Infringement
Disruption of Business Operations
Excessive Personal Use
Exfiltration Over Email
Exfiltration Over Media Capture
Exfiltration Over Messaging Applications
Exfiltration Over Other Network Medium
Exfiltration Over Web Service
Exfiltration via Physical Medium
- Exfiltration via Bring Your Own Device (BYOD)
- Exfiltration via Disk Media
- Exfiltration via Floppy Disk
- Exfiltration via New Internal Drive
- Exfiltration via Physical Access to System Drive
- Exfiltration via Physical Documents
- Exfiltration via Target Disk Mode
- Exfiltration via USB Mass Storage Device
- Exfiltration via USB to Mobile Device
- Exfiltration via USB to USB Data Transfer
Inappropriate Web Browsing
Installing Unapproved Software
Misappropriation of Funds
Providing Access to a Unauthorized Third Party
Public Statements Resulting in Brand Damage
Sharing on AI Chatbot Platforms
Theft
Unauthorized Changes to IT Systems
Unauthorized Printing of Documents
Unlawfully Accessing Copyrighted Material
- ID: AR4
- Created: 22nd May 2024
- Updated: 23rd July 2024
Infringement
The act that harms or undermines an organization.
Sections
ID | Name | Description |
---|---|---|
IF013 | Disruption of Business Operations | A subject affects availability or integrity or systems or data, resulting in operational disruption. |
IF017 | Excessive Personal Use | A subject uses organizational resources, such as internet access, email, or work devices, for personal activities both during and outside work hours, exceeding reasonable personal use. This leads to reduced productivity, increased security risks, and the potential mixing of personal and organizational data, ultimately affecting the organization’s efficiency and overall security. |
IF010 | Exfiltration Over Email | A subject uses electronic mail to exfiltrate data. |
IF003 | Exfiltration Over Media Capture | A subject uses an external device, such as a mobile phone or camera, to record audio, photos, or video to capture media. |
IF005 | Exfiltration Over Messaging Applications | A subject uses a messaging application to exfiltrate data through messages or uploaded media. |
IF004 | Exfiltration Over Other Network Medium | A subject exfiltrates files through a network. A network can be an Internet Protocol (IP) network or other technology enabling the communication of data between two or more digital devices. |
IF001 | Exfiltration Over Web Service | A subject uses an existing, legitimate external Web service to exfiltrate data |
IF002 | Exfiltration via Physical Medium | A subject may exfiltrate data via a physical medium, such as a removable drive. |
IF008 | Inappropriate Web Browsing | A subject accesses web content that is deemed inappropriate by the organization. |
IF009 | Installing Unapproved Software | A subject installs unapproved software on a corporate device, contravening internal policies on acceptable use of company equipment. |
IF016 | Misappropriation of Funds | A subject dishonestly makes false representations, fails to disclose information or abuses their access or position to make a financial gain and/or cause a loss to an organization. Methods to achieve this include unauthorized bank transfers, misuse of corporate cards, or creating fictitious invoices. |
IF011 | Providing Access to a Unauthorized Third Party | A subject intentionally provides system or data access to a third party that is not authorized to access it. |
IF012 | Public Statements Resulting in Brand Damage | A subject makes comments either in-person or online that can damage the organization's brand through association. |
IF018 | Sharing on AI Chatbot Platforms | A subject interacts with a public Artificial Intelligence (AI) chatbot (such as ChatGPT and xAI Grok), leading to the intentional or unintentional sharing of sensitive information. |
IF015 | Theft | A subject steals an item or items belonging to an organization, such as a corporate laptop or corporate mobile phone. |
IF014 | Unauthorized Changes to IT Systems | A subject makes changes to IT systems that have adverse effects and cause operational disruption. |
IF006 | Unauthorized Printing of Documents | A subject exfiltrates information by printing it to paper or other physical medium. |
IF007 | Unlawfully Accessing Copyrighted Material | A subject unlawfully accesses copyrighted material, such as pirated media or illegitimate streaming sites. |