass of: Restriction
  on property: uses
  some values from: SymmetricAlgorithm
subclass of: SecureNetworkCommunication

Public-KeyEncryption
type: Class
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Detection
    intersection of: Authentication
    intersection of: Sender
subclass of: Restriction
  all values from: Class
    union of: Class
      intersection of: Detection
      intersection of: Authentication
      intersection of: Sender
    union of: Class
      intersection of: Prevention
      intersection of: Confidentiality
      intersection of: Data
  on property: protects
disjoint with: SymmetricAlgorithm
subclass of: EncryptionAlgorithm
description: A cryptographic system where encryption and decryption are performed using different keys. These schemes use two mathematically related keys. The decryption key is hard to determine from the encryption key. (Phoha)
disjoint with: EncryptionHardware
comment: Aka asymmetric encryption.

SecureNetworkCommunication
type: Class
subclass of: Countermeasure
comment: Any technology that protects communication.

BiometricAuthenticationSystem
type: Class
subclass of: Restriction
  all values from: BiometricToken
  on property: verifiesCredential
subclass of: Restriction
  on property: verifiesCredential
  some values from: BiometricToken
description: A system that authenticates people using biometrics, i.e. that rely on the measurement of an anatomical, physiological or behavioural characteristic of the user, rather than knowledge or possession of information or a key. (Phoha)
subclass of: LoginSystem

SHA-1
type: Class
subclass of: Standard
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects
subclass of: CryptographicHashFunction
subclass of: Restriction
  has value: US government standard
  on property: hasStandardReference
description: Secure Hash Algorithm 1, a message digest algorithm that has been developed by the US government. (ODotI)

StackAttack
type: Class
subclass of: DenialOfService
description: A stack attack involves running a program, typically from a web page, which consumes huge amounts of stack memory. (ODotI)
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Availability
    intersection of: Stack
subclass of: Restriction
  on property: threatens
  some values from: Stack

DenialOfService
type: Class
subclass of: ActiveAttack
subclass of: Restriction
  on property: threatens
  some values from: Availability
description: An attack on a computer system which results in the service being offered [...] being severely degraded. (ODotI)

DataInTransit
type: Class
subclass of: Data
subclass of: Restriction
  some values from: Network
  on property: residesOn
description: Data that is transferred over a network. Notice that all other subclasses of Data can also be "in transit". A login name, password, or a copy of the heap may be transferred over the network.

ElGamalAlgorithm
type: Class
description: An asymmetric key encryption algorithm for public key cryptography which is based on Diffie-Hellman key agreement. The Digital Signature Algorithm is a variant of the ElGamal SIGNATURE scheme, which should not be confused with the ElGamal algorithm. (Wikipedia)
subclass of: Public-KeyEncryption

ActiveAttack
type: Class
description: Classification from ODotI, together with PassiveAttack NP6: Active misuse of resources. Misuse of (apparently) conferred authority that alters the system or its data. integrity of the asset is violated (my def)
subclass of: Threat

SSH (Secure Shell)
type: Class
subclass of: Restriction
  on property: uses
  some values from: SymmetricAlgorithm
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Integrity
    intersection of: DataInTransit
subclass of: Restriction
  some values from: Public-KeyEncryption
  on property: uses
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Authentication
    intersection of: Host
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Class
        intersection of: DataInTransit
      union of: Class
        intersection of: Authentication
        intersection of: Host
    intersection of: Prevention
  on property: protects
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: DataInTransit
  on property: protects
subclass of: Standard
subclass of: SecureNetworkCommunication
subclass of: Restriction
  some values from: Prevention
  on property: protects
description: Secure Shell, a network protocol designed for logging into and executing commands on a networked computer, replacing the insecure ftp, telnet and rlogin protocol. (Wikipedia)

Encryption
type: Class
description: Translation of data into a secret code (Webopedia)
equivalent class: Cryptography
comment: This contains algorithms.
description: The coding of messages so as to render them unintelligible to other than authorized recipients. (ODoC)
subclass of: Restriction
  some values from: Data
  on property: protects
subclass of: Restriction
  all values from: KeyManagement
  on property: supportedBy
subclass of: Countermeasure

Cryptography
type: Class
subclass of: Countermeasure
description: Discipline which embodies principles, means, and methods for the transformation of data in order to hide its information content, prevent its undetected modification and/or prevent its unauthorised use. (CCITT)
equivalent class: Encryption

KeyManagement
type: Class
subclass of: Restriction
  on property: supports
  all values from: Encryption
subclass of: Countermeasure
description: Key management is the set of techniques and procedures supporting the establishment and maintenance of keying relationships between authorised parties. (MOV97)

supportedBy
type: ObjectProperty
range: Countermeasure
inverse of: supports
domain: Countermeasure
comment: A countermeasure is supported (relates to) another countermeasure. Encryption is supported by key management.

Countermeasure
type: Class
description: A countermeasure is a piece of 'security technology' that protects assets against threats. An alternative naming is 'control'. (my def)
disjoint with: AssetLifeCyclePhase
subclass of: Asset
subclass of: Thing
disjoint with: Model
disjoint with: DefenseStrategy
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: Vulnerability
disjoint with: Goal

credentialVerifiedBy
type: ObjectProperty
sub property of: usedBy
inverse of: verifiesCredential
domain: Credential
range: Countermeasure
comment: A credential is verified by at least one, possibly more countermeasures.

hasMechanismType
type: FunctionalProperty
range: DefenseStrategy
comment: A helper property for the n-ary relations. Denotes a mechanism type.
domain: HasMechanismType
type: ObjectProperty

FormatStringAttack
type: Class
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: Stack
  on property: threatens
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
    intersection of: Stack
comment: void print (char *str) { printf(str); } Call: print("%n") pops 4 bytes off the stack and makes them even accessible for writing (Wil05)
subclass of: MalformedInput
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: Stack

MalformedInput
type: Class
subclass of: ActiveAttack
description: A program is supplied with unexpected, potentially malicious, input (mu def)

Auditing
type: Class
equivalent class: Logging
equivalent class: LogMonitoring
subclass of: Restriction
  all values from: Detection
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: PolicyCompliance
comment: Same as: Logging, LogMonitoring
subclass of: Monitoring
subclass of: Restriction
  on property: protects
  some values from: Detection
description: Collection of data about events which have occurred in a system. (inspired by ODotI)
subclass of: Restriction
  all values from: Class
    union of: PolicyCompliance
    union of: Confidentiality
    union of: Integrity
  on property: protects

CodeInjection
type: Class
subclass of: Restriction
  some values from: MaliciousCode
  on property: ifSuccessfulLeadsToThreat
description: technique to introduce arbitrary code into a running computer process (Wikipedia). Subcategories also from Wikipedia.
subclass of: MalformedInput

EncryptionHardware
type: Class
disjoint with: BlockCipher
subclass of: SecurityHardware
disjoint with: SymmetricAlgorithm
disjoint with: StreamCipher
disjoint with: CryptographicHashFunction
description: Hardware used to speed up encryption.
disjoint with: Steganography
disjoint with: Public-KeyEncryption
subclass of: Restriction
  some values from: Encryption
  on property: uses

MemoryProtection
type: Class
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Integrity
    intersection of: DataOnVolatileMedia
subclass of: Countermeasure
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Integrity
    intersection of: DataOnVolatileMedia
  on property: protects
description: Countermeasures that detect and thwart buffer overflow attacks.

hasGoal
type: FunctionalProperty
domain: HasGoal
range: Goal
type: ObjectProperty
comment: A helper property for the n-ary relations. Denotes a goal.

PolicyCompliance
type: Goal
goal has related goal: Correctness
goal has related goal: Integrity
comment: also: compliance with laws, regulations

Correctness
type: Goal
goal has related goal: PolicyCompliance
description: A property of a representation of a Target of Evaluation such thtat it accurately reflects the stated security target for that system or product (ITSEC)
goal has related goal: Integrity

Integrity
type: Goal
description: A condition in which data (or a system itself) has not been modified or corrupted without authorisation. A system protects the integrity of data if it prevents unauthorised modification, as opposed to protecting the confidentiality of data, which prevents unauthorised disclosure. (Phoha) The degree to which a system or component prevents unauthorised access to, or modification of, computer programs or data (IEEE Std 610.12)
goal has related goal: PolicyCompliance
goal has related goal: Correctness

TinyFragmentAttack
type: Class
comment: This attack may accomplish all sorts of things, thus we do not (on this level) define any existential quantifiers.
subclass of: BypassingIntendedControls
subclass of: Restriction
  on property: threatens
  some values from: Network
description: The attacker uses the IP fragmentation option to create extremely small fragments and force the TCP header information into a separate packet fragment. This attack is designed to circumvent filtering rules that depend on TCP header information. (Stallings 06)
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: Availability
    intersection of: Network

BypassingIntendedControls
type: Class
subclass of: ActiveAttack
description: NP5: Circumvention of existing controls or improper acquisition of otherwise denied authority.
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: Availability
    intersection of: Technology

ConfigurationFile
type: Class
subclass of: File
comment: A file that configures a program, also a policy.

AssetLifeCyclePhase
type: Class
disjoint with: Literature
disjoint with: Definition
disjoint with: DefenseStrategy
disjoint with: Asset
disjoint with: Goal
disjoint with: Threat
comment: Denotes when a countermeasure is employed or a vulnerability introduced or exploited. Proof-of-concept status
disjoint with: Product
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: User
disjoint with: Model
disjoint with: Countermeasure
version info: TODO: Work with this.
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: Vulnerability

Vulnerability
type: Class
disjoint with: Countermeasure
disjoint with: NaryRelation
disjoint with: Literature
disjoint with: Threat
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: Asset
disjoint with: Goal
disjoint with: Product
description: Any mechanism that could lead to a breach of the security of a system in the presence of a threat. (ODoC) Asset: Building, Threat: Flood, Vulnerability: Closeness to water, meters above water level.
disjoint with: AssetLifeCyclePhase
disjoint with: User
disjoint with: Definition
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: DefenseStrategy
disjoint with: Model

DefenseStrategy
type: Class
disjoint with: Definition
disjoint with: Model
comment: Another type of protection goal, the strategy or style for protecting assets against a threat: detection, prevention, recovery, deterrence etc. Used by countermeasures.
disjoint with: Threat
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: User
disjoint with: Vulnerability
disjoint with: Asset
disjoint with: Countermeasure
disjoint with: Literature
disjoint with: AssetLifeCyclePhase
disjoint with: Product
disjoint with: Goal

Goal
type: Class
disjoint with: Asset
disjoint with: Product
disjoint with: Vulnerability
disjoint with: Threat
disjoint with: Definition
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: DefenseStrategy
disjoint with: AssetLifeCyclePhase
disjoint with: Literature
comment: The goal of a countermeasure, typically confidentialiy, integrity etc.
disjoint with: Countermeasure
disjoint with: User
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: Model

Threat
type: Class
disjoint with: DefenseStrategy
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: Model
subclass of: Restriction
  all values from: Vulnerability
  on property: enabledByVulnerability
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: AssetLifeCyclePhase
description: A potential violation of security. (CCITT) Any event that is potentially harmful to an IS through unauthorised access, destruction, disclosure, modification of data, and/or denial of service. (ISD)
equivalent class: Attack
disjoint with: Vulnerability
disjoint with: Goal

Asset
type: Class
disjoint with: DefenseStrategy
disjoint with: AssetLifeCyclePhase
disjoint with: Vulnerability
disjoint with: Goal
disjoint with: ThreatThreatensGoalOfAsset
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: Model
description: A useful or valuable thing. (OED)

User
type: Class
comment: The type of user that interacts with a countermeasure.
disjoint with: AssetLifeCyclePhase
disjoint with: Product
disjoint with: CountermeasureProtectsGoalOfAssetThroughType
disjoint with: Model
disjoint with: DefenseStrategy
disjoint with: Goal
disjoint with: Vulnerability
disjoint with: ThreatThreatensGoalOfAsset

MisuseDetectionSystem
type: Class
description: In misuse detection, the IDS analyzes the information it gathers and compares it to large databases of attack signatures. Essentially, the IDS looks for a specific attack that has already been documented. (Webopedia)
subclass of: ByDetectionMethod
equivalent class: Knowledge-BasedIntrusionDetectionSystem

Anonymity
type: Goal
goal has related goal: Confidentiality
description: A condition in which an individual's true identity is unknown. (www.microsoft.com/security/glossary.mspx)
goal has related goal: Privacy
goal has related goal: Secrecy

Confidentiality
type: Goal
goal has related goal: Secrecy
goal has related goal: Privacy
description: The property that information is not made available or disclosed to unauthorised individuals, entities or processes. (CCITT) The property of not being divulged to unauthorised parties. (Phoha) The prevention of the unauthorised disclosure of information (ITSEC)
goal has related goal: Anonymity

Privacy
type: Goal
goal has related goal: Confidentiality
goal has related goal: Secrecy
description: Protection from the unauthorised disclosure of data. Security purists use confidentiality for this and use privacy to refer to the protection of personal information; privacy legislation consists of laws requiring government and business to justify which data they keep about people, and to tell people what information those organisations are storing about them. (Phoha) The right of individuals to control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. Note: Because this term relates to the right of individuals, it cannot be very precise and its use should be avoided except as a motivation for requiring security. (CCITT)
goal has related goal: Anonymity

IP Address Spoofing
type: Class
subclass of: Masquerading
subclass of: Restriction
  on property: enabledByVulnerability
  some values from: TargetConnectedToNetwork
description: One machine on the Internet masquerading as another machine by using the latter's IP address. (ISD) A packet contains a false IP address (usually sender address), often used to trick firewalls to accept the packet as coming from a trusted source, e.g. the inner network. (my def, from Stallings 06)

enabledByVulnerability
type: ObjectProperty
range: Vulnerability
comment: A threat is enabled by one or more vulnerabilities.
inverse of: enablesThreat
domain: Threat

Authentication
type: Goal
goal has related goal: Trust
goal has related goal: Authenticity
goal has related goal: Accountability
goal has related goal: Non-Repudiation
description: The process of reliably determining the identify of a communicating party or source of a message. (Phoha)
goal has related goal: Identification

Trust
type: Goal
description: Trust is a particular level of the subjective probability with which an agent will perform a particular action, both before we can monitor such action (or independently of his capacity of ever to be able to monitor it) and in a context in which it affects our action. (Gambetta, 1990)
description: Trust is a subjective expectation an agent has about another agent’s future behavior. (L. Mui, 2003)
goal has related goal: Authorisation
description: The ﬁrm belief in the competence of an entity to act dependably, securely, and reliably within a speciﬁed context. (Grandison, 2000)
goal has related goal: Authentication
goal has related goal: Identification

Authorisation
type: Goal
description: Permission to access a resource. (Phoha)
goal has related goal: Trust
goal has related goal: Identification

Accountability
type: Goal
goal has related goal: Identification
goal has related goal: Non-Repudiation
goal has related goal: Authentication
description: The property that ensures that the actions of an entity may be traced uniquely to the entity. (CCITT) The process allowing for the auditing of IS activities to be traced to a source that may then be held responsible. (Phoha)

Non-Repudiation
type: Goal
goal has related goal: Accountability
description: The property of a scheme ... in which the recipient is able to prove to a third party that data has been sent by the sender or received by the receiver. This property protects against the sender denying having sent the message and the receiver denying having received the message. The sender is provided with a proof of delivery and receiver is assured of sender's identity. (Phoha) Repudiation: Denial by one of the entities involved in a communication of having participated in all or part of the communication. (CCITT)
goal has related goal: Authentication
goal has related goal: Identification

Authenticity
type: Goal
goal has related goal: Authentication
description: A security principle that ensures that a message is received in exactly the form in which it was sent. (Phoha)

Credential
type: Class
description: Secret information used to prove one's identity or authorisation in an authentication exchange. (ISD)
description: A credential is a piece of data or hardware that is presented to an AuthenticationService or IntegrityValidationService.
subclass of: Restriction
  on property: credentialVerifiedBy
  some values from: Countermeasure
description: Data that is transferred to establish the claimed identity of an entity. (CCITT)
subclass of: Asset
description: An object that is verified when presented to the verifier in an authentication transaction. Credentials may be bound in some way to the individual to whom they were issued, or they may be bearer credentials. The former are necessary for identification, while the latter may be acceptable for some forms of authorization. (Webopedia)
subclass of: Restriction
  all values from: Countermeasure
  on property: credentialVerifiedBy

SourceCodeAnalysis
type: Class
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Detection
    intersection of: ProgramSourceCodeFile
    intersection of: Correctness
subclass of: Restriction
  has value: AtWriteTime
  on property: employedAt
subclass of: Restriction
  some values from: Detection
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: ProgramSourceCodeFile
subclass of: Countermeasure
subclass of: Restriction
  some values from: Correctness
  on property: protects
description: Aka static code analysis Tools that statically analyse source or object code for problems, flag suspicious constructs in software (adapted from Wikipedia)

AtWriteTime
type: AssetLifeCyclePhase
comment: Employed when the code is written.

employedAt
type: ObjectProperty
comment: A countermeasure is employed at one or more points in time, e.g. at runtime, at compile time.
range: AssetLifeCyclePhase
domain: Countermeasure

TechnologyMistakenlyUsedAsCountermeasure
type: Class
subclass of: Countermeasure
description: Sometimes a technology is used as a countermeasure but it was not devised to be a countermeasure and may possibly not the best suitable countermeasure against a perceived threat. Such technologies are put into this class as a caveat.

MD4
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects
description: Message digest algorithm (ISD)
subclass of: CryptographicHashFunction

UntrustedNetwork
type: Class
disjoint with: TrustedNetwork
subclass of: Network
comment: Can be an asset because even the untrusted network can add value to a host (e.g. by giving access to the Internet).

TrustedNetwork
type: Class
subclass of: Network
disjoint with: UntrustedNetwork
comment: Not so sure if this is needed. Could not find a use case yet.

Availability
type: Goal
description: The property of being accessible and useable upon demand by an authorised entity. (CCITT) Timely, reliable access to data and information services for authorised users. (Phoha) The ability of a product to be in a state to perform a required function under given conditions at a given instant of time or over a given time interval assuming that the required external resources are provide. (Meul) The prevention of the unauthorised withholding of information or resources (ITSEC)

DictionaryAttack
type: Class
description: Guessing passwords using a dictionary (my def)
subclass of: GuessingAttack

GuessingAttack
type: Class
subclass of: BruteForceAttack
description: Guessing a password or key or other credential. This threatens a credential and may lead to the classification of a credential as an asset.
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: Data
  on property: threatens
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: Data

Disclosure
type: Class
subclass of: Threat
equivalent class: PassiveAttack
description: Unauthorised access to information (Shirey)

Spyware
type: Class
subclass of: Restriction
  some values from: Class
    intersection of: Privacy
    intersection of: Human
  on property: threatens
version info: TODO: Spyware could also be used as a countermeasure to guard policy compliance, if installed by an authorised entity.
subclass of: MaliciousCode
comment: Spyware threatens the integrity (unauthorised software) and availability (software consumes resources) of the host on which it is executed. It also threatens the user's privacy.
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: Data
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: Host
subclass of: Restriction
  some values from: Class
    intersection of: Availability
    intersection of: Host
  on property: threatens
description: Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. (Webopedia)

InternetInfrastructureAttack
type: Class
comment: Tree from CM02.
subclass of: Restriction
  some values from: TargetConnectedToNetwork
  on property: enabledByVulnerability
subclass of: ActiveAttack

ChecksumAlgorithm
type: Class
description: Algorithms for creating checksums. These checksums are for error detection and possibly correction on a low level, e.g. disturbances over a noisy connection. They are not secure to use for high-level integrity as new checksums can easily be created and small changes in the data can result in the same checksum. For stronger checksum algorithms, see the class cryptographic hash function.
subclass of: Encryption

KLK05
type: Literature
has quotation: A. Kim, J. Luo, M. Kang. Security ontology for annotating resources. In Proceedings of the On the Move to Meaningful Internet Systems: CoopIS, DOA and ODBASE. LNCS 3761. pp. 1483-1499. Springer Verlag. October 2005.

Deception
type: Class
equivalent class: Masquerading
equivalent class: Spoofing
equivalent class: Impersonation
subclass of: ActiveAttack
description: Acceptance of false data (Shi94)

LoginSystem
type: Class
subclass of: Restriction
  some values from: Credential
  on property: verifiesCredential
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Authentication
    intersection of: Human
    intersection of: Prevention
subclass of: Countermeasure
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Authentication
    intersection of: Human
    intersection of: Prevention
subclass of: Restriction
  comment: May have additions.
  on property: supports
  all values from: AccessControl

BufferOverflow
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: DataOnVolatileMedia
  on property: threatens
description: Buffer overflow happens when input or intermediate results exceed the buffer size. (Phoha) A program writes data beyond the allocated end of a buffer in memory. Buffer overflows usually arise as a consequence of a bug and the use of languages such as C or C++ that are not "memory-safe". One consequence of the overflow is that valid data can be overwritten as a result. (Wikipedia) A method of overloading a predefined amount of space in a buffer, which can potentially overwrite and corrupt data in memory. (www.evestigations.com/html/glossary.html)
subclass of: MalformedInput
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: DataOnVolatileMedia

ClientHost
type: Class
subclass of: NetworkedHost
comment: As opposed to ServerHost. Important in authentication.

DatabaseDataFile
type: Class
subclass of: File
comment: The data files, as distinguished from the executables, of a database management system.

existsOnAsset
type: ObjectProperty
range: Asset
comment: A vulnerability exists on one or more assets.
inverse of: assetHasVulnerability
domain: Vulnerability

Password
type: Class
description: Confidential authentication information, usually composed of a string of characters. (CCITT) A unique character string held by each user, a copy of which is stored within the system. During login an authentication process takes place; the password entered by the intending user must correspond with the stored value before the user is accepted by the system. (ODoC) A secret series of characters that enables a user to access a file, computer, or program. On multi-user systems, each user must enter his or her password before the computer will respond to commands. The password helps ensure that unauthorized users do not access the computer. In addition, data files and programs may require a password. (Webopedia)
subclass of: ElectronicToken

DNSSEC
type: Class
description: This protocol provides security extensions to the DNS to assure data integrity or authentication. DNSSEC provides data integrity and authentication services to security-aware resolvers or applications through the use of cryptographic digital signatures. (ISD)
subclass of: Restriction
  on property: uses
  some values from: DigitalSignatureData
subclass of: Restriction
  all values from: Class
    union of: Class
      intersection of: Detection
      intersection of: Integrity
      intersection of: Data
    union of: Class
      intersection of: Prevention
      intersection of: Authentication
      intersection of: Host
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Host
subclass of: Restriction
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
    intersection of: Data
  on property: protects
subclass of: Standard
subclass of: SecureNetworkCommunication

DigitalSignatureData
type: Class
subclass of: MessageDigestData
subclass of: Restriction
  all values from: Class
    union of: CryptographicHashFunction
    union of: Public-KeyEncryption
    union of: X.509
  on property: uses
description: An authentication code appended to an electronic document that indicates the author of the document. (ODoC)
subclass of: Restriction
  some values from: Public-KeyEncryption
  on property: uses
description: A digital code that can be attached to an electronically transmitted message that uniquely identifies the sender. (Webopedia)
description: Data appended to, or a cryptographic transformation of a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery by the recipient. (CCITT)

EncryptionKey
type: Class
description: A piece of data that serves as input to encryption or decryption.
subclass of: ElectronicToken

PasswordSniffing
type: Class
description: Eavesdropping to capture passwords, which can then be used to masquerade as a legitimate user. (ISD)
subclass of: Eavesdropping
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Confidentiality
    intersection of: Password

Eavesdropping
type: Class
subclass of: PassiveAttack
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: DataInTransit
description: The act of capturing data which is flowing through the communications media used by a computer network. (ODotI) Often accompanied by a more active attack.

JavaSandbox
type: Class
description: A mechanism that confines the scope of Java applet actions according to rules defined in a security model. (ISD)
subclass of: Restriction
  on property: protects
  some values from: Integrity
subclass of: Restriction
  some values from: Technology
  on property: protects
description: A technique whereby a program executing on a computer in a network is isolated from the system around it so that it cannot do any damage or violate any security policy. (ODotI)
subclass of: Restriction
  some values from: Confidentiality
  on property: protects
subclass of: Restriction
  some values from: PolicyCompliance
  on property: protects
subclass of: AccessControl
subclass of: Restriction
  on property: protects
  some values from: Prevention
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: PolicyCompliance
    intersection of: Technology
  on property: protects

DiffieHellman
type: Class
subclass of: Restriction
  on property: implementsModel
  all values from: DiscreteLogarithm
description: An algorithm for creating public and private key and exchanging the public keys.
subclass of: Restriction
  on property: implementsModel
  some values from: DiscreteLogarithm
subclass of: KeyExchange

implementsModel
type: ObjectProperty
domain: Countermeasure
comment: A countermeasure implements a theoretical security model, e.g. RBAC.
inverse of: modelImplementedBy
range: Model

DiscreteLogarithm
type: Class
description: It is easy to generate y given x in: y = g^x modulo p (with p a prime and g < p) but it is hard to do the reverse.
subclass of: CryptographyModel

KeyExchange
type: Class
comment: Moved away from encryption algorithms as this does not deal with encryption but with key generation, being a support for encryption but not the same as encryption.
subclass of: KeyManagement

CryptographyModel
type: Class
description: Models used for hash functions and encryption.
subclass of: Model

RSA
type: Class
subclass of: Public-KeyEncryption
subclass of: Restriction
  on property: implementsModel
  all values from: Factorisation
description: A method of public key encryption devised by Rivest, Shamir, and Adleman. (ODoC)
subclass of: Restriction
  on property: implementsModel
  some values from: Factorisation

Factorisation
type: Class
description: It is difficult to find p and q given N in the equation: N = p * q
subclass of: CryptographyModel

ProgramFile
type: Class
comment: An executable file.
subclass of: File

Rabbit
type: Class
description: A program that absorbs all of some class of resources. (Bishop)
equivalent class: Bacteria
subclass of: Virus

Bacteria
type: Class
comment: Same as Rabbit (Bishop)
subclass of: Virus
equivalent class: Rabbit

Virus
type: Class
subclass of: MaliciousCode
description: Code that recursively replicates a possibly evolved copy of itself. Viruses infect a host file or system area, or they simply modify a reference to such objects to take control and then multiply again to form new generations. (Szor)

IntrusionDetectionSystem
type: Class
subclass of: Restriction
  some values from: Integrity
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Availability
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Prevention
      union of: Detection
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: Availability
    intersection of: Technology
  on property: protects
subclass of: Restriction
  some values from: Technology
  on property: protects
description: Subdivisions according to Debar, Dacier, Wespi "Towards a taxonomy of IDS" An intrusion detection system (IDS) inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate a network or system attack from someone attempting to break into or compromise a system. (Webopedia) Further subclasses could be developed from http://www.sans.org/resources/idfaq/aint.php
subclass of: Restriction
  on property: protects
  some values from: Detection
subclass of: Monitoring
subclass of: Restriction
  on property: protects
  some values from: Confidentiality
comment: Not all IDS prevent but all detect.

HoneyPot
type: Class
subclass of: Restriction
  on property: protects
  some values from: Technology
subclass of: Restriction
  on property: protects
  some values from: Detection
subclass of: Restriction
  some values from: Availability
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Deflection
description: A honeypot is a trap set to detect or deflect attempts at unauthorized use of information systems. Generally it consists of a computer, data or a network site that appears to be part of a network but which is actually isolated and protected, and which seems to contain information that would be of value to attackers. (Wikipedia)
description: Fishbowl: The area of a computer system where an intruder is sent for its behaviour to be observed. (ODotI)
subclass of: Restriction
  some values from: Confidentiality
  on property: protects
subclass of: Countermeasure
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Deflection
      union of: Detection
      union of: Prevention
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: Availability
    intersection of: Technology
comment: A honey pot is rather a scientific tool for observing intrusions. As a security countermeasure it is probably not very effective or efficient. Should be put into TechnologyMistakenlyUsed AsCountermeasure?
subclass of: Restriction
  on property: protects
  some values from: Prevention

RoutingTablePoisoningThroughRouter
type: Class
description: Malicious (compromised) router (CM02)
subclass of: RoutingTablePoisoning

RoutingTablePoisoning
type: Class
description: Malicious modification of routing tables. This can be achieved by maliciously modifying the routing information update packets sent by the routing protocols. (CM02)
subclass of: InternetInfrastructureAttack
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: Data

TDES-EDE
type: Class
description: TripleDES used in Encryption-Decryption-Encryption mode for compatibility with single DES: DES(k3;DES^−1(k2;DES(k1;M))) and so a single DES encryption with key k can be represented as TDES-EDE with k1 = k2 = k3 = k.
subclass of: TripleDES

SymmetricKey
type: Class
subclass of: EncryptionKey
description: The same key is used in encryption and decryption.

X.509CertificateData
type: Class
subclass of: CertificateData
subclass of: Restriction
  some values from: SigningWithX.509Certificate
  on property: credentialVerifiedBy
description: A certificate based on the X.509 standard. (my def)
subclass of: Restriction
  on property: uses
  some values from: X.509

MessageDigestData
type: Class
subclass of: Restriction
  some values from: MessageDigest
  on property: credentialVerifiedBy
description: A technique used to establish whether text sent over a network has been tampered with. It consists of a mathematical rule which, when applied to a piece of text, generates a relatively short number, usually between 128 and 512 bits. This number is then sent with the text to a recipient who reapplies the mathematical rule to the text and compares the result with the original number. If they are the same then there is a very high probability that the message has not been tampered with during the sending process; if it does differ it is virtually certain that the message has been tampered with. (ODotI)
equivalent class: ChecksumData
comment: A message digest, used in a security context, makes use of a cryptographic hash function.
subclass of: ElectronicToken

X.509
type: Class
subclass of: Restriction
  some values from: Authentication
  on property: protects
description: The most popular standard for security certificates. It contains information such as the public key associated with some Internet entity, its name, and a unique registration number. (ODotI)
subclass of: Standard
subclass of: SecureNetworkCommunication
subclass of: PKI (Public Key Infrastructure)

OpenPGP (Open Pretty Good Privacy)
type: Class
subclass of: Standard
subclass of: Restriction
  some values from: DigitalSignatureData
  on property: uses
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: Data
  on property: protects
comment: OpenPGP is not specific to e-mail in transit but can just as well encrypt data on disk. That is why the restrictions denote *data* as asset and not *data in transit*.
subclass of: Restriction
  all values from: Class
    union of: Class
      intersection of: Prevention
      intersection of: Authentication
      intersection of: Human
    union of: Class
      union of: Class
        intersection of: Detection
        intersection of: Integrity
      union of: Class
        intersection of: Class
        intersection of: Data
  on property: protects
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Human
  on property: protects
subclass of: Restriction
  some values from: Public-KeyEncryption
  on property: uses
subclass of: SecureNetworkCommunication
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
    intersection of: Data
subclass of: PKI (Public Key Infrastructure)
description: An open standard for encryption of messages and sender/receiver authentication. (adapted from Wikipedia) It is not specific to e-mail in transit but can just as well encrypt data on disk. (my)
subclass of: Restriction
  some values from: SymmetricAlgorithm
  on property: uses

PKI (Public Key Infrastructure)
type: Class
description: Infrastructure that handles public keys.
subclass of: KeyManagement

DNSServerCompromising
type: Class
subclass of: DNSHacking
subclass of: Restriction
  some values from: Class
    intersection of: Correctness
    intersection of: Data
  on property: threatens
description: The DNS server is compromised and thus under full control of the attacker. DNS data is no longer trusted. (CM02)
subclass of: HostCompromising
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: Router

DNSHacking
type: Class
subclass of: InternetInfrastructureAttack
description: Any attack that affects the DNS services. (CM02)

HostCompromising
type: Class
subclass of: Usurpation
subclass of: Disruption
description: An attacker gains partial or full control over a host. (my def)

containsTechnology
type: TransitiveProperty
comment: One technolgoy asset can contain further technology assets. For example: A network contains hosts, hosts contain data.
range: Technology
domain: Technology
inverse of: residesOn
type: ObjectProperty

NAKAttack
type: Class
subclass of: ActiveAttack
description: A type of attack that exploits the vulnerability of those operating systems that do not handle asynchronous interrupts well and leave the system unprotected during such a time. (ISD)
subclass of: Restriction
  on property: threatens
  some values from: Integrity

Firefly
type: Class
subclass of: Restriction
  some values from: Authentication
  on property: protects
subclass of: Restriction
  some values from: Data
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Confidentiality
subclass of: Restriction
  on property: protects
  some values from: Detection
version info: TO DO: Check the restrictions against a good description of Firefly.
subclass of: Restriction
  some values from: Public-KeyEncryption
  on property: uses
subclass of: Restriction
  some values from: Integrity
  on property: protects
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Authentication
      union of: Confidentiality
      union of: Integrity
    intersection of: Data
    intersection of: Detection
description: Protocol of key distribution based on public key cryptography.
subclass of: Standard
subclass of: SecureNetworkCommunication

StreamCipher
type: Class
subclass of: EncryptionAlgorithm
disjoint with: EncryptionHardware
description: A cipher in which a relatively small quantity of data is encrypted (or decrypted) at each iteration of the algorithm, perhaps just one character or byte, but in which the algorithm contains memory that retains message-dependent information between iterations. (ODoc)
comment: Not all stream ciphers are guaranteed to provide the detection of integrity violations. This must be supplied for every algorithm.
disjoint with: BlockCipher

enablesThreat
type: ObjectProperty
comment: A vulnerability enables one or more threats.
inverse of: enabledByVulnerability
range: Threat
domain: Vulnerability

Bastion Host
type: Class
subclass of: NetworkedHost
description: A computer which stands between a secure network and the Internet. (ODotI) A firewall host which acts as an interface point to an external untrusted network. (Phoha)

Rootkit
type: Class
subclass of: Restriction
  on property: ifSuccessfulLeadsToThreat
  some values from: MaliciousCode
subclass of: MaliciousCode
description: A collection of software tools installed by an intruder on a compromised computer. A rootkit will normally contain tools to hide evidence of the intrusion and backdoors to allow access or remote-control in future. Rootkits often include tools to facilitate other types of misuse such as distributed denial of service attacks or distribution of spam. (ODoC)
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: Host
  on property: threatens

ifSuccessfulLeadsToThreat
type: TransitiveProperty
range: Threat
comment: Threats can imply other threats. If one threat has materialised, this may open up for other threats. For example: if the host is compromised a rootkit can be introduced.
type: ObjectProperty
domain: Threat

PowerMonitoringAttack
type: Class
description: Attacks which make use of varying power consumption by the hardware during computation. (Wikipedia)
subclass of: SideChannelAttack

SideChannelAttack
type: Class
subclass of: PassiveAttack
description: In cryptography, a side channel attack is any attack based on information gained from the physical implementation of a cryptosystem, rather than theoretical weaknesses in the algorithms. (Wikipedia) Could be used for other algorithms as well. (my)
subclass of: Restriction
  some values from: Data
  on property: threatens
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: Data
  on property: threatens

Disruption
type: Class
subclass of: ActiveAttack
description: Interruption or prevention of correct operation (Shi94)

SmartCard
type: Class
subclass of: Restriction
  on property: protects
  some values from: Class
    union of: Class
      intersection of: Authentication
      intersection of: Human
    union of: Class
      intersection of: Confidentiality
      intersection of: Data
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: Class
      union of: Class
        intersection of: Authentication
        intersection of: Human
      union of: Class
        intersection of: Confidentiality
        intersection of: Data
description: A small electronic device about the size of a credit card that contains electronic memory, and possibly an embedded integrated circuit (IC). (Webopedia) A smartcard can be used as an access control token that proves the autorisation of its bearer. (my def)
subclass of: Restriction
  on property: protects
  some values from: Prevention
subclass of: PhysicalToken
comment: It is either used as human authentication or for data confidentiality, possibly both.
subclass of: SecurityHardware

CodeSigning
type: Class
subclass of: DigitalSigning
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Detection
    intersection of: ProgramFile
    intersection of: Class
      union of: Integrity
      union of: Authentication
subclass of: Restriction
  on property: protects
  some values from: ProgramFile
comment: CodeSigning may overlap with SigningWithCertificate. CodeSigning is specific to Code, not to Signing.
description: A secure hashing algorithm is used on the code to be executed providing a compact code signature. This signature is encrypted using the private key of a vendor. ... (Phoha)

SourceRoutingAttack
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
      union of: Availability
    intersection of: Network
  on property: threatens
subclass of: Restriction
  on property: threatens
  some values from: Network
subclass of: BypassingIntendedControls
comment: This attack may accomplish all sorts of things, thus we do not (on this level) define any existential quantifiers.
description: The source station specifies the route that a packet should take as it crosses the Internet, in the hopes that this will bypass security measures that do not analyse the source routing information. The countermeasure is to discard all packets that use this option. (Stallings 06)

MandatoryAccessControl
type: Class
subclass of: AccessControlModel
description: A form of secure access control in which the access rights to objects are set by system administrators and cannot be made more permissive by other users. (ODoC)

AccessControlModel
type: Class
subclass of: Model
comment: This subclass contains a collection of access control principles.

Deflection
type: DefenseStrategy
description: Deflection leads an intruder to believe that he has succeeded in an intrusion attempt, whereas instead he has been attracted or shunted off to where harm is minimized. (http://www.sans.org/resources/idfaq/aint.php)

Sanitizer
type: Class
description: leads to the unrecoverable erasure of sensitive material from a system (adapted from ODoC)
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: DataOnNon-VolatileMedia
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: DataOnNon-VolatileMedia
subclass of: Countermeasure

Degausser
type: Class
description: A device that can generate a magnetic field for degaussing magnetic storage media. (www.all.net/books/standards/remnants/glo.html)
subclass of: Sanitizer
subclass of: SecurityHardware

PacketFilter
type: Class
description: A packet-filtering router applies a set of rules to each incoming and outgoing IP packet and then forwards or discards the packet. (Stallings, 2006)
subclass of: Firewall

Firewall
type: Class
comment: Subclasses according to Stallings06.
subclass of: AccessControl
subclass of: Restriction
  some values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Availability
      union of: Integrity
    intersection of: Class
      union of: Host
      union of: Intranet
  on property: protects
subclass of: Monitoring
description: Systems that act as a gateway between two networks to enforce an access policy. (ISD)
description: A system designed to control the passage of information from one network into a second network. Typically a firewall will be used as a means of reducing the risk of unwanted access to sensitive systems, where one carefully regulated network contains the sensitive systems and is connected to a larger less-regulated network. (ODoC)
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Class
      union of: Class
        intersection of: Class
      union of: Class
        intersection of: PolicyCompliance
        intersection of: DataInTransit
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: PolicyCompliance
    intersection of: DataInTransit
subclass of: Restriction
  some values from: Prevention
  on property: protects

DNSSpoofing
type: Class
description: The attacker masquerades as a DNS server and feeds the client wrong and/or potentially malicious information. (CM02)
subclass of: Restriction
  some values from: Class
    intersection of: Correctness
    intersection of: Data
  on property: threatens
subclass of: DNSHacking
subclass of: Masquerading

VPN (Virtual Private Network)
type: Class
description: Virtual private network. A connection between two computers or other endpoints in which packets sent over a shared network are automatically encrypted and decrypted by the endpoints. (ODoC)
subclass of: Restriction
  some values from: SSH (Secure Shell)
  on property: uses
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: NetworkLayerPacket
    intersection of: Confidentiality
  on property: protects
subclass of: SecureNetworkCommunication
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: NetworkLayerPacket
    intersection of: Confidentiality

DistributedDenialOfService
type: Class
subclass of: Restriction
  some values from: TargetConnectedToNetwork
  on property: enabledByVulnerability
description: A form of denial of service, performed by simultaneously sending large numbers of packets to the same host or network from many computers in different locations on the Internet, with the aim of flooding a network connection or other service. (ODotI)
subclass of: DenialOfService

ChecksumData
type: Class
equivalent class: MessageDigestData
subclass of: ElectronicToken
description: A small fixed-length quantity computed as a function of an arbitrary-length message. A checksum is computed by the sender of a message, recomputed and checked by the recipient of a message to detect data corruption. ... Usage has extended the definition to include more complex noncryptographic functions such as CRCs... and cryptographic functions such as message digests. (Phoha)

CachePoisoning
type: Class
subclass of: Restriction
  on property: threatens
  all values from: Class
    union of: Class
      intersection of: Availability
      intersection of: HostOnInternet
    union of: Class
      intersection of: Integrity
      intersection of: Data
subclass of: DNSHacking
subclass of: Masquerading
subclass of: Restriction
  some values from: Class
    intersection of: Availability
    intersection of: HostOnInternet
  on property: threatens
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: Data
  on property: threatens
description: The DNS server is made to cache bogus information, the attacker can redirect traffic intended for a legitimate site to a site under the attacker's control. (CM02)

LoginName
type: Class
description: A name used to gain access to a computer system. (Webopedia)
subclass of: ElectronicToken
comment: Aka username.
description: The username or name of your account used for identification purposes. (home.esn.net/support/glossarya.html)

DSA
type: Class
subclass of: CryptographicHashFunction
subclass of: Standard
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Authentication
      union of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects
subclass of: Restriction
  on property: hasStandardReference
  has value: FIPS 186-2
description: Digital Signature Algorithm, an algorithm which is used in the US government's digital signature standard. When applied to a message it generates two integers which need to be compared by the recipient of a message which has been signed using this technique. The algorithm can only be used for digital signatures, not for the transmission of data. (ODotI)

MessageAuthenticationCode
type: Class
subclass of: MessageDigest
description: The process of generating and verifying a message authentication code.
subclass of: Restriction
  on property: verifiesCredential
  all values from: MessageAuthenticationCodeData
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Detection
    intersection of: Integrity
    intersection of: Data
subclass of: Restriction
  some values from: MessageAuthenticationCodeData
  on property: verifiesCredential

MessageDigest
type: Class
equivalent class: Checksum
subclass of: Restriction
  some values from: SignatureAlgorithm
  on property: uses
subclass of: Restriction
  some values from: MessageDigestData
  on property: verifiesCredential
description: The process of generating and verifying a message digest credential.
subclass of: Countermeasure
subclass of: Restriction
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
    intersection of: Data
  on property: protects

MessageAuthenticationCodeData
type: Class
subclass of: Restriction
  some values from: MessageAuthenticationCode
  on property: credentialVerifiedBy
description: Data that allows a receiver to verify an authenticated message. The received message matches the sent message. (ISD) A version of a message digest which also includes a password. The user of a message authentication code cannot recreate the number associated with the message digest unless they also know the password. This represents an attempt to strengthen the security of basic message digest schemes. (ODotI)
subclass of: MessageDigestData

ConfidentialityGoals
type: Class
comment: Confidentiality and goals that are related to confidentiality. BEWARE: The inferred individuals are not (always) correct in Protege 3.1.1/Pellet1.3!
equivalent class: Class
  intersection of: Goal
  intersection of: Class
    union of: Restriction
      on property: goalHasRelatedGoal
      has value: Confidentiality
    union of: Class
      one of: Confidentiality

goalHasRelatedGoal
type: ObjectProperty
comment: A security goal can have related security goals. For example: confidentiality is related to anonymity, privacy and secrecy.
range: Goal
domain: Goal
type: SymmetricProperty

SystemModification
type: Class
subclass of: Restriction
  on property: threatens
  some values from: Class
    union of: Confidentiality
    union of: Integrity
description: NP 4:Setting Up Subsequent Misuse: Planting and arming malicious software Introduction of unauthorised or unwanted software.
subclass of: Restriction
  some values from: Host
  on property: threatens
subclass of: Restriction
  on property: ifSuccessfulLeadsToThreat
  some values from: MaliciousCode
subclass of: ActiveAttack

AnomalyDetectionSystem
type: Class
equivalent class: Behaviour-BasedIntrusionDetectionSystem
subclass of: ByDetectionMethod
description: In anomaly detection, the system administrator defines the baseline, or normal, state of the network?s traffic load, breakdown, protocol, and typical packet size. The anomaly detector monitors network segments to compare their state to the normal baseline and look for anomalies. (Webopedia)

Role-BasedAccessControl
type: Class
subclass of: AccessControlModel
description: Role-based access control (RBAC) is an alternative to traditional access control models (eg, discretionary or non-discretionary access control policies) that permits the specification and enforcement of enterprise-specific security policies in a way that maps more naturally to an organization's structure and business activities. (www.hipaabasics.com/glossary.htm)

TrafficAnalysis
type: Class
subclass of: Restriction
  on property: threatens
  some values from: NetworkLayerPacket
description: That part of eavesdropping concerned with the analysis of which parties are communicating and the volumes and timings of those communications, rather than the contents of the messages themselves. Some encryption systems do not protect users against traffic analysis, even though all the content my be encrypted. (ISD) Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more that can be inferred from the traffic. (Wikipedia)
subclass of: Restriction
  all values from: Class
    intersection of: Confidentiality
    intersection of: NetworkLayerPacket
  on property: threatens
subclass of: Eavesdropping

RIPE-MAC
type: Class
subclass of: MACAlgorithm
description: Adopted by the RIPE project.

IPSec
type: Class
description: Acronym for Internet Protocol Security. A series of Internet standards, defined in RFC2401 and others, that allow the content of IP packets to be encrypted and/or signed. (ODoC)
subclass of: Restriction
  some values from: NetworkLayerPacket
  on property: protects
subclass of: Restriction
  on property: uses
  some values from: DigitalSignatureData
subclass of: Restriction
  some values from: Class
    intersection of: Detection
    intersection of: Authentication
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
subclass of: Restriction
  some values from: Encryption
  on property: uses
subclass of: SecureNetworkCommunication
subclass of: Standard
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Prevention
        intersection of: Confidentiality
      union of: Class
        intersection of: Detection
        intersection of: Class
    intersection of: NetworkLayerPacket

TrafficPadding
type: Class
version info: TODO: Find a name for the asset that is protected by traffic padding, add that asset to the asset hierarchy and introduce it as protection goal with the protects-property.
subclass of: SecureNetworkCommunication
description: The addition of false communications or data units to conceal the amount of real data units being sent. (ISD) The generation of spurious instances of communication, spurious data units and/or spurious data within data units. (CCITT)

FileAccessControl
type: Class
description: Abstract container for access control to files provided by operating systems.
equivalent class: Class
  intersection of: AccessControl
  intersection of: Restriction
    on property: protects
    some values from: Class
      intersection of: File
      intersection of: Class
        union of: Confidentiality
        union of: Integrity
  intersection of: Restriction
    some values from: Class
      intersection of: PolicyCompliance
      intersection of: Human
    on property: protects

System Mapping
type: Class
subclass of: PassiveAttack
description: Tools used for learning more about a system, host, network etc.

containsControl
type: ObjectProperty
range: Countermeasure
comment: A product can contain one or more countermeasure. For example: MS Word contains encryption and access control.
domain: Product
inverse of: isContainedIn

KEA (Key Exchange Algorithm)
type: Class
publisher: csrc.nist.gov
subclass of: KeyExchange

MD5
type: Class
subclass of: Standard
description: Message Digest 5, an algorithm used to generate message digests (ODotI)
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects
subclass of: Restriction
  on property: hasStandardReference
  has value: RFC 1321
subclass of: CryptographicHashFunction

RoutingTablePoisoningThroughLink
type: Class
subclass of: RoutingTablePoisoning
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: DataInTransit
  on property: threatens
subclass of: Masquerading
description: An adversary can intercept, interrupt and/or modify the routing messages. (CM02)
subclass of: Restriction
  all values from: Class
    intersection of: Integrity
    intersection of: DataInTransit
  on property: threatens

residesOn
type: ObjectProperty
domain: Technology
inverse of: containsTechnology
comment: One technology asset resides on one or more technology assets. For example: Data resides on Host, Host resides on Network.
range: Technology
type: TransitiveProperty

ReferenceMonitor
type: Class
comment: A dated term that is almost an equivalent to Access Control Mechansim. Used as a placeholder in case typical subclasses of a reference monitor can be found. Might also be removed.
subclass of: AccessControl
description: A system component responsible for the mediation of all access to objects by subjects. All data accesses are performed through the reference monitor, which cannot be bypassed. (ISD)

Skipjack
type: Class
subclass of: BlockCipher
description: A secret key encryption algorithm developed by NSA (US) using 64-bit blocks and 80-bit keys. (ISD)
subclass of: SymmetricAlgorithm

Keylogger
type: Class
subclass of: Spyware
subclass of: Restriction
  all values from: Class
    union of: Class
      intersection of: Availability
      intersection of: Host
    union of: Class
      intersection of: Integrity
      intersection of: Host
    union of: Class
      intersection of: Privacy
      intersection of: Human
    union of: Class
      intersection of: Confidentiality
      intersection of: Data
  on property: threatens
description: Aka keystroke monitoring: recording every keystroke of the user (and usually every character of response). A form of audit trail software or a specialised device usually does this monitoring. (ISD)

Scavenging
type: Class
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: StationaryData
subclass of: PassiveAttack
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Confidentiality
    intersection of: StationaryData
description: Acquiring data from object residue. (ISD)

Rabbit-Worm
type: Class
description: A special worm that exists as a single copy of itself at any point in time as it "jumps around" on networked hosts. (Szor)
subclass of: Worm

Worm
type: Class
description: Worms are network viruses, primarily replicating on networks. (Szor)
subclass of: Restriction
  some values from: Network
  on property: threatens
subclass of: Virus

One-Time Password
type: Class
subclass of: Password
description: Aka non-reusable password A password which is only used once and is then discarded. (ODotI)

Least-Privilege
type: Class
subclass of: AccessControlModel
description: A principle: that every user/process should have just enough, but no more privileges to enable them to carry out their jobs. (combined from ODoC, ODotI)

2TDES
type: Class
subclass of: TripleDES
description: Like TDES-EDE but with only two keys: DES(k1;DES^-1(k2;DES(k1;M)))

PacketMistreatment
type: Class
description: A malicious router mishandles packets, thus resulting in congestion, dos. The problem becomes intractable if the router selectively interrupts or misroutes packets resulting in triangle routing. (CM02)
subclass of: InternetInfrastructureAttack
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Availability
    intersection of: NetworkLayerPacket
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Availability
    intersection of: NetworkLayerPacket

Dongle
type: Class
subclass of: PhysicalToken
description: A security or copy protection device for programs that must be connected to an I/O port of the computer while the program is run. (ODoC)
subclass of: SecurityHardware
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Process
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Process

PassiveIntrusionDetectionSystem
type: Class
subclass of: ByBehaviourOnDetection
subclass of: Restriction
  all values from: Detection
  on property: protects
description: The IDS detects a potential security breach, logs the information and signals an alert. (Webopedia)

RIPE-MD-160
type: Class
description: A message digest algorithm. This is a 160-bit cryptographic hash function ... intended as a secure replacement for the 128-bit hash functions MD4, MD5, and RIPEMD.
subclass of: CryptographicHashFunction
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Integrity
    intersection of: Detection
    intersection of: Data

Backdoor
type: Class
description: A backdoor is the malicious hacker's tool of choice that allows remote connections to systems. A typical backdoor opens a network port (UDP/TCP) on the host when it is executed. Then the listening backdoor waits for a remote connection from the attacker and allows the attacker to connect to the system. (Szor)
subclass of: MaliciousCode
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Integrity
    intersection of: NetworkedHost
subclass of: Restriction
  some values from: TargetConnectedToNetwork
  on property: enabledByVulnerability

TrustManagement
type: Class
description: the activity of collecting, encoding, analyzing and presenting evidence relating to competence, honesty, security or dependability with the purpose of making assessments and decisions regarding trust relationships (Grandison, 2000)
subclass of: Countermeasure
subclass of: Restriction
  some values from: Trust
  on property: protects
description: a uniﬁed approach to specifying and interpreting security policies, credentials, and relationships which allow direct authorization of security-critical actions (M. Blaze, 1996)

P3P
type: Class
description: Platform for Privacy Preferences is a specification that will allow users' Web browsers to automatically understand Web sites' privacy practices. (Webopedia)
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: PolicyCompliance
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: PolicyCompliance
  on property: protects
subclass of: SecureNetworkCommunication
subclass of: Standard

Smurf
type: Class
subclass of: Restriction
  on property: threatens
  some values from: NetworkedHost
subclass of: DenialOfService
description: A DoS-attack in which many pings (ICMP echo request packets) are broadcast to the network. The source field is set to the victim's IP address. Any machines that respond will transmit to the victim, overloading its network interface. (ISD)
subclass of: Restriction
  all values from: Class
    intersection of: Availability
    intersection of: NetworkedHost
  on property: threatens
subclass of: Restriction
  on property: enabledByVulnerability
  some values from: TargetConnectedToNetwork
subclass of: Masquerading

Usurpation
type: Class
subclass of: ActiveAttack
description: Unauthorised control of some part of the system (Shi94)
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Availability
    intersection of: Host

IPSplicing
type: Class
subclass of: SessionHijacking
description: A method for attacking or intercepting an established TCP/IP connection. Usually, this type of attack occurs after authentication of the users is complete and the attacker assumes the role of a legitimate user. (ISD)

HTTPS (HTTP over SSL, HTTP Secure)
type: Class
subclass of: Standard
subclass of: Restriction
  on property: protects
  some values from: DataInTransit
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Prevention
        intersection of: Confidentiality
      union of: Class
        intersection of: Detection
        intersection of: Integrity
    intersection of: DataInTransit
  on property: protects
subclass of: SecureNetworkCommunication
subclass of: Restriction
  on property: uses
  some values from: SSL (Secure Sockets Layer)
disjoint with: S-HTTP
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
  on property: protects
subclass of: Restriction
  some values from: Class
    intersection of: Detection
    intersection of: Integrity
  on property: protects
description: HTTPS is ordinary HTTP exchanged over an SSL encrypted session.

S-HTTP
type: Class
description: Secure Hypertext Transfer Protocol, developed within the Internet standards process, this protocol defines the security additions to the HTTP protocol. It is an application-level protocol and adds encryption and authentication to WWW communications. (ISD) obsoleted by HTTPS (HTTP using SSL)
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: DataInTransit
  on property: protects
subclass of: Standard
subclass of: Restriction
  on property: uses
  some values from: Encryption
subclass of: Restriction
  on property: protects
  some values from: Prevention
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: DataInTransit
  on property: protects
subclass of: SecureNetworkCommunication
subclass of: Restriction
  some values from: Class
    intersection of: Authentication
    intersection of: Host
  on property: protects
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Class
        intersection of: DataInTransit
      union of: Class
        intersection of: Authentication
        intersection of: Host
    intersection of: Prevention
disjoint with: HTTPS (HTTP over SSL, HTTP Secure)

Steganography
type: Class
subclass of: Encryption
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: Prevention
  on property: protects
disjoint with: EncryptionHardware
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Confidentiality
    intersection of: Prevention
    intersection of: Data
description: Means by which two or more parties may employ subliminal or invisible communication. (ISD)

SAML (Security Assertion Markup Language)
type: Class
subclass of: Restriction
  on property: protects
  some values from: Integrity
subclass of: Restriction
  some values from: Availability
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Data
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: Data
    intersection of: Class
      union of: Integrity
      union of: Confidentiality
      union of: Availability
subclass of: Standard
description: Security Assertion Markup Language, an XML-based framework for ensuring that transmitted communications are secure. SAML defines mechanisms to exchange authentication, authorization and nonrepudiation information, allowing single signon capabilities for Web services. (Webopedia)
subclass of: SecureNetworkCommunication
subclass of: Restriction
  some values from: Prevention
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Confidentiality

UseOfVulnerableProgrammingLanguage
type: Class
comment: Using a specific programming language (subclasses may define the languages) enables e.g. buffer overflows.
subclass of: VulnerabilityInCode

Flooding
type: Class
description: Insertion of a large quantity of data that may result in a denial of service. (ISD)
subclass of: DenialOfService

Attack
type: Class
equivalent class: Threat
description: A synonym for threat. Some publications use threat for high-level threats like "act of human error or failure" and attack for more specific threats like "virus". But the distinction is arbitrary as illustrated in Whitford, Mattord, Principles of Information Security, 2nd Edition, 2005. p. 126: Table 4.3 describes threats to information security, one threat being 'deliberate software *attacks*'.

Snort
type: Class
source: http://www.snort.org/
subclass of: Network-BasedIntrusionDetectionSystem
description: Network-based intrusion detection system. GP license.

Network-BasedIntrusionDetectionSystem
type: Class
comment: Aka NIDS.
subclass of: ByAuditSourceLocation
description: NIDS analyses the individual packets flowing through a network. It can detect malicious packets that are designed to be overlooked by a firewall's simplistic filtering rules. (Webopedia)

PingOfDeath
type: Class
description: A large ICMP packet sent to overflow the remote host's buffer, causing the remote host to reboot or hang. (ISD)
subclass of: Restriction
  on property: ifSuccessfulLeadsToThreat
  some values from: DenialOfService
disjoint with: HeapOverflow
disjoint with: StackOverflow
subclass of: BufferOverflow

ElGamalSignatureScheme
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Authentication
      union of: Integrity
    intersection of: Detection
    intersection of: Data
  on property: protects
subclass of: Restriction
  on property: usedBy
  some values from: MessageDigest
subclass of: CryptographicHashFunction
description: Used to sign a message digest or hash function. (my def)

usedBy
type: ObjectProperty
inverse of: uses
type: TransitiveProperty
range: Class
  union of: Credential
  union of: Countermeasure
comment: A countermeasure or credential is used by one or more countermeasures or credentials.
domain: Class
  union of: Countermeasure
  union of: Credential

Stateful Inspection Packet Filter
type: Class
description: Considers state of higher-level connection, not only single packets of stateful protocols. (Stallings 06)
subclass of: PacketFilter

Database Management System
type: Class
subclass of: Restriction
  some values from: DBAccessControl
  on property: containsControl
equivalent class: Database
subclass of: Product

WindowAttack
type: Class
subclass of: DenialOfService
description: A form of DENIAL OF SERVICE ATTACK which relies on the fact that administering visible widgets such as WINDOWS and BUTTONS on a screen consumes a large amount of resources. A typical example of a window attack might involve the creation of a large number of windows displayed on a screen. The amount of resources required to manage such a large number of windows can easily render a computer inoperable. (ODotI)

TrojanHorse
type: Class
description: An apparently innocent program designed to circumvent the security features of a system. (ODoC) A virus which infects a computer by masquerading as a normal system entity. (ODotI) (too strict, a modified ps-command is a Trojan but not a virus)
subclass of: MaliciousCode

ActiveHardwareMisuse
type: Class
description: NP2b) active hardware misuse with side effects
subclass of: Disruption

ActiveIntrusionDetectionSystem
type: Class
comment: Aka reactive IDS.
subclass of: ByBehaviourOnDetection
subclass of: Restriction
  some values from: Prevention
  on property: protects
description: The IDS responds to the suspicious activity by e.g. logging off a user or by reprogramming the firewall to block network traffic from the suspected malicious source. (Webopedia)

Sch96
type: Literature
has quotation: Bruce Schneier. Applied Cryptography, 2nd Edition. Wiley & Sons. 1996.

Replay
type: Class
subclass of: Restriction
  some values from: Class
    intersection of: Correctness
    intersection of: DataInTransit
  on property: threatens
subclass of: Masquerading
description: A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated. (Wikipedia)
subclass of: Restriction
  on property: threatens
  all values from: Class
    intersection of: Correctness
    intersection of: DataInTransit

AES
type: Class
subclass of: SymmetricAlgorithm
subclass of: BlockCipher
description: A US government encryption standard that supercedes DES. AES specifies the Rijndael algorithm with key sizes of 128, 192, and 256 bits and a block size of 128 bits. (Phoha)
subclass of: Standard
comment: Advanced Encryption Standard.

Network Address Translation
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: HostOnIntranet
  on property: protects
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: HostOnIntranet
  on property: protects
subclass of: TechnologyMistakenlyUsedAsCountermeasure
subclass of: SecureNetworkCommunication
comment: NAT solves the problem of shortage of IPv4 addresses. Only by accident, does it have security properties. The appropriate countermeasure is a firewall.
subclass of: Standard
description: Network Address Translation, an Internet standard that enables a local-area network (LAN) to use one set of IP addresses for internal traffic and a second set of addresses for external traffic. A NAT box located where the LAN meets the Internet makes all necessary IP address translations. NAT security purpose: to provide a type of firewall by hiding internal IP addresses. (Webopedia)

CBC-MAC
type: Class
subclass of: MACAlgorithm
description: The simplest way to make a key-dependent one-way hash function is to encrypt a message with a block algorithm in CBC or CFB modes . The hash is the last encrypted block, encrypted once more in CBC or CFB modes.

3TDES
type: Class
description: Uses three different keys: DES(k3;DES(k2;DES(k1;M))) where M is the message block to be encrypted and k1, k2, and k3 are DES keys
subclass of: TripleDES
comment: Not allowed to start name with number, thus the underscore in the name.

DiscretionaryAccessControl
type: Class
description: A form of access control in which subjects may themselves create and alter access rights to objects, limited by any overriding constraints imposed by system administrators.
subclass of: AccessControlModel

ApplicationLevelGateway
type: Class
subclass of: Firewall
description: Aka proxy server, relay of application-level traffic. If the gateway does not implement the proxy code for a specific application, the service is not supported and cannot be forwarded. Scrutinizes only a few allowable applications. (Stallings06)

ManInTheMiddle
type: Class
subclass of: Restriction
  some values from: Class
    intersection of: Confidentiality
    intersection of: DataInTransit
  on property: threatens
description: An attack on a computer system whereby the attacker intercepts messages between two entities on a network, for example a SERVER and a CLIENT , and makes each one think it is communicating with the other. (ODotI)
subclass of: Masquerading
subclass of: Restriction
  some values from: Class
    intersection of: Integrity
    intersection of: DataInTransit
  on property: threatens
subclass of: Restriction
  all values from: Class
    intersection of: Class
      union of: Confidentiality
      union of: Integrity
    intersection of: DataInTransit
  on property: threatens
version info: TBD: Not all MITM attacks affect both confidentiality and integrity. For the moment the model says otherwise so that MITM is found both for integrity and confidentiality attacks.

E-Mail Filter
type: Class
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Class
      union of: Class
        intersection of: PolicyCompliance
        intersection of: E-Mail
      union of: Class
        intersection of: Availability
        intersection of: Class
  on property: protects
subclass of: AccessControl
description: A program which examines incoming e-mails and rejects those which the user (or a system policy (my def)) has indicated that he or she is not interested in. (ODotI)
subclass of: Restriction
  some values from: Class
    intersection of: Availability
    intersection of: Class
      union of: Human
      union of: Host
  on property: protects
subclass of: Restriction
  some values from: Class
    intersection of: PolicyCompliance
    intersection of: E-Mail
  on property: protects
subclass of: Monitoring

Backup
type: Class
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Recovery
    intersection of: Class
      union of: Availability
      union of: Integrity
    intersection of: Data
subclass of: Restriction
  some values from: Integrity
  on property: protects
subclass of: Countermeasure
description: The transfer of file which are stored on a computer to some long-term archival medium such as a CD ROM. (ODotI)
subclass of: Restriction
  on property: protects
  some values from: Data
subclass of: Restriction
  some values from: Recovery
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Availability
description: Copies of files, data and programs made to facilitate recovery from failures of primary system. (Phoha)

OnionRouter
type: Class
subclass of: SecureNetworkCommunication
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Class
      union of: Class
        intersection of: Privacy
        intersection of: Human
      union of: Class
        intersection of: Confidentiality
        intersection of: DataInTransit
  on property: protects
subclass of: Restriction
  some values from: Prevention
  on property: protects
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Confidentiality
    intersection of: DataInTransit
description: The Router at the head of a transmission selects a number of Onion Routers at random and generates a message for each one, providing it with symmetric keys for decrypting messages, and instructing it which Router will be next in the path. Each of these messages, and the messages intended for subsequent routers, is encrypted with the corresponding Router's public key. This provides a layered structure, in which it is necessary to decrypt all outer layers of the onion in order to reach an inner layer. (Wikipedia)
subclass of: Restriction
  some values from: Class
    intersection of: Privacy
    intersection of: Human
  on property: protects

IntegrityGoals
type: Class
comment: BEWARE: The inferred individuals are not (always) correct in Protege 3.1.1/Pellet1.3!
equivalent class: Class
  intersection of: Goal
  intersection of: Class
    union of: Restriction
      has value: Integrity
      on property: goalHasRelatedGoal
    union of: Class
      one of: Integrity

EmissionsSecurity
type: Class
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: Data
  on property: protects
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: Confidentiality
    intersection of: Data
description: Protection designed to deny unauthorised persons information derived from the interception and analysis of compromising emanations from computers, monitors, printers, etc. (ISD)
subclass of: Countermeasure

Remailer
type: Class
description: A server computer which receives messages with embedded instructions on where to send them next, and which forwards them without revealing where they originally came from. (Wikipedia)
subclass of: SecureNetworkCommunication
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Prevention
    intersection of: Anonymity
    intersection of: Sender
subclass of: Restriction
  some values from: Class
    intersection of: Prevention
    intersection of: Anonymity
    intersection of: Sender
  on property: protects

RadiationMonitoring
type: Class
subclass of: SideChannelAttack
description: Attacks based on leaked electromagnetic radiation which can directly provide plaintexts and other information. (Wikipedia)

S-MIME (Secure Multipurpose Internet Mail Extensions)
type: Class
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Class
      union of: Class
        intersection of: Class
        intersection of: E-Mail
      union of: Class
        intersection of: Authentication
        intersection of: Human
    intersection of: Prevention
subclass of: SecureNetworkCommunication
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Confidentiality
    intersection of: E-Mail
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Authentication
    intersection of: Human
subclass of: Standard
description: Secure Multimedia Internet Mail Extensions, a standard for public key encryption and signing of e-mail encapsulated in MIME (wikipedia)
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Integrity
    intersection of: E-Mail
subclass of: Restriction
  some values from: Prevention
  on property: protects

TimingAttack
type: Class
description: A timing attack is a form of side channel attack where the attacker tries to break a cryptosystem by analyzing the time taken to execute cryptographic algorithms. The attack exploits the fact that, particularly in asymmetric key algorithms, computation time for a private key operation is dependent on the key in some way. (Wikipedia) (Term also badly explained in ODotI)
subclass of: SideChannelAttack

IntegerOverflow
type: Class
subclass of: BufferOverflow
description: A math operation may give a result larger than the available register width, an error condition may result. Integer overflows do not generally lead to exploitable conditions. However, on systems where the result is simply stored, and no error is returned (this is the general case), it may not be possible for the software to determine that the value stored is erroneous. If an integer value is used to specify the location of other code or variable values in memory, the resulting pointer error may be exploited to create a buffer overflow condition or to write and execute arbitrary (and possibly harmful) code to the resulting (and unexpected) position. (Wikipedia)

MisuseOfLanguageConstruct
type: Class
subclass of: UseOfVulnerableProgrammingLanguage
comment: A programming language element is not used as intended.

CircuitLevelGateway
type: Class
description: A circuit-level gateway does not permit an end-to-end TCP connection, but sets up two TCP connections, one between itself and a TCP user on an inner host and one between itself and a TCP user on an outside host. The gateway typically relays TCP segments from one connection to the other without examining the contents. The security function consists of determining which connections will be allowed. (Stallings06)
description: ensures the validity of TCP and UDP sessions by ceating a handshake between communicating parties and passing packets through until the end of the session. (ISD)
subclass of: Firewall

FormatStringMisuse
type: Class
comment: Misuse of the format string as shown in FormatStringAttack.
subclass of: MisuseOfLanguageConstruct
subclass of: Restriction
  on property: enablesThreat
  all values from: Class
    union of: FormatStringAttack
    union of: StackOverflow

KerberosAuthenticationProtocol
type: Class
subclass of: Restriction
  on property: protects
  some values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Class
      union of: Human
      union of: Host
subclass of: Standard
subclass of: SecureNetworkCommunication
subclass of: Restriction
  all values from: Class
    intersection of: Prevention
    intersection of: Authentication
    intersection of: Class
      union of: Human
      union of: Host
  on property: protects
description: A secure method of authenticating users on a computer network, developed by MIT. (ODoC)

VulnerabilityScanner
type: Class
subclass of: Restriction
  some values from: Integrity
  on property: protects
subclass of: Countermeasure
subclass of: Restriction
  on property: threatens
  some values from: Class
    intersection of: Confidentiality
    intersection of: Host
subclass of: Restriction
  some values from: Host
  on property: protects
subclass of: Restriction
  on property: protects
  all values from: Class
    intersection of: Host
    intersection of: Class
      union of: Detection
      union of: Correction
    intersection of: Class
      union of: Correctness
      union of: Integrity
subclass of: Restriction
  some values from: Correctness
  on property: protects
subclass of: System Mapping
description: A vulnerability scanner is a type of computer program specifically designed to search a given target (piece of software, computer, network, etc.) for weaknesses. The scanner systematically engages the target in an attempt to assess where the target is vulnerable to "attack". The program can be used either prophylactically (to find holes and plug them before they are exploited) or maliciously (to find holes and exploit them). (Wikipedia)
subclass of: Restriction
  on property: protects
  some values from: Detection

assetHasVulnerability
type: ObjectProperty
inverse of: existsOnAsset
range: Vulnerability
comment: An asset can have one or more vulnerabilities.
domain: Asset

supportsCountermeasure
type: ObjectProperty
inverse of: runsOnOperatingSystem
comment: An operating system can support one or more countermeasures. This is for finding countermeasure products for a given operating system. For example: Which firewalls run on Mac OS?
domain: OperatingSystem
range: Countermeasure

runsOnOperatingSystem
type: ObjectProperty
domain: Countermeasure
range: OperatingSystem
comment: A countermeasure executes on one or more operating systems. This is for finding countermeasure products for a given operating system. For example: Which firewalls run on Mac OS?
inverse of: supportsCountermeasure

modelImplementedBy
type: ObjectProperty
range: Countermeasure
inverse of: implementsModel
domain: Model
comment: A model is implemented by one or more countermeasures.

isContainedIn
type: ObjectProperty
domain: Countermeasure
inverse of: containsControl
comment: A countermeasure is contained in one or more products. For example: Encryption part of MS Word.
range: Product

hasUser
type: ObjectProperty
domain: Countermeasure
range: User
comment: A property for determining what kind of users typically interact with a countermeasure. A useful add-on if one wants to reason about usability requirements of countermeasures.
version info: Not part of the core security ontology.

hasCountermeasure
type: FunctionalProperty
inverse of: protects
domain: CountermeasureProtectsGoalOfAssetThroughType
comment: A helper property for the n-ary relations. Denotes a countermeasure.
type: ObjectProperty
range: Countermeasure

hasThreat
type: FunctionalProperty
range: Threat
comment: A helper property for the n-ary relations. Denotes a threat.
type: ObjectProperty
domain: HasThreat

AC-CCITT
type: Definition
has source: CCITT
has definition: Whatever

MOV97
type: Literature
has quotation: Alfred J. Menezes, Paul C. van Oorschot, Scott A. Vanstone. Handbook of Applied Cryptography. CRC Press. 1997.