Misbehaviours have a URI and a readable label, but they also have an abbreviation code. This is used in a threat naming convention supported by the Domain Model Editor Access DB, which allows some consistency checking between threat URIs and what the threat does.
Specifically, the threat name includes the misbehaviour abbreviation code for its 'primary' effect. If the set of misbehaviours need to be changed, e.g., to incorporate finer discrimination between threat causes, then threats must also be changed. Checking that misbehaviour codes are consistent can help ensure that the changes to misbehaviours and threats have been made in a consistent way.
There are two relatively recently added misbehaviours that do not have abbreviation codes, making it impossible to check this:
- NetworkAccessibility: distinct from NetworkUserTW, as it signifies physical access but not the ability to send messages to connected devices, and
- LossOfSelectivity: distinct from LossOfServiceTW, signifies that access control is compromised but the service as a whole is not.
Abbreviations should be added for these consistent with the names of the threats causing them. In the process, the consistency between threats and misbehaviours can also be checked.
Note that some packages do not use the threat naming convention.
Misbehaviours have a URI and a readable label, but they also have an abbreviation code. This is used in a threat naming convention supported by the Domain Model Editor Access DB, which allows some consistency checking between threat URIs and what the threat does.
Specifically, the threat name includes the misbehaviour abbreviation code for its 'primary' effect. If the set of misbehaviours need to be changed, e.g., to incorporate finer discrimination between threat causes, then threats must also be changed. Checking that misbehaviour codes are consistent can help ensure that the changes to misbehaviours and threats have been made in a consistent way.
There are two relatively recently added misbehaviours that do not have abbreviation codes, making it impossible to check this:
Abbreviations should be added for these consistent with the names of the threats causing them. In the process, the consistency between threats and misbehaviours can also be checked.
Note that some packages do not use the threat naming convention.