| Hardware |
| Device Properties | Threats |
| PID-11 | Device includes a microprocessor | | TID-101 | Power Consumption Analysis Side Channel | | TID-102 | Electromagnetic Analysis Side Channel | | TID-103 | Cache Timing Analysis Side Channel | | TID-105 | Hardware Fault Injection – Control Flow Modification |
|
| PID-121 | Device includes buses for external memory/storage | |
| PID-122 | Device includes discrete chips/devices that have access to the same physical memory | | TID-107 | Unauthorized Direct Memory Access (DMA) |
|
| PID-123 | Device includes ROM, VRAM, or removable Storage | | TID-108 | ROM/NVRAM Data Extraction or Modification |
|
| PID-124 | Device includes Random Access Memory (RAM) chips | |
| PID-1241 | Device includes DDR DRAM | | TID-110 | Hardware Fault Injection – Data Manipulation |
|
| PID-13 | Device includes peripheral chips and integrated data buses | | TID-113 | Unverified Peripheral Firmware Loaded | | TID-114 | Peripheral Data Bus Interception |
|
| PID-14 | Device includes external peripheral interconnects (e.g., USB, Serial) | | TID-111 | Untrusted External Storage | | TID-118 | Weak Peripheral Port Electrical Damage Protection |
|
| PID-15 | Device includes a hardware access port (e.g., UART, JTAG) | | TID-115 | Firmware/Data Extraction via Hardware Interface | | TID-116 | Latent Privileged Access Port | | TID-119 | Latent Hardware Debug Port Allows Memory/Code Manipulation |
|
| System Software |
| Device Properties | Threats |
| PID-21 | Device includes a bootloader | | TID-201 | Inadequate Bootloader Protection and Verification |
|
| PID-22 | Device includes a debugging capabilities | | TID-224 | Excessive Access via Software Diagnostic Features |
|
| PID-23 | Device includes OS/kernel | | TID-202 | Exploitable System Network Stack Component | | TID-218 | Operating System Susceptible to Rootkit |
|
| PID-231 | Device includes an operating system that uses drivers/modules that can be loaded | | TID-203 | Malicious OS Kernel Driver/Module Installable |
|
| PID-2321 | Device lacks an access enforcement/privilege mechanism | | TID-204 | Untrusted Programs Can Access Privileged OS Functions |
|
| PID-23221 | Device includes and enforces OS user accounts | | TID-205 | Existing OS Tools Maliciously Used for Device Manipulation | | TID-219 | OS/Kernel Privilege Escalation |
|
| PID-23222 | Device includes a memory management model, including protections of memory access (read-only/, executable, writable) | | TID-206 | Memory Management Protections Subverted | | TID-223 | System Susceptible to RAM Scraping |
|
| PID-241 | Device includes containers | |
| PID-242 | Device includes hypervisor | | TID-208 | Virtual Machine Escape | | TID-209 | Host Can Manipulate Guest Virtual Machines |
|
| PID-251 | Root of Trust is physically accessible or is not immutable | | TID-214 | Secrets Extracted from Device Root of Trust |
|
| PID-252 | Root of Trust is immutable | | TID-220 | Unpatchable Hardware Root of Trust |
|
| PID-26 | Device lacks firmware/software update support | | TID-210 | Device Vulnerabilities Unpatchable |
|
| PID-271 | Device has firmware or software that is not cryptographically checked for integrity validation | | TID-211 | Device Allows Unauthenticated Firmware Installation |
|
| PID-272 | Device includes cryptographic firmware/software integrity protection mechanisms | | TID-214 | Secrets Extracted from Device Root of Trust | | TID-330 | Cryptographic Timing Side-Channel |
|
| PID-2721 | Device includes a shared key for firmware integrity validation | | TID-212 | FW/SW Update Integrity Shared Secrets Extraction |
|
| PID-2722 | Device includes digitally signed firmware (with private key) | | TID-213 | Faulty FW/SW Update Integrity Verification |
|
| PID-273 | Device has unencrypted firmware updates | |
| PID-274 | Device includes user firmware/software version selection during updates | | TID-216 | Firmware Update Rollbacks Allowed |
|
| PID-275 | Device includes remotely-initiated firmware/software updates | | TID-217 | Remotely Initiated Updates Can Cause DoS |
|
| Application Software |
| Device Properties | Threats |
| PID-31 | Application-level software is present and running on the device | | TID-301 | Applications Binaries Modified |
|
| PID-311 | Device includes the usage of a web/HTTP applications | | TID-319 | Cross Site Scripting (XSS) | | TID-320 | SQL Injection | | TID-321 | HTTP Application Session Hijacking | | TID-322 | Cross Site Request Forgery (CSRF) | | TID-323 | HTTP Path Traversal | | TID-324 | HTTP Direct Object Reference | | TID-325 | HTTP Injection/Response Splitting |
|
| PID-3121 | Device includes support for object oriented programming languages(e.g., Java, Python, PHP, C++) | |
| PID-3122 | Device includes support for manual memory management programming languages (e.g. C, C++) | | TID-327 | Out of Bounds Memory Access |
|
| PID-32 | Device includes the ability to deploy custom or external programs (e.g., ladder logic, compiled binaries) | | TID-302 | Install Untrusted Application |
|
| PID-321 | Device includes ability to deploy custom programs from engineering software or IDE | | TID-303 | Excessive Trust in Offboard Management/IDE Software |
|
| PID-322 | Device includes a program runtime environment for custom or external programs | | TID-304 | Manipulate Runtime Environment |
|
| PID-3231 | Device includes ability to run custom/external programs as native binary without a confined/restricted environment | | TID-305 | Program Executes Dangerous System Calls |
|
| PID-3232 | Device includes ability to run custom/external programs/processes through an execution sandboxed environment | | TID-306 | Sandboxed Environments Escaped |
|
| PID-324 | Device includes support for "program uploads" to retrieve programs from the device from an engineering workstation | | TID-307 | Device Code Representations Inconsistent | | TID-308 | Code Overwritten to Avoid Detection | | TID-309 | Device Exploits Engineering Workstation |
|
| PID-331 | Device includes unauthenticated services | | TID-310 | Remotely Accessible Unauthenticated Services |
|
| PID-332 | Device includes authenticated services | | TID-311 | Default Credentials | | TID-312 | Credential Change Mechanism Can Be Abused | | TID-313 | Unauthenticated Session Changes Credential | | TID-328 | Hardcoded Credentials |
|
| PID-3321 | Device includes passwords to authenticate the users | | TID-314 | Passwords Can Be Guessed Using Brute-Force Attempts | | TID-315 | Password Retrieval Mechanism Abused | | TID-329 | Improper Password Storage |
|
| PID-3322 | Device includes cryptographic mechanism to authenticate users and sessions | | TID-316 | Incorrect Certificate Verification Allows Authentication Bypass | | TID-317 | Predictable Cryptographic Key | | TID-318 | Insecure Cryptographic Implementation | | TID-330 | Cryptographic Timing Side-Channel | | TID-411 | Weak/Insecure Cryptographic Protocol |
|
| Networking |
| Device Properties | Threats |
| PID-41 | Device exposes remote network services | | TID-222 | Critical System Service May Be Disabled | | TID-310 | Remotely Accessible Unauthenticated Services | | TID-401 | Undocumented Protocol Features | | TID-404 | Remotely Triggerable Deadlock/DoS | | TID-405 | Network Stack Resource Exhaustion | | TID-407 | Missing Message Replay Protection |
|
| PID-4111 | Device lacks protocol support for message authentication | | TID-406 | Unauthorized Messages or Connections |
|
| PID-4112 | Device lacks protocol support for message encryption | | TID-408 | Unencrypted Sensitive Data Communication |
|
| PID-4113 | Device includes cryptographic functions for sensitive data, such as encryption or authentication | | TID-221 | Authentication Bypass By Message Replay | | TID-316 | Incorrect Certificate Verification Allows Authentication Bypass | | TID-317 | Predictable Cryptographic Key | | TID-318 | Insecure Cryptographic Implementation | | TID-330 | Cryptographic Timing Side-Channel | | TID-410 | Cryptographic Protocol Side Channel | | TID-411 | Weak/Insecure Cryptographic Protocol |
|
| PID-42 | Device includes procedure to forward or route network messages | | TID-412 | Network Routing Capability Abuse |
|