Means

An individual or individuals knowingly assist a subject to gain access to devices, systems, or services that hold sensitive information, or otherwise contravene internal policies.

A subject can access devices that have not been assigned to them.

A subject can conduct bluetooth file transfers from an organization device.

An organization has a Bring Your Own Device (BYOD) policy, where a subject is authorized to connect personally owned devices—such as smartphones, tablets, or laptops—to organizational resources. These resources include corporate networks, cloud applications, and on-premises systems that may handle confidential and/or sensitive information.

The use of personal devices in a corporate environment introduces several risks, as these devices may lack the same level of security controls and monitoring as organization-owned equipment.

A subject can use the clipboard on a device (copy & paste).

A subject is able to access external FTP servers.

A subject can leverage software approved for installation or software that is already installed.

A subject can capture photos, videos and/or audio with an external device, such as taking photos of a screen, documents, or their surroundings.

A subject can write to a Network Attached Storage (NAS) device outside of the organisations control.

A subject has the ability to access the physical disk of a target system.

A subject has the ability to print documents and other files.

A subject has privileged access to devices, systems or services that hold sensitive information.

A subject can mount and write to removable media.

A subject can take screenshots on a device.

A subject has the ability to share files across a network through Server Message Block (SMB) file sharing.

A subject is able to access external SSH servers.

A subject has the ability to access the system startup firmware of a target system.

A subject can install software on a device without restriction.

The subject has left the organization but still has access to services or data that is reserved for employees.

A subject can access the web with an organization device.