Reference
Codebook
Definitions used across incidents, organisations and threat actors.
Codebook reference
CIA Posture
Cyber security involves safeguarding the Confidentiality, Integrity, and
Availability (CIA) of information systems. These three principles form the foundation of effective cyber
security:
- Confidentiality: Ensures that sensitive information is accessed only by authorised individuals, preventing data breaches and unauthorised disclosures.
- Integrity: Protects the accuracy and reliability of data by preventing unauthorised modifications or tampering, ensuring that the information remains trustworthy.
- Availability: Ensures that information systems and data are accessible when needed by authorised users, minimising downtime caused by cyber attacks or system failures.
Incident Timeline Milestones
Incident timelines use a small set of public-source-friendly milestones. Dates may be precise or approximate depending on what the source material supports.
| Milestone | Description |
|---|---|
| Occurred | When the incident, intrusion, compromise, outage, or harmful activity is reported to have started. |
| Discovered | When the victim, researcher, authority, or another source first identified the incident. |
| Disclosed | When the incident was publicly reported, announced, notified, or otherwise disclosed. |
| Resolved | When the source reports that service was restored, remediation was completed, the incident was closed, or the immediate incident impact ended. |
Incident Timeline Statuses
Timeline status summarises whether the incident appears active, resolved, old enough to treat as historical, or not yet clear from available evidence.
| Status | Description |
|---|---|
| Ongoing | A source explicitly indicates that the incident, disruption, recovery, investigation, or response remains active. |
| Resolved | A source explicitly indicates that the incident was resolved, restored, remediated, closed, or otherwise ended. |
| Historical | No current source says the incident is ongoing, and the incident is old enough for CSIDB to treat it as no longer active. |
| Unknown | Available sources do not yet support a clear ongoing, resolved, or historical status. |
STIX Motives
Below is the list of potential motives or motivations for cyber incidents, based on STIX 2.1.
Reference:
STIX Attack
Motivation Vocabulary
| Motive | Description |
|---|---|
| Accidental | A non-hostile actor whose benevolent or harmless intent inadvertently causes harm. For example, a well-meaning and dedicated employee who through distraction or poor training unintentionally causes harm to his or her organization. |
| Coercion | Being forced to act on someone else's behalf. Adversaries who are motivated by coercion are often forced through intimidation or blackmail to act illegally for someone else’s benefit. Unlike the other motivations, a coerced person does not act for personal gain, but out of fear of incurring a loss. |
| Dominance | A desire to assert superiority over someone or something else. Adversaries who are seeking dominance over a target are focused on using their power to force their target into submission or irrelevance. Dominance may be found with ideology in some state-sponsored attacks and with notoriety in some cyber vandalism-based attacks. |
| Ideology | A passion to express a set of ideas, beliefs, and values that may shape and drive harmful and
illegal acts. Adversaries who act for ideological reasons (e.g., political, religious, human rights, environmental, desire to cause chaos/anarchy, etc.) are not usually motivated primarily by the desire for profit; they are acting on their own sense of morality, justice, or political loyalty. For example, an activist group may sabotage a company’s equipment because they believe the company is harming the environment. |
| Notoriety | Seeking prestige or to become well known through some activity. Adversaries motivated by notoriety are often seeking either personal validation or respect within a community and staying covert is not a priority. In fact, one of the main goals is to garner the respect of their target audience. |
| Organizational Gain | Seeking advantage over a competing organization, including a military
organization. Adversaries motivated by increased profit or other gains through an unfairly obtained competitive advantage are often seeking theft of intellectual property, business processes, or supply chain agreements and thus accelerating their position in a market or capability. |
| Personal Gain | The desire to improve one’s own financial status. Adversaries motivated by a selfish desire for personal gain are often out for gains that come from financial fraud, hacking for hire, or intellectual property theft. While a Threat Actor or Intrusion Set may be seeking personal gain, this does not mean they are acting alone. Individuals can band together solely to maximize their own personal profits. |
| Personal Satisfaction | A desire to satisfy a strictly personal goal, including curiosity, thrill-seeking, amusement,
etc. Threat Actors or Intrusion Set driven by personal satisfaction may incidentally receive some other gain from their actions, such as a profit, but their primary motivation is to gratify a personal, emotional need. Individuals can band together with others toward a mutual, but not necessarily organizational, objective. |
| Revenge | A desire to avenge perceived wrongs through harmful actions such as sabotage, violence, theft,
fraud, or embarrassing certain individuals or the organization. A disgruntled Threat Actor or Intrusion Set seeking revenge can include current or former employees, who may have extensive knowledge to leverage when conducting attacks. Individuals can band together with others if the individual believes that doing so will enable them to cause more harm. |
| Unpredictable | Acting without identifiable reason or purpose and creating unpredictable
events. Unpredictable is not a miscellaneous or default category. Unpredictable means a truly random and likely bizarre event, which seems to have no logical purpose to the victims. |
STIX Industry Sectors
Below is the CSIDB STIX Industry Sector list, based on STIX 2.1 with contextual dashed sub-sector codes for clarity. Reference:
STIX Industry Sector Vocabulary
| Type | Description |
|---|---|
| Agriculture | The production of food, crops, and livestock for human consumption. |
| Aerospace | The design, development, and manufacturing of aircraft and spacecraft. |
| Automotive | Manufacturing and design of vehicles for personal and commercial use. |
| Chemical | Production and distribution of chemicals, from industrial to consumer products. |
| Commercial | Retail, trade, and business sectors focused on selling goods and services. |
| Communications | Industries responsible for telephone, broadcasting, and internet communications. |
| Construction | Building infrastructure including roads, bridges, and buildings. |
| Defense | Government and military sectors involved in national security and defense technology. |
| Education | Institutions focused on academic learning and research. |
| Energy | The generation and distribution of power, including oil, gas, and renewable energy. |
| Entertainment | Industries related to media, film, music, and other forms of entertainment. |
| Financial Services | Institutions like banks, investment firms, and payment processors. |
| Government Emergency Services | Services related to law enforcement, fire departments, and emergency medical response. |
| Government Local | Local government agencies and services at the municipal or county level. |
| Government National | National-level government bodies and agencies. |
| Government Public Services | Public-facing government services including social services and welfare programs. |
| Government Regional | Regional or state-level government agencies and services. |
| Healthcare | Organizations and professionals involved in medical care and public health. |
| Hospitality & Leisure | Hotels, restaurants, and tourism-related services. |
| Infrastructure - Dams | Management and operation of dam systems for water control and power generation. |
| Infrastructure - Nuclear | Industries focused on the development and management of nuclear power plants. |
| Infrastructure - Water | Management of water systems for consumption and sanitation purposes. |
| Insurance | Companies providing risk management through insurance policies. |
| Manufacturing | Industries involved in the production of goods and materials. |
| Mining | Extraction of minerals, metals, and other natural resources. |
| Non-Profit | Organizations that provide services and operate without a profit motive. |
| Pharmaceuticals | Development, production, and marketing of drugs and medical treatments. |
| Retail | Businesses involved in the sale of goods directly to consumers. |
| Technology | Companies focused on software, hardware, and technology development. |
| Telecommunications | Industries involved in providing communication services, including mobile and internet. |
| Transportation | Industries focused on moving people and goods via air, land, and sea. |
| Utilities | Provision of essential services such as electricity, gas, and water. |
STIX Threat Actor Types
Below is the list of STIX Threat Actor Types, based on STIX 2.1. Reference:
STIX Threat Actor
Type Vocabulary
| Type | Description |
|---|---|
| Activist | Highly motivated supporter of a social or political cause, aiming to disrupt an organization’s business model or damage its image. This category includes anarchists, cyber vandals, and hacktivists. |
| Competitor | An organization aiming to gain an advantage over a rival by stealing intellectual property, trade secrets, or business data. |
| Crime Syndicate | An enterprise organized to conduct large-scale criminal activity for profit, often associated with organized crime. |
| Criminal | Individuals or small groups committing crimes, often for personal financial gain. Common activities include intellectual property theft and extortion. |
| Hacker | Individuals who break into networks for the thrill or challenge, using either advanced skills or pre-made attack scripts. |
| Insider-Accidental | Non-hostile insiders who unintentionally expose the organization to harm through human error or lack of training. |
| Insider-Disgruntled | Current or former insiders seeking revenge, potentially leveraging extensive internal knowledge to harm the organization. |
| Nation-State | Actors working for or on behalf of a government, often with sophisticated tools, resources, and training to conduct espionage or political attacks. |
| Sensationalist | Individuals or small groups seeking fame by exposing sensitive information to cause public relations crises, without political goals. |
| Spy | Actors collecting sensitive information for use, dissemination, or sale, typically part of a well-resourced intelligence organization. |
| Terrorist | Individuals or groups using violence or cyber techniques to promote political or ideological goals, often raising funds through criminal activity. |
| Unknown | Actors whose motivations or identities cannot yet be determined due to insufficient information. |
STIX Threat Actor Resource Levels
Resource level describes the organisational scale and support available to a threat actor,
based on the STIX 2.1 Threat Actor resource level vocabulary. Reference:
STIX Threat Actor
Resource Level Vocabulary
| Resource Level | Description |
|---|---|
| Individual | The actor operates alone with limited resources. |
| Club | An informal association of individuals with shared interests or goals. |
| Contest | A temporary or competitive grouping assembled around a specific objective. |
| Team | A coordinated group with shared tooling, infrastructure, or operational processes. |
| Organization | A formal organisation or structured entity supporting the actor's activity. |
| Government | A state or state-backed actor with access to government-level support or resources. |
STIX Threat Actor Sophistication Levels
Sophistication describes the actor's tradecraft, technical skill, and operational maturity,
based on the STIX 2.1 Threat Actor sophistication vocabulary. Reference:
STIX Threat Actor
Sophistication Vocabulary
| Sophistication | Description |
|---|---|
| None | No meaningful technical sophistication is evident. |
| Minimal | The actor uses simple or publicly available methods with little adaptation. |
| Intermediate | The actor shows some operational knowledge and can adapt known methods. |
| Advanced | The actor demonstrates mature operations, customisation, or coordinated tradecraft. |
| Expert | The actor has deep expertise and can conduct complex operations reliably. |
| Innovator | The actor develops novel techniques, tooling, or operational approaches. |
| Strategic | The actor can conduct long-term campaigns aligned to strategic objectives. |
STIX Threat Actor Roles
Roles describe how a threat actor participates in an operation, based on the STIX 2.1 Threat
Actor role vocabulary. Reference:
STIX Threat Actor
Role Vocabulary
| Role | Description |
|---|---|
| Agent | Conducts activity on behalf of another actor or sponsor. |
| Director | Directs, coordinates, or tasks other actors. |
| Independent | Acts without evidence of direction or sponsorship by another party. |
| Infrastructure Architect | Designs or builds operational infrastructure used by the actor. |
| Infrastructure Operator | Runs, maintains, or administers operational infrastructure. |
| Malware Author | Develops malware or malicious tooling used in operations. |
| Sponsor | Provides resources, direction, funding, or other support to enable activity. |
Threat Actor Goals
Goals are short, source-backed objectives attributed to the actor, such as intelligence collection, financial theft, disruptive impact, persistence, or access maintenance. CSIDB stores goals as actor-specific statements rather than as a fixed vocabulary so they can preserve the source-supported wording.
Tactics, Techniques & Procedures (TTPS)
Below is a list of tactics, techniques, and procedures (TTPs) definitions, aligned with those used in the CISSM Events database:
| Name | Description |
|---|---|
| Message Manipulation | Interfering with the target's ability to communicate accurately. Examples: Hijacking social media accounts, defacing websites with political messages. |
| External Denial of Service | Attacks from outside the network to disrupt communication. Examples: DDoS attacks like ICMP flood, SYN flood, BGP hijack. |
| Internal Denial of Service | Disruption from within the network. Examples: Resetting routers, installing disruptive malware on file servers. |
| Data Attack | Manipulation, destruction, or encryption of data. Examples: Wiper viruses, ransomware, altering data with stolen credentials. |
| Physical Attack | Using IT components to damage physical systems. Examples: Manipulating PLCs to cause grid shutdowns, overheating a blast furnace. |
| Exfiltration from Sensors | Theft of data from peripheral devices. Example: Compromising PoS devices to steal credit card data. |
| Exfiltration from End Host | Theft of data from user devices. Examples: Malicious links, using compromised credentials. |
| Exfiltration from Network Infrastructure | Theft via networking equipment. Example: VPNFilter malware compromising routers. |
| Exfiltration from Application Server | Exploiting server vulnerabilities to steal data. Examples: SQL injection, direct access to email servers. |
| Exfiltration from Data in Transit | Intercepting data in transit. Example: Unencrypted data stolen from PoS devices or unsecured Wi-Fi. |