Classification Example: Stolen Device

A common incident reported by all organizations is the theft of mobile devices, such as laptops or mobile phones. In many cases it will be difficult to know if a missing device was lost or stolen, but we suggest classifying it as a 'loss' (internal.error) rather than 'theft' (external.physical) unless there is good reason to suspect the latter. This is not a blind/unwarranted assumption; if one is unsure what happened to the device, the variety of 'loss or misplacement' is appropriate and historical data shows devices are lost far more often than stolen.

But let's say for the sake of example that we know the device was stolen. Specifically, someone broke into an employee's vehicle and took a corporate-issued laptop from the backseat. This incident is not complex to VERISize because (typically) there will only be one actor, action, and asset. We assume here that the device is password-protected with full disk encryption implemented.

It is a very common error to see stolen laptops modeled as a confidentiality loss, but not a corresponding availability loss. Remember, the organization has lost the use of an asset. Availability should be listed in the affected attributes.

The main difference in classifying a lost laptop versus a stolen laptop is changing the threat actor and the action taken. Rather than an internal actor, the actor is assumed to be external. And instead of Error the action is Physical.

Incident Description

Actor: External

Motive: Financial

Actor Variety: Unaffiliated

Action: Physical

Action Variety: Theft

Location: Personal vehicle

Vector: Disabled controls

Asset

Variety: Laptop

Ownership: Victim

Attribute: Confidentiality, Availability

Data dislosure: No

Notes: Laptop was password protected and encrypted

Availabilty Variety: Loss

Rationale

The classification of this everyday incident is pretty straightforward. The actor in this example is assumed to be a typical thief ('Unaffiliated'), but could be any other variety of external, insider, or partner as well. The action variety is 'Theft' under the Physical action, and we've recorded a vector of 'Disabled controls' and location of 'Personal vehicle' to capture that the thief smashed the window of the employee's card.

A variation on this could be that the thief picked the lock, in which case the physical.vector of 'Bypassed controls' would be more suitable. The location can also be modified if the laptop was stolen from the corporate office ('Victim work area'), a store or restaurant ('Public facility'), or the employee's house ('Personal residence'). And so forth.

The asset variety here is 'Laptop', but that could easily be modified to record stolen phones, documents, etc. Since VERIS' attribute of Confidentiality also encompasses the notion of loss of possession or control, it is included for all lost assets. The more obvious attribute of Availability is also recorded unless the device and all data since the last backup can be fully recovered.

In this case, the device is password protected and encrypted, and unless there is positive evidence of data disclosure, we can record 'No' for that variable under Confidentiality. *If* it wasn't password protected and/or encrypted, we'd need to change that to 'Potentially' to account for the fact that our data is now at-risk of disclosure. Moreover, the variety and amount of the data involved would need to be included. *If* we received evidence that data was disclosed to unauthorized parties (e.g., it's posted on the web or used for fraud), we'd need to record 'Yes' for the data_disclosure variable.

JSON output

{
  "action": {
    "physical": {
      "location": [
        "Personal vehicle"
      ],
      "variety": [
        "Theft"
      ],
      "vector": [
        "Disabled controls"
      ]
    }
  },
  "actor": {
    "external": {
      "motive": [
        "Financial"
      ],
      "variety": [
        "Unaffiliated"
      ]
    }
  },
  "asset": {
    "assets": [
      {
        "variety": "U - Laptop"
      }
    ]
  },
  "attribute": {
    "availability": {
      "variety": [
        "Loss"
      ]
    },
    "confidentiality": {
      "data": [
        {
          "amount": 16,
          "variety": "Personal"
        }
      ],
      "data_disclosure": "Potentially",
      "data_total": 16,
      "notes": "",
      "state": [
        "Stored unencrypted"
      ]
    }
  },
  "discovery_method": "Other",
  "impact": {
    "overall_rating": "Unknown"
  },
  "incident_id": "demo001",
  "reference": "http://www.youtube.com/watch?v=67L0pbneT2w",
  "schema_version": "1.2",
  "security_incident": "Confirmed",
  "summary": "laptop stolen when someone broke into employee car.",
  "timeline": {
    "incident": {
      "year": 2013
    }
  },
  "victim": [
    {
      "country": "US",
      "employee_count": "1 to 10",
      "industry": 522293,
      "notes": "",
      "state": "NY",
      "victim_id": "Art Vandelay, LLC."
    }
  ]
}