{ "name": "NetworkMap object catalogue", "version": 2, "reviewed": "2026-08-30", "licence": "CC BY 4.0", "licenceUrl": "https://creativecommons.org/licenses/by/4.0/", "attribution": "NetworkMap object catalogue, P.K. Sharma, pk-sharma.com, CC BY 4.0", "source": "https://www.pk-sharma.com/tools/network-map", "sources": [ "MITRE ATT&CK, for technique vocabulary retained as aliases" ], "credit": "Inspired by net_draw by mr-r3b00t. Built clean-room: no code, no icons, no data, and every definition written from scratch.", "note": "Plain-English definitions of the objects that appear on network and attack diagrams, with the technical acronyms kept as aliases. Every attack note describes a mechanism only, contains no procedure, and ships beside the defences that reduce it. Written against the standard sources for each domain and reviewed for accuracy across network, infrastructure, cloud, wireless, threat intelligence and security architecture. Corrections are welcome and produce a version bump rather than a silent edit.", "counts": { "kinds": 100, "groups": 12, "sides": 6, "statuses": 13, "areaKinds": 6 }, "groups": [ { "id": "network", "name": "Network", "blurb": "The paths traffic travels along." }, { "id": "wireless", "name": "Wireless and radio", "blurb": "The parts of the network that travel through the air, and how far they reach." }, { "id": "cloud", "name": "Cloud and subscribed services", "blurb": "Things that only exist because somebody else runs the platform underneath them." }, { "id": "security", "name": "Security and edge", "blurb": "The things that sit in front of something else and check what is trying to reach it." }, { "id": "servers", "name": "Servers", "blurb": "Machines that run something for other machines." }, { "id": "storage", "name": "Storage", "blurb": "Where data sits still." }, { "id": "endpoints", "name": "Endpoints and devices", "blurb": "The things people and processes touch directly." }, { "id": "identity", "name": "Identity", "blurb": "Who something claims to be, and what proves it." }, { "id": "people", "name": "People and organisations", "blurb": "The humans and the entities they belong to." }, { "id": "places", "name": "Places", "blurb": "Physical locations and regions." }, { "id": "flow", "name": "Process flow", "blurb": "Shapes for describing a procedure rather than a network." }, { "id": "threat", "name": "Threats", "blurb": "The adversary and the things they bring." } ], "sides": [ { "id": "ours", "name": "Ours", "question": "Whose side?", "blurb": "Belongs to the organisation the diagram is about." }, { "id": "partner", "name": "Partner", "question": "Whose side?", "blurb": "Someone we deal with by arrangement: a supplier, a customer, a provider, another company in the group." }, { "id": "bystander", "name": "Bystander", "question": "Whose side?", "blurb": "No relationship with us and no choice in the matter: an unwitting hosting provider, a stranger's compromised machine." }, { "id": "responder", "name": "Responder", "question": "Whose side?", "blurb": "Acting to help: law enforcement, a national authority, an incident response team, a researcher." }, { "id": "unknown", "name": "Not established", "question": "Whose side?", "blurb": "Whose side this is on has not been established. The honest setting for outside infrastructure early in an investigation." }, { "id": "attacker", "name": "Attacker", "question": "Whose side?", "blurb": "Working against the organisation." } ], "statuses": [ { "id": "affected", "name": "Affected", "aliases": [ "victim", "impacted" ], "severity": 1, "blurb": "Harmed by the incident, whether or not it was the target." }, { "id": "weakness", "name": "Known weakness", "aliases": [ "vulnerable", "unpatched" ], "severity": 1, "blurb": "A flaw is present that has not yet been used." }, { "id": "odd-behaviour", "name": "Behaving oddly", "aliases": [ "suspicious activity", "anomalous" ], "severity": 2, "blurb": "Doing something out of character. Not yet explained." }, { "id": "offline", "name": "Offline", "aliases": [ "outage", "down" ], "severity": 2, "blurb": "Not working, for any reason." }, { "id": "overwhelmed", "name": "Overwhelmed", "aliases": [ "ddos", "denial of service" ], "severity": 2, "blurb": "Buried under more requests than it can answer." }, { "id": "weakness-used", "name": "Weakness used", "aliases": [ "exploited" ], "severity": 3, "blurb": "A known flaw has now actually been used against it." }, { "id": "infected", "name": "Infected", "aliases": [ "malware infection", "compromised host" ], "severity": 3, "blurb": "Hostile software is running on it." }, { "id": "data-leaving", "name": "Data leaving", "aliases": [ "exfiltration", "data theft" ], "severity": 3, "blurb": "Information is being copied out to somewhere it should not go." }, { "id": "broken-into", "name": "Broken into", "aliases": [ "breached", "compromised" ], "severity": 3, "blurb": "Someone who should not have access now has it." }, { "id": "being-listened-to", "name": "Being listened to", "aliases": [ "intercepted", "eavesdropped", "passive capture" ], "severity": 2, "blurb": "Somebody is receiving what it sends, without changing anything about it. It is working perfectly throughout." }, { "id": "impersonated", "name": "Impersonated", "aliases": [ "spoofed", "cloned", "look-alike" ], "severity": 3, "blurb": "Something else is successfully claiming to be it." }, { "id": "signal-lost", "name": "Signal lost", "aliases": [ "jammed", "interference", "out of range" ], "severity": 2, "blurb": "Its radio link is unusable, whether by accident or on purpose." }, { "id": "ransomed", "name": "Locked by ransomware", "aliases": [ "encrypted", "ransomware encryption" ], "severity": 3, "blurb": "Scrambled by an attacker who wants payment to undo it." } ], "areaKinds": [ { "id": "untrusted", "name": "Untrusted", "aliases": [ "internet", "public", "hostile network" ], "blurb": "Anything outside your control. Assume it is hostile." }, { "id": "perimeter", "name": "Perimeter", "aliases": [ "DMZ", "demilitarised zone", "edge" ], "blurb": "The buffer between the open internet and your internal network." }, { "id": "internal", "name": "Internal", "aliases": [ "corporate", "LAN", "office network" ], "blurb": "Your ordinary working network." }, { "id": "restricted", "name": "Restricted", "aliases": [ "crown jewels", "secure enclave" ], "blurb": "The part that matters most, with the tightest controls." }, { "id": "supplier-run", "name": "Supplier run", "aliases": [ "hosted elsewhere", "outsourced", "managed service", "provider estate" ], "blurb": "Runs on somebody else's infrastructure, under somebody else's rules." }, { "id": "air-gapped", "name": "Air-gapped", "aliases": [ "off-network", "air gap", "offline", "physical" ], "blurb": "No cabled path in or out. Establish which radios are inside it before calling it isolated." } ], "kinds": [ { "id": "internet", "name": "The internet", "aliases": [ "WAN", "public network" ], "group": "network", "icon": "Globe", "oneLine": "Everything outside your organisation's control.", "whyItMatters": "Almost everything that reaches you from outside arrives across it. Drawing it explicitly forces the question of what is exposed to it.", "commonlyAttacked": [ "Scanning for anything reachable and unpatched", "Guessing passwords on exposed sign-in pages" ], "defences": [ "Treat everything arriving from it as hostile, and keep an accurate list of what you expose to it", "Review that exposure on a schedule, because it grows without anyone deciding it should" ], "defaultSide": "bystander" }, { "id": "cloud", "name": "Cloud platform", "aliases": [ "AWS", "Azure", "GCP", "Google Cloud", "public cloud", "hyperscaler", "IaaS" ], "group": "cloud", "icon": "Cloud", "oneLine": "A supplier's computing platform, rented by the hour, where a setting made on a website creates or removes a whole system.", "whyItMatters": "It is a place, a supplier and a set of controls all at once, and it is reached by signing in rather than by connecting, so a network diagram never shows the way in. Responsibility is split with the provider, and the settings on your side of that line are the ones nobody else is checking.", "commonlyAttacked": [ "Its own controls reached from anywhere in the world, protected by a password alone", "Permissions granted once for a project and never reduced afterwards", "Systems created in accounts and locations that nobody was asked to watch" ], "defences": [ "A phishing-resistant second factor on every administrative sign-in, with no exception for machine accounts", "Account-wide limits, because they are the only control that still holds after an administrator account is taken", "The provider's activity record switched on in every account and every region, written where that account cannot delete it" ], "defaultSide": "ours" }, { "id": "router", "name": "Router", "aliases": [ "gateway", "layer 3" ], "group": "network", "icon": "Router", "oneLine": "Sends information from one network to another, the way a junction sends cars down different roads.", "whyItMatters": "It decides which networks can reach which. A change here can quietly undo a segmentation design.", "commonlyAttacked": [ "Default or shared administrator passwords", "Management interfaces reachable from the internet" ], "defences": [ "Individual named accounts rather than a shared one, and management reachable only from an administrative path", "Accept routing updates only from devices configured to send them", "Patch the device's own software on the same schedule as a server, because it is one" ], "defaultSide": "ours" }, { "id": "switch", "name": "Switch", "aliases": [ "layer 2", "LAN switch" ], "group": "network", "icon": "Network", "oneLine": "Connects the devices inside one building or floor, passing each message only to the machine it is addressed to.", "whyItMatters": "Segments are created and collapsed here, often by a single port setting, so a switch decides whether two systems that should never meet can reach each other.", "commonlyAttacked": [ "Ports left active in unattended rooms", "Segment settings changed to bridge networks that should stay apart" ], "defences": [ "Disable unused ports, and require a device to prove itself before the port carries traffic", "Review segment settings as configuration, since one port setting can collapse a boundary", "Keep management off the network the switch itself carries" ], "defaultSide": "ours" }, { "id": "access-point", "name": "Wi-Fi access point", "aliases": [ "AP", "wireless", "WAP" ], "group": "wireless", "icon": "Wifi", "oneLine": "Lets devices join the network without a cable.", "whyItMatters": "It extends your network past your walls to wherever the signal reaches, and the people who can hear it are on no visitor list and in no log.", "commonlyAttacked": [ "Weak or shared wireless passwords", "Look-alike networks that copy a legitimate name to harvest connections" ], "defences": [ "Per-user or certificate-based joining, which removes the shared secret entirely", "Turn off automatic joining for open and guest names on managed devices", "Separate guest traffic on the switch, not merely by the name shown on the device" ], "defaultSide": "ours" }, { "id": "vpn-gateway", "name": "Remote access gateway", "aliases": [ "VPN", "VPN concentrator", "remote access" ], "group": "network", "icon": "LogIn", "oneLine": "The door staff use to reach the internal network from outside.", "whyItMatters": "It is internet-facing by definition and it leads straight inside, which is why it is a standing target.", "commonlyAttacked": [ "Sign-in without a second factor", "Delayed patching of a widely published flaw in the appliance" ], "defences": [ "A phishing-resistant second factor, since a code or a prompt can be relayed in real time", "Patch appliance software urgently, because flaws in it are used at scale within days of publication", "Remove access when people leave, and reconcile the account list against the staff list" ], "defaultSide": "ours" }, { "id": "ip-range", "name": "Address range", "aliases": [ "CIDR", "subnet", "IP range" ], "group": "network", "icon": "Braces", "oneLine": "A group of numbered addresses on a network, written as a single line such as 192.0.2.0/24 rather than listed one by one.", "whyItMatters": "Lets a diagram say which addresses belong to which part of the network without drawing every device.", "commonlyAttacked": [ "Ranges wider than intended, quietly granting access to neighbours" ], "defences": [ "Write firewall rules against named groups rather than wide ranges", "Re-check rules when a range grows, because the rule silently grows with it" ], "defaultSide": "ours" }, { "id": "asn", "name": "Internet network operator", "aliases": [ "ASN", "autonomous system", "AS number", "BGP network", "peering" ], "group": "network", "icon": "Hexagon", "oneLine": "One organisation's own network on the internet, identified by a number so every other network knows whose it is.", "whyItMatters": "It is how you tell whose infrastructure an address actually belongs to, which is the difference between a supplier's server and a hosting provider that rents to anyone.", "commonlyAttacked": [ "Address ranges announced by a network with no right to them, pulling traffic somewhere it was never meant to go", "Operators with little oversight renting space for short-lived hostile infrastructure" ], "defences": [ "Publish which networks are allowed to announce your address ranges, and monitor for announcements that are not yours", "Check who operates an address block before treating traffic from it as ordinary" ], "defaultSide": "bystander" }, { "id": "wireless-network-name", "name": "Wireless network name", "aliases": [ "SSID", "network name", "WLAN", "guest wifi" ], "group": "wireless", "icon": "Rss", "oneLine": "The name devices show in their list of available wireless networks.", "whyItMatters": "The name is the whole of what a person or a device checks before connecting, and it is the one part of a wireless network anybody can copy.", "commonlyAttacked": [ "A name copied exactly by another transmitter, so devices join the wrong network on the strength of the label alone", "Hidden names treated as a control, when the name is still carried by every device that goes looking for it", "A guest name and a staff name served onto the same internal network by the same equipment" ], "defences": [ "Certificate-based joining, configured so the device checks the server certificate against a named authority before it connects. Without that check the copy still succeeds, and a stronger password never helps", "Separate guest traffic on the switch, because the label on the device is not a boundary", "Do not rely on hiding a name: it is tidiness, not protection" ], "defaultSide": "ours" }, { "id": "wireless-controller", "name": "Wireless controller", "aliases": [ "WLC", "wireless LAN controller", "AP controller", "cloud-managed wireless" ], "group": "wireless", "icon": "SlidersHorizontal", "oneLine": "The single system that configures and watches every wireless access point.", "whyItMatters": "One change here reaches every access point at once, including the settings that decide which wireless network reaches which part of the internal network.", "commonlyAttacked": [ "Administrator access reachable from the ordinary staff network", "Cloud-managed estates where the vendor account, not the network, is the real control plane", "Configuration pushed to every site at once, so one wrong setting removes segmentation everywhere" ], "defences": [ "Keep administration on a separate path, not on the staff network", "Put a phishing-resistant second factor on the vendor account, which is the real control plane", "Stage configuration changes rather than pushing to every site at once" ], "defaultSide": "ours" }, { "id": "cellular-router", "name": "Mobile broadband router", "aliases": [ "4G router", "5G router", "cellular modem", "MiFi", "dongle", "tethering" ], "group": "wireless", "icon": "Signal", "oneLine": "A box, or a phone, that gives a network its own connection through the mobile phone network.", "whyItMatters": "It is a second way in and out that does not pass through the firewall, the web filter or the logging. That is exactly why it gets used, and exactly why it belongs on the diagram.", "commonlyAttacked": [ "Traffic taking a path that no gateway inspects and no log records", "A backup link left live at all times instead of only during an outage", "Commissioned quickly by a team that needed connectivity, and never handed over" ], "defences": [ "Look for the connection existing at all, since there will be no record of what crossed it", "Keep a standby link disconnected until it is needed, because one always connected is a second front door", "Require a handover record before any site connection goes live" ], "defaultSide": "ours" }, { "id": "satellite-terminal", "name": "Satellite terminal", "aliases": [ "VSAT", "satcom", "satellite internet", "BGAN" ], "group": "wireless", "icon": "SatelliteDish", "oneLine": "A dish or flat panel that connects a site to the internet through a satellite.", "whyItMatters": "It is often the only link at a remote site, a ship or a vehicle, which makes it both the lifeline and the single path an adversary needs to sit on.", "commonlyAttacked": [ "One link with no alternative, so loss of the link is loss of the site", "Traffic assumed private because the path is unusual, when the downlink covers a very wide area", "Fleets of identical terminals updated centrally, so one supplier problem reaches every site at once" ], "defences": [ "Encrypt end to end and treat the link as public, because directional does not mean unhearable", "Decide what the site does offline before it has to", "Ask how the provider authorises updates before signing, since the fleet moves together" ], "defaultSide": "ours" }, { "id": "gnss-receiver", "name": "Satellite time and location receiver", "aliases": [ "GPS", "GNSS", "GPS clock", "grandmaster clock", "timing source" ], "group": "wireless", "icon": "Satellite", "oneLine": "A device that works out where it is, and what the time is, from satellites.", "whyItMatters": "Far more depends on it than anyone expects. Log timestamps, certificate validity, one-time codes and access schedules all quietly assume the clock is right.", "commonlyAttacked": [ "A faint signal from far away outweighed by a stronger local one, so the receiver reports a time that is not true", "One receiver supplying time for an entire estate with no fallback of a different kind", "A clock that steps without raising anything, because nothing monitors time as a signal in its own right" ], "defences": [ "Compare against an independent source of a different kind and alert on disagreement", "Two sources of different kinds is the control; a better single source is not", "Alert on the step change, not only on the outage" ], "defaultSide": "ours" }, { "id": "bluetooth-device", "name": "Bluetooth device", "aliases": [ "BT", "Bluetooth Low Energy", "BLE", "pairing", "wireless keyboard" ], "group": "wireless", "icon": "Bluetooth", "oneLine": "Something that connects to a phone or a computer over a short-range radio link: a headset, a keyboard, a car.", "whyItMatters": "It is a network of its own that no firewall sees, and the devices on it frequently hold keyboard, microphone or file access to the machine they pair with.", "commonlyAttacked": [ "Pairing left open, or accepted on a prompt nobody read", "Input devices that can type, which makes them a route into the machine rather than an accessory on it", "Pairings kept indefinitely from hire cars, hotels and former colleagues' equipment" ], "defences": [ "Make pairing a deliberate act at a known time in a known place, not a standing state", "Treat a wireless keyboard as an interface into the machine, not an accessory on it", "Put clearing pairings into the travel routine and the leaver process" ], "defaultSide": "ours" }, { "id": "low-power-radio-device", "name": "Low-power radio device", "aliases": [ "LoRa", "LoRaWAN", "Zigbee", "Z-Wave", "sub-GHz", "wireless sensor" ], "group": "wireless", "icon": "Radio", "oneLine": "A small battery-powered sensor or switch that sends short messages over a long range: a meter, a door contact, a thermostat.", "whyItMatters": "These are chosen for battery life rather than for security, deployed in the hundreds, and frequently control something physical: heating, lighting, doors, water.", "commonlyAttacked": [ "Keys fixed at manufacture and shared across a production batch, so one recovered device speaks for many", "Messages accepted on content alone with no check on freshness", "Deployments that outlive the supplier, leaving devices that can never be updated" ], "defences": [ "Ask how keys are issued and whether they can be changed in the field, before purchase", "Look for replay protection in the specification rather than in the brochure", "Set the replacement date at purchase, because these will outlive their supplier" ], "defaultSide": "ours" }, { "id": "radio-gateway", "name": "Radio gateway", "aliases": [ "IoT gateway", "LoRaWAN gateway", "Zigbee hub", "protocol bridge", "smart hub" ], "group": "wireless", "icon": "Cast", "oneLine": "The box that turns messages from small wireless sensors into ordinary network traffic.", "whyItMatters": "It is the seam where a radio world with almost no authentication meets a network that assumes there is some. Whatever it forwards is believed downstream.", "commonlyAttacked": [ "Sensor messages passed inwards without the gateway asserting anything about where they came from", "A device sitting on the internal network and on an open radio network at the same time", "Consumer hubs bought by a facilities team, never inventoried and never patched" ], "defences": [ "Make the gateway decide what is worth believing, because nothing downstream will", "Give it its own segment on the network side, since it bridges two worlds by design", "Fix this at purchasing: an uninventoried hub is the common case" ], "defaultSide": "ours" }, { "id": "contactless-reader", "name": "Contactless reader", "aliases": [ "NFC reader", "tap reader", "payment terminal", "card terminal" ], "group": "wireless", "icon": "Nfc", "oneLine": "A pad that reads a card, a phone or a wristband held against it, usually to take a payment.", "whyItMatters": "It handles payment data and sits in a public area where anybody can touch it. That combination is unusual, and it is regulated.", "commonlyAttacked": [ "Substitution or tampering in a public area, because one terminal looks much like another to a customer", "Terminals connected to the ordinary shop or office network rather than a dedicated one", "Estates managed by an installer holding standing remote access" ], "defences": [ "Serial checks and tamper seals, done by the people who use the device daily rather than on an audit cycle", "Give card handling equipment its own segment", "Establish who can reach the terminals remotely and how that access is approved" ], "defaultSide": "ours" }, { "id": "wireless-monitor", "name": "Wireless monitoring sensor", "aliases": [ "WIDS", "WIPS", "wireless intrusion detection", "air monitor" ], "group": "wireless", "icon": "Radar", "oneLine": "Equipment that listens to the airwaves and reports transmitters that should not be there.", "whyItMatters": "It is the only object on a wireless diagram that would notice an added or a copied transmitter. A diagram showing a wireless attack with no sensor on it is also showing why nobody saw it.", "commonlyAttacked": [ "Deployed to satisfy an audit and then left with nobody reading the alerts", "Coverage that follows where access points were convenient rather than where the boundary is", "Everything unfamiliar suppressed to quieten the noise from neighbouring tenants" ], "defences": [ "Write the response before the first alert arrives, because an unread alert is an absent control", "Map monitoring against the boundary, not against the office", "Tune the noise; do not suppress the category" ], "defaultSide": "ours" }, { "id": "firewall", "name": "Firewall", "aliases": [ "NGFW", "packet filter" ], "group": "security", "icon": "BrickWall", "oneLine": "Decides which connections are allowed between two networks.", "whyItMatters": "The rules on it are the actual boundary. What the diagram claims and what the firewall permits are often different.", "commonlyAttacked": [ "Rules added for a project and never removed", "Management interface exposed to the internet" ], "defences": [ "Review rules on a schedule and remove the ones added for finished projects", "Keep the management interface off the internet entirely", "Patch the appliance urgently, because flaws in the device itself are exploited within days of publication. Review the rules on their own schedule: both routes are live and neither has replaced the other" ], "defaultSide": "ours" }, { "id": "web-shield", "name": "Web app shield", "aliases": [ "WAF", "web application firewall" ], "group": "security", "icon": "ShieldCheck", "oneLine": "Checks visits to your website and blocks the ones that look like an attack.", "whyItMatters": "It buys time against known attack shapes, but it is a filter in front of the flaw, not a fix for it.", "commonlyAttacked": [ "Requests reshaped until they no longer match a filter", "Origin server reachable directly, bypassing the shield entirely" ], "defences": [ "Fix the flaw behind it, because this is a filter in front of a weakness rather than a repair of it", "Make the origin server unreachable except through the shield, or it is simply bypassed" ], "defaultSide": "ours" }, { "id": "web-filter", "name": "Outbound web filter", "aliases": [ "forward proxy", "secure web gateway", "SWG", "web filter", "web proxy" ], "group": "security", "icon": "ArrowLeftRight", "oneLine": "Checks and records everything staff and servers send out to the internet.", "whyItMatters": "It is often the only place outbound traffic is recorded, which makes it the place data leaving is noticed. It also holds a signing certificate that every company machine has been told to trust.", "commonlyAttacked": [ "Traffic routed around it entirely", "Blending in with ordinary web traffic so nothing looks unusual", "The signing certificate it uses to open encrypted traffic, which every company machine already trusts" ], "defences": [ "Route outbound traffic through it by policy, not by hoping", "Protect its signing certificate as you would a domain controller, since every company machine already trusts it", "Alert on traffic that leaves by any other path" ], "defaultSide": "ours" }, { "id": "traffic-splitter", "name": "Traffic splitter", "aliases": [ "load balancer", "LB", "ADC" ], "group": "security", "icon": "GitFork", "oneLine": "Spreads incoming requests across several servers.", "whyItMatters": "It is the real front door for most services, so it holds the certificates and sees every request.", "commonlyAttacked": [ "Individual servers reachable directly, skipping the front door", "Health check endpoints left unauthenticated" ], "defences": [ "Make individual servers unreachable except through it", "Do not trust address headers it adds unless nothing else can inject them", "Treat it as a key store, because it holds the private keys for everything behind it" ], "defaultSide": "ours" }, { "id": "content-cache", "name": "Global content cache", "aliases": [ "CDN", "content delivery network", "edge cache" ], "group": "security", "icon": "Earth", "oneLine": "Copies your content to servers worldwide so pages load faster.", "whyItMatters": "It sits in front of everything public, so it is both a shield and a place private content can be cached by mistake.", "commonlyAttacked": [ "Private responses cached and served to the wrong people", "The origin server left reachable at its real address" ], "defences": [ "Set cache rules so private responses are never stored, and test that they are not", "Keep the origin unreachable at its real address" ], "defaultSide": "ours" }, { "id": "api-front-door", "name": "API front door", "aliases": [ "API gateway" ], "group": "security", "icon": "DoorOpen", "oneLine": "One controlled entrance for the automatic requests other software makes of yours, without a person involved.", "whyItMatters": "It is where authentication, rate limits and logging for automated traffic are applied, or forgotten.", "commonlyAttacked": [ "Individual services reachable behind the gateway's back", "Keys valid far longer and far wider than intended" ], "defences": [ "Make services unreachable except through it", "Issue short-lived keys scoped to one caller, and record which caller used which", "Inventory endpoints, because one published without being listed is one nothing reviews" ], "defaultSide": "ours" }, { "id": "endpoint-agent", "name": "Endpoint protection", "aliases": [ "EDR", "antivirus", "AV", "XDR" ], "group": "security", "icon": "ScanEye", "oneLine": "Software on each computer watching for hostile behaviour.", "whyItMatters": "It is often the only witness to what happened on a machine, which makes it both a defence and evidence.", "commonlyAttacked": [ "Being switched off or excluded before anything else happens", "Machines that were never enrolled at all" ], "defences": [ "Alert on the agent being switched off or excluded, since that is usually the first step", "Reconcile enrolled machines against the asset register, because the gap is where the incident happens" ], "defaultSide": "ours" }, { "id": "log-collector", "name": "Log collector", "aliases": [ "SIEM", "log server", "syslog" ], "group": "security", "icon": "ScrollText", "oneLine": "Collects the records of what happened, from every computer and system, into one place.", "whyItMatters": "If it is not collecting from a system, an incident on that system leaves no trace to investigate.", "commonlyAttacked": [ "Logs cleared or forwarding stopped to remove the trail", "Retention too short to cover how long the intruder was present" ], "defences": [ "Check what is not sending to it, which is the question that matters", "Retain for longer than the time an intruder is typically present, or the records will not cover the incident", "Write records somewhere the systems they describe cannot delete" ], "defaultSide": "ours" }, { "id": "secrets-store", "name": "Secrets store", "aliases": [ "vault", "secrets manager", "credential store", "password safe" ], "group": "security", "icon": "KeyRound", "oneLine": "The safe where passwords, keys and certificates are kept.", "whyItMatters": "Reaching it converts one compromised machine into access to everything it holds credentials for.", "commonlyAttacked": [ "Application credentials found in code or configuration instead", "Access tokens reused far beyond their intended scope" ], "defences": [ "Grant access per secret rather than at the safe, so one application cannot read every credential", "Prefer platform-issued machine identities, which remove the stored credential entirely", "Rotate on a schedule and alert on a secret fetched from an unexpected place" ], "defaultSide": "ours" }, { "id": "server", "name": "Server", "aliases": [ "host", "machine" ], "group": "servers", "icon": "Server", "oneLine": "A computer that runs something for other computers.", "whyItMatters": "The generic building block. Use a more specific kind where you know one.", "commonlyAttacked": [ "Unpatched software with a published flaw", "Administrator accounts shared between machines" ], "defences": [ "Give every server a named owner, because a machine nobody owns is a machine nobody patches", "Patch on a schedule that matches how exposed it is", "Stop reusing local administrator credentials between machines" ], "defaultSide": "ours" }, { "id": "web-server", "name": "Web server", "aliases": [ "HTTP server", "website" ], "group": "servers", "icon": "MonitorCheck", "oneLine": "The computer that sends your website to anybody who visits it.", "whyItMatters": "Usually the most exposed thing an organisation runs, which is why it is scanned continuously by people who have never heard of you.", "commonlyAttacked": [ "Flaws in the application it hosts rather than the server itself", "File upload features used to leave behind a way back in" ], "defences": [ "Patch the application it hosts, not only the server software", "Treat upload directories as untrusted and prevent anything in them from executing" ], "defaultSide": "ours" }, { "id": "app-server", "name": "Application server", "aliases": [ "backend", "business logic tier" ], "group": "servers", "icon": "Blocks", "oneLine": "Runs the working parts of an application, behind the website.", "whyItMatters": "It usually holds the credentials for the database, so reaching it often means reaching the data.", "commonlyAttacked": [ "Trusting input that has already passed the web tier", "Service accounts with far more access than the job needs" ], "defences": [ "Validate input at this tier too, rather than trusting that the web tier did", "Give its service account only the database rights the job needs" ], "defaultSide": "ours" }, { "id": "database", "name": "Database", "aliases": [ "DB", "SQL server", "data store" ], "group": "servers", "icon": "Database", "oneLine": "Stores the organised information an application depends on.", "whyItMatters": "It is usually the thing an attacker actually came for, and the thing a regulator will ask about.", "commonlyAttacked": [ "Queries built from untrusted input", "Backups readable by people who cannot read the live database" ], "defences": [ "Use parameterised queries, so untrusted input is bound as a value and never becomes part of the query text. Table and column names cannot be parameterised, so those need an allow-list", "Protect backups with the same controls as the live data, since they hold the same content", "Record reads, not only changes, or the size of a loss cannot be established afterwards" ], "defaultSide": "ours" }, { "id": "mail-server", "name": "Mail server", "aliases": [ "email server", "Exchange", "SMTP" ], "group": "servers", "icon": "Mail", "oneLine": "Sends, receives and stores the organisation's email.", "whyItMatters": "It is both a way in and years of accumulated sensitive content in one place.", "commonlyAttacked": [ "Rules quietly added to forward mail elsewhere", "Sign-in from anywhere in the world without a second factor" ], "defences": [ "Alert on forwarding and hiding rules being created, which is the usual first sign", "A phishing-resistant second factor on every mailbox, including shared ones", "Review which applications hold standing access to mailboxes, because a password reset does not remove them" ], "defaultSide": "ours" }, { "id": "dns-server", "name": "Name server", "aliases": [ "DNS", "domain name server" ], "group": "servers", "icon": "Signpost", "oneLine": "Translates names like example.com into network addresses.", "whyItMatters": "Whoever controls name resolution controls where traffic actually goes, regardless of what users typed.", "commonlyAttacked": [ "Registrar or hosting records changed to redirect a domain", "Name lookups used as a quiet channel to carry data out" ], "defences": [ "Lock the registrar account with its own second factor and a registry lock", "Monitor for lookups used as a data channel, which look like ordinary traffic in volume", "Remove records pointing at services you no longer run" ], "defaultSide": "ours" }, { "id": "file-server", "name": "File server", "aliases": [ "SMB server", "network share" ], "group": "servers", "icon": "FolderOpen", "oneLine": "Holds shared documents everyone can reach over the network.", "whyItMatters": "Broad access by design, which is why ransomware reaches so much of an organisation through it.", "commonlyAttacked": [ "Shares open to everyone rather than to a specific group", "Used as the route to reach many machines at once" ], "defences": [ "Grant shares to named groups, never to everyone", "Keep previous versions and snapshots under separate credentials from the live data", "Limit how much one workstation account can reach, since that is the path encryption takes" ], "defaultSide": "ours" }, { "id": "vm-host", "name": "Virtual machine host", "aliases": [ "hypervisor", "ESXi", "Hyper-V" ], "group": "servers", "icon": "LayoutGrid", "oneLine": "One physical server pretending to be many.", "whyItMatters": "Reaching the host puts every machine running on it within reach at once, which is a different problem from compromising any one of them.", "commonlyAttacked": [ "Management interfaces on the ordinary office network", "Unpatched flaws in the host software itself" ], "defences": [ "Keep management interfaces off the ordinary office network", "Patch the host on the same urgency as an internet-facing server", "Watch for encryption applied at the host, which hits every guest at once and never runs an in-guest agent" ], "defaultSide": "ours" }, { "id": "jump-host", "name": "Jump host", "aliases": [ "bastion", "jump box", "hardened admin host" ], "group": "servers", "icon": "Footprints", "oneLine": "The single controlled machine administrators go through to reach sensitive systems.", "whyItMatters": "It exists to be the only path in. If another path exists, the control is decorative.", "commonlyAttacked": [ "Alternative routes that bypass it", "Sessions left open and reused" ], "defences": [ "Make the sensitive systems unreachable by any other route, or the control is decorative", "Record sessions, because this is the one place a full view of administrative work could exist", "Expire sessions rather than letting them be left open and reused" ], "defaultSide": "ours" }, { "id": "backup-server", "name": "Backup server", "aliases": [ "backup", "Veeam", "backup controller" ], "group": "servers", "icon": "DatabaseBackup", "oneLine": "Makes and manages the spare copies of your data that let you recover after something goes wrong.", "whyItMatters": "Ransomware operators look for backups, because destroying them is what creates the pressure to pay. A backup system reachable with ordinary credentials is part of the attack surface, not outside it.", "commonlyAttacked": [ "Backups reachable with ordinary network credentials", "No copy kept offline or unchangeable" ], "defences": [ "Keep at least one copy that ordinary network credentials cannot reach or delete", "Keep backup software accounts out of the ordinary administrator groups", "Test a restore, since a copy nobody has restored from is a hope rather than a control" ], "defaultSide": "ours" }, { "id": "update-server", "name": "Update server", "aliases": [ "WSUS", "patch server", "software distribution" ], "group": "servers", "icon": "RefreshCw", "oneLine": "Distributes software updates to every machine.", "whyItMatters": "It is trusted to install software everywhere, which is exactly why it is worth taking.", "commonlyAttacked": [ "Updates delivered over connections that are not verified", "Its trusted reach used to distribute something else" ], "defences": [ "Verify update packages by signature, not by where they came from", "Treat it as a system that can run code everywhere, because it is", "Alert on distributions nobody scheduled" ], "defaultSide": "ours" }, { "id": "build-pipeline", "name": "Build pipeline", "aliases": [ "CI/CD", "Jenkins", "GitHub Actions" ], "group": "servers", "icon": "Workflow", "oneLine": "The automated production line that turns written code into the software the business actually runs.", "whyItMatters": "It holds credentials for production and can publish code, which makes it a route into everything it deploys to.", "commonlyAttacked": [ "Secrets readable by any job that runs", "Dependencies pulled in without verification" ], "defences": [ "Scope secrets to the job that needs them rather than to every job", "Write the trust condition tightly, so a fork or an unowned repository cannot claim the cloud role", "Do not run code from a proposed change before it has been reviewed", "Use fresh machines per job, so one job cannot leave something for the next" ], "defaultSide": "ours" }, { "id": "model-endpoint", "name": "AI model endpoint", "aliases": [ "LLM API", "inference endpoint", "model service", "AI service" ], "group": "cloud", "icon": "Sparkles", "oneLine": "Where an application sends a question, along with documents, images or data, to an AI model and gets an answer back.", "whyItMatters": "It handles untrusted input by design, and whatever consumes its answer usually trusts it. Where the model has been given tools or credentials of its own, its permissions are the blast radius.", "commonlyAttacked": [ "Instructions hidden in content the model later reads", "Model output used to trigger actions without a check" ], "defences": [ "Treat model output as untrusted input to whatever consumes it", "Never let an answer trigger an action without a check in between", "Give the model narrower access than the person asking, not wider" ], "learnMore": "prompt-injection-patterns", "defaultSide": "ours" }, { "id": "telephony", "name": "Phone system", "aliases": [ "VoIP", "PBX", "telephony server" ], "group": "servers", "icon": "PhoneCall", "oneLine": "Runs the organisation's telephone calls over the network.", "whyItMatters": "Often managed separately from IT and forgotten in reviews, while sitting on the same network as everything else.", "commonlyAttacked": [ "Default administrator credentials", "Call routing abused to place expensive calls at your cost" ], "defences": [ "Change default credentials on the call platform", "Agree a verification step for any request that arrives by voice, because caller display can be set to anything", "Restrict call routing so it cannot be used to place expensive calls" ], "defaultSide": "ours" }, { "id": "shared-file-store", "name": "Shared file store", "aliases": [ "NAS", "network attached storage" ], "group": "storage", "icon": "HardDrive", "oneLine": "A box on the network that holds shared files.", "whyItMatters": "Frequently bought by a department rather than IT, and frequently never patched.", "commonlyAttacked": [ "Management pages reachable from the internet", "Known flaws in consumer models, targeted at scale" ], "defences": [ "Keep snapshot schedules and retention under different credentials from the live data", "Take management pages off the internet", "Inventory units bought by departments, which is where the unpatched ones are" ], "defaultSide": "ours" }, { "id": "storage-network", "name": "Storage network", "aliases": [ "SAN", "storage area network" ], "group": "storage", "icon": "Layers", "oneLine": "A high-speed network whose only job is connecting servers to disks.", "whyItMatters": "It underpins many systems at once, so a problem here is rarely contained to one of them.", "commonlyAttacked": [ "Management network shared with ordinary office traffic" ], "defences": [ "Keep the storage management network separate from ordinary office traffic", "Watch who can change which server sees which disks, because that is a one-step data move" ], "defaultSide": "ours" }, { "id": "object-storage", "name": "Cloud storage", "aliases": [ "S3", "blob storage", "bucket", "object storage", "cloud file storage" ], "group": "storage", "icon": "Package", "oneLine": "A pool of files kept in a cloud platform, each one labelled and fetched by name rather than filed in folders.", "whyItMatters": "It is where the large, quiet, long-lived copies of things end up, and the folder rules people expect do not apply to it. Access can be granted in several different places at once, so the honest question is not whether it is public but the full list of who can read it.", "commonlyAttacked": [ "Read access granted broadly through permissions rather than by making it public", "Links that let anyone holding them fetch the contents, long after they were needed", "Keys for it left in code, in configuration or in a build record", "Reads of the contents not recorded by default, so a copy taken leaves no trace" ], "defences": [ "Review who can read it through permissions, which is now the common path rather than a public setting", "Expire signed links, and never issue one without an expiry", "Keep its keys out of code, configuration and build records", "Switch on read logging, or a copy taken leaves no trace" ], "defaultSide": "ours" }, { "id": "backup-vault", "name": "Backup vault", "aliases": [ "immutable backup", "offline backup", "air-gapped copy" ], "group": "storage", "icon": "Archive", "oneLine": "A copy of your data held so that it cannot be changed or deleted for a set period, including by an administrator, for as long as the retention lock is genuinely in force.", "whyItMatters": "It is the control that decides whether operations can be restored without paying, because it is the copy the encryption could not reach. It does nothing about data already copied out, which is why recovery and disclosure are two separate problems.", "commonlyAttacked": [ "Retention locks not actually enabled", "The only copy sitting on the same network as the live data" ], "defences": [ "Confirm the retention lock is actually enabled, not merely available", "Keep the copy off the network and under different credentials from production", "Retain for longer than the time an intruder was present, or every surviving copy contains them" ], "defaultSide": "ours" }, { "id": "workstation", "name": "Desktop computer", "aliases": [ "workstation", "PC", "desktop" ], "group": "endpoints", "icon": "Monitor", "oneLine": "A computer somebody sits at to do their job.", "whyItMatters": "Where people open attachments and click links, which makes it a routine first foothold.", "commonlyAttacked": [ "Attachments and links delivered by email", "Local administrator rights that were never needed" ], "defences": [ "Remove local administrator rights, which were rarely needed and are routinely used", "Filter attachments and links before they arrive, and expect some to get through anyway", "Keep the machine enrolled in endpoint protection and alert when it is not" ], "defaultSide": "ours" }, { "id": "laptop", "name": "Laptop", "aliases": [ "notebook", "mobile workstation" ], "group": "endpoints", "icon": "Laptop", "oneLine": "A portable computer that leaves the building.", "whyItMatters": "It spends time on networks you do not control, then comes back and reconnects to yours.", "commonlyAttacked": [ "Theft, where the disk was never encrypted", "Connections made on untrusted public networks" ], "defences": [ "Encrypt the disk and require shutdown or hibernate rather than sleep, so a stolen machine is a loss of hardware rather than of data", "Assume public networks are hostile and require the remote access gateway for anything internal" ], "defaultSide": "ours" }, { "id": "phone", "name": "Mobile phone", "aliases": [ "smartphone", "mobile", "handset" ], "group": "endpoints", "icon": "Smartphone", "oneLine": "A pocket computer that reads company email.", "whyItMatters": "It usually holds the second factor that protects every other account.", "commonlyAttacked": [ "Approval prompts sent repeatedly until somebody taps accept", "Mobile numbers moved onto an attacker's device through the network operator" ], "defences": [ "Number matching and a limit on repeated prompts, which removes prompt fatigue rather than training against it", "Move off codes sent by text, because the number can be moved to another device through the operator and the code can be relayed in real time", "Turn off notification previews for authentication apps" ], "defaultSide": "ours" }, { "id": "printer", "name": "Printer", "aliases": [ "MFP", "multifunction device", "copier" ], "group": "endpoints", "icon": "Printer", "oneLine": "Prints, scans and often emails documents.", "whyItMatters": "A full computer with a hard disk and stored credentials, and one that rarely appears on a patching schedule or an asset register.", "commonlyAttacked": [ "Stored network credentials read from its configuration", "Default administrator passwords" ], "defences": [ "Change default administrator passwords, which is rarely done because nobody signs in to it", "Put it in the asset register so it appears on a patching schedule", "Do not store network credentials in it where its configuration can be read" ], "defaultSide": "ours" }, { "id": "iot-device", "name": "Smart device", "aliases": [ "IoT", "internet of things", "connected device", "camera", "CCTV", "IP camera", "security camera", "sensor", "door lock", "smart TV" ], "group": "endpoints", "icon": "Cpu", "oneLine": "Everyday equipment with a network connection: cameras, sensors, door locks, TVs.", "whyItMatters": "Bought outside IT, often with no way to update it, and usually on the same network as everything else.", "commonlyAttacked": [ "Fixed passwords built into the product", "Recruitment into networks of hijacked devices" ], "defences": [ "Ask at purchase whether the fixed credential can be changed, and refuse products where it cannot", "Put it on its own segment with no path to anything internal", "Watch outbound traffic, since recruitment shows as traffic leaving while the device keeps working" ], "defaultSide": "ours" }, { "id": "plant-equipment", "name": "Plant equipment", "aliases": [ "OT", "ICS", "SCADA", "operational technology" ], "group": "endpoints", "icon": "Factory", "oneLine": "Machinery that runs a physical process: a pump, a valve, a production line.", "whyItMatters": "Failure here has physical consequences, and the equipment often cannot be patched or taken offline.", "commonlyAttacked": [ "Reached through the ordinary office network", "Protocols that were designed with no authentication at all" ], "defences": [ "Keep a filtering point between the office network and the plant network, and know every path across it", "Where the equipment cannot be patched, control what can reach it instead", "Treat protocols with no authentication as requiring the network to provide it" ], "defaultSide": "ours" }, { "id": "controller", "name": "Machine controller", "aliases": [ "PLC", "RTU", "programmable logic controller" ], "group": "endpoints", "icon": "CircuitBoard", "oneLine": "The small computer that tells a piece of machinery what to do.", "whyItMatters": "It is the last step between a network instruction and something physical moving.", "commonlyAttacked": [ "Instructions accepted without any check on who sent them", "Displays showing normal readings while the process is altered" ], "defences": [ "Restrict which systems may send it instructions, since it will not check who sent them", "Compare displayed readings against an independent source, because a display can be made to look normal" ], "defaultSide": "ours" }, { "id": "card-reader", "name": "Door access reader", "aliases": [ "card reader", "badge reader", "access control" ], "group": "endpoints", "icon": "CreditCard", "oneLine": "Reads a badge to unlock a door.", "whyItMatters": "It is where physical access and network access meet, and it is often on the ordinary network.", "commonlyAttacked": [ "Badges copied from a short distance away", "Following an authorised person through the door" ], "defences": [ "Use an authenticated reader-to-controller protocol and a tamper switch that reports", "Reconcile badge records against the staff list, and investigate the difference", "Anti-passback and an occupancy count, which catch the badge that follows a tailgate rather than the tailgate itself; only a turnstile or an airlock stops two people entering on one badge" ], "defaultSide": "ours" }, { "id": "identity-provider", "name": "Sign-in service", "aliases": [ "IdP", "SSO", "identity provider", "Entra ID", "Okta" ], "group": "identity", "icon": "FingerprintPattern", "oneLine": "The single service that proves who someone is, for every application.", "whyItMatters": "One sign-in unlocks everything connected to it, which is convenient for staff and for whoever takes it over.", "commonlyAttacked": [ "Session tokens stolen after a legitimate sign-in", "Trust settings altered to accept identities from elsewhere" ], "defences": [ "A phishing-resistant second factor, because a code or prompt can be relayed in real time", "Review which applications have been granted standing access, since that access survives a password reset", "Alert on changes to trust settings, which is how identities from elsewhere get accepted" ], "defaultSide": "ours" }, { "id": "directory", "name": "Directory service", "aliases": [ "Active Directory", "AD", "DC", "LDAP", "domain controller", "staff directory", "identity store" ], "group": "identity", "icon": "ServerCog", "oneLine": "The system that holds every account and computer, and decides what each one is allowed to do.", "whyItMatters": "Control of it is control of the whole estate, which is why it is the usual objective of an intrusion.", "commonlyAttacked": [ "Escalating from an ordinary account to an administrative one", "Old accounts and permissions nobody removed" ], "defences": [ "Tier administrative accounts so an ordinary workstation compromise cannot reach a domain administrator", "Review delegated permissions, which accumulate into a path to full control nobody granted deliberately", "Protect backups and replicas as strongly as the live system, since the account database can be taken from either" ], "defaultSide": "ours" }, { "id": "second-factor", "name": "Second factor", "aliases": [ "MFA", "2FA", "multi-factor authentication" ], "group": "identity", "icon": "ShieldPlus", "oneLine": "A second proof of identity beyond the password.", "whyItMatters": "It removes the value of a stolen password on its own, which is why the systems it does not cover are where intrusions tend to start. How much it removes depends entirely on which second factor: a hardware key resists the phishing that intercepts a code or a prompt.", "commonlyAttacked": [ "Repeated approval prompts until somebody accepts one", "Sign-in paths that were never covered by it" ], "defences": [ "Prefer a hardware key or passkey, which is bound to the site and resists relay; a code or prompt is not", "Cover every sign-in path, because the one that was missed is the one that gets used", "Alert on a factor being registered through account recovery, which is how a real one gets replaced" ], "defaultSide": "ours" }, { "id": "service-account", "name": "Machine account", "aliases": [ "service account", "robot account", "non-human account", "application account" ], "group": "identity", "icon": "Bot", "oneLine": "An account used by software rather than by a person.", "whyItMatters": "Its password rarely changes, nobody watches it, and it usually carries more access than any person would be given. It is also the account most often left out of the second factor and out of the sign-in rules, because a program cannot answer a prompt, which quietly makes it the way around both.", "commonlyAttacked": [ "Credentials found in scripts and configuration files", "Broad permissions granted once to make something work" ], "defences": [ "Replace with a platform-issued machine identity where the platform supports it, which removes the stored credential", "Scope permissions to the job and review them, since they are granted once and never reduced", "Do not reuse the same account between test and live" ], "defaultSide": "ours" }, { "id": "certificate", "name": "Certificate", "aliases": [ "TLS certificate", "PKI", "code signing certificate" ], "group": "identity", "icon": "BadgeCheck", "oneLine": "A digital document proving something is genuinely what it claims to be.", "whyItMatters": "Software and browsers accept it without asking a person, so a stolen one lets hostile code arrive looking legitimate.", "commonlyAttacked": [ "Signing certificates stolen and used to sign malicious software", "Certificates issued by an authority that was tricked into vouching for the wrong party" ], "defences": [ "Keep signing keys in protected hardware, not beside the code that uses them", "Monitor expiry so an outage is never resolved by turning checks off", "Watch certificate transparency logs for certificates issued in your name that you did not request" ], "defaultSide": "ours" }, { "id": "access-badge", "name": "Access badge", "aliases": [ "proximity card", "prox card", "RFID card", "fob", "smart card", "staff pass" ], "group": "identity", "icon": "IdCard", "oneLine": "The card or fob a person holds against a reader to open a door.", "whyItMatters": "It is a credential like a password, but it is carried in a pocket, lent between colleagues and readable by anything close enough. It is also the credential least often included in a joiners and leavers review.", "commonlyAttacked": [ "Older card types that answer with a fixed number to any reader that asks, so a copy cannot be told from the original", "Cards that keep working after somebody leaves, because the badge system is not joined to the leaver process", "Visitor and contractor cards issued in bulk and never returned" ], "defences": [ "Move off card types that answer with a fixed number: no reader can compensate for that", "Reconcile the badge list against the staff list on a schedule and investigate the difference", "Expire visitor and contractor cards by date rather than on trust" ], "defaultSide": "ours" }, { "id": "person", "name": "Person", "aliases": [ "user", "employee", "staff member" ], "group": "people", "icon": "User", "oneLine": "A named individual involved in the diagram.", "whyItMatters": "A person doing something reasonable in an unreasonable situation is a recurring shape in incidents, which is why the person belongs on the diagram. Label the role rather than the individual unless there is a reason not to.", "commonlyAttacked": [ "Convincing messages that create urgency", "Phone calls impersonating IT support" ], "defences": [ "Make reporting a suspicious approach easy and blameless, because that is the only control that reaches this", "Verify unusual requests through a second channel the requester did not choose" ], "defaultSide": "ours" }, { "id": "supplier", "name": "Supplier", "aliases": [ "vendor", "third party", "contractor", "MSP" ], "group": "people", "icon": "Building", "oneLine": "Another organisation with access to your systems.", "whyItMatters": "Their security becomes yours the moment you grant them access, and you rarely get to inspect it.", "commonlyAttacked": [ "Standing access that outlives the engagement", "Compromise of the supplier, reaching all of their customers" ], "defences": [ "Time-bound their access and remove it at the end of the engagement rather than on trust", "Require them to notify you of their own incidents, in the contract", "Give them the narrowest access that does the job, and record what it reaches" ], "defaultSide": "bystander" }, { "id": "organisation", "name": "Organisation", "aliases": [ "company", "entity", "business" ], "group": "people", "icon": "Landmark", "oneLine": "A company, agency or other body.", "whyItMatters": "An incident rarely stops at one company. Naming the other entities is what makes a supply chain visible instead of implied.", "commonlyAttacked": [], "defaultSide": "bystander" }, { "id": "customer", "name": "Customer", "aliases": [ "client", "data subject", "end user" ], "group": "people", "icon": "UserCheck", "oneLine": "Somebody the organisation serves.", "whyItMatters": "Usually the person whose data is at stake, and the reason a breach carries legal weight.", "commonlyAttacked": [ "Fraud using details taken from a breach elsewhere" ], "defences": [ "Tell them promptly when their data is affected, because they cannot act on what they do not know" ], "defaultSide": "bystander" }, { "id": "site", "name": "Site", "aliases": [ "office", "location", "branch" ], "group": "places", "icon": "MapPin", "oneLine": "A physical place the organisation operates from.", "whyItMatters": "Network boundaries and legal obligations often follow physical sites.", "commonlyAttacked": [ "Entry by following staff through a controlled door" ], "defences": [ "Keep network sockets in public areas inactive until a device proves itself", "Assess an acquired site before joining it to the corporate network, not afterwards" ], "defaultSide": "ours" }, { "id": "data-centre", "name": "Data centre", "aliases": [ "server room", "colocation", "comms room" ], "group": "places", "icon": "Warehouse", "oneLine": "The building or room where the servers physically live.", "whyItMatters": "Physical access removes assumptions that most other controls rest on, which is why the access list matters as much as the firewall rules.", "commonlyAttacked": [ "Access lists never reviewed after people leave" ], "defences": [ "Review the access list after every leaver, not on an annual cycle", "Keep building systems off the network that serves the servers they cool" ], "defaultSide": "ours" }, { "id": "region", "name": "Region", "aliases": [ "country", "jurisdiction", "cloud region" ], "group": "places", "icon": "Map", "oneLine": "A country or geographic area.", "whyItMatters": "Which laws apply turns on where the organisation operates, whom it serves and where the data sits, and those three answers frequently disagree. Drawing the region makes the disagreement visible.", "commonlyAttacked": [], "defences": [ "Apply the same records, limits and monitoring to every region you have switched on, not only the ones you expected to use" ], "defaultSide": "bystander" }, { "id": "start-end", "name": "Start or end", "aliases": [ "terminator" ], "group": "flow", "icon": "Circle", "oneLine": "Where a process begins or finishes.", "whyItMatters": "Every procedure diagram needs an explicit beginning and end.", "commonlyAttacked": [] }, { "id": "step", "name": "Step", "aliases": [ "process", "action", "task" ], "group": "flow", "icon": "Square", "oneLine": "One action in a procedure.", "whyItMatters": "The unit of a runbook or an incident response plan.", "commonlyAttacked": [] }, { "id": "decision", "name": "Decision", "aliases": [ "choice", "fork" ], "group": "flow", "icon": "Diamond", "oneLine": "A point where the path splits depending on the answer.", "whyItMatters": "Where a procedure most often goes wrong under pressure.", "commonlyAttacked": [] }, { "id": "data-item", "name": "Data", "aliases": [ "input", "output", "record" ], "group": "flow", "icon": "FileInput", "oneLine": "Information going into or coming out of a step.", "whyItMatters": "Makes it explicit what a step actually handles.", "commonlyAttacked": [] }, { "id": "document", "name": "Document", "aliases": [ "report", "form", "written output" ], "group": "flow", "icon": "FileText", "oneLine": "A written output, such as a report or a form.", "whyItMatters": "Often the evidence an auditor asks to see.", "commonlyAttacked": [] }, { "id": "subprocess", "name": "Subprocess", "aliases": [ "predefined process", "sub-procedure" ], "group": "flow", "icon": "Rows3", "oneLine": "A step defined in detail somewhere else.", "whyItMatters": "Keeps a diagram readable by hiding detail that belongs elsewhere.", "commonlyAttacked": [] }, { "id": "note", "name": "Note", "aliases": [ "annotation", "comment", "label" ], "group": "flow", "icon": "StickyNote", "oneLine": "A piece of explanatory text on the diagram.", "whyItMatters": "Carries the caveat that stops a diagram being misread.", "commonlyAttacked": [] }, { "id": "cloud-account", "name": "Cloud account", "aliases": [ "subscription", "project", "AWS account", "Azure subscription", "Google Cloud project", "cloud environment" ], "group": "cloud", "icon": "SquareStack", "oneLine": "One named compartment of a cloud platform, with its own bill and its own list of who may change what.", "whyItMatters": "It is the container most cloud diagrams leave out, and it is usually the real blast radius: anyone with control of the account reaches everything inside it without crossing a single boundary drawn on the page. How solid a wall it is differs by provider, so the diagram should say which one.", "commonlyAttacked": [ "Administrative sign-in protected by a password alone", "Access granted to a supplier or a second account and never withdrawn", "Resources created in an account nobody was asked to watch" ], "defences": [ "A phishing-resistant second factor on every administrative sign-in", "Review cross-account grants on a schedule, since they are made once and forgotten", "Do not assume a compartment on one platform separates identities the way it does on another" ], "defaultSide": "ours" }, { "id": "cloud-account-group", "name": "Cloud account group", "aliases": [ "management group", "AWS Organizations", "GCP folder", "landing zone", "account structure" ], "group": "cloud", "icon": "FolderTree", "oneLine": "The parent that owns all of an organisation's cloud accounts and can set rules over every one of them.", "whyItMatters": "It sits above every account on the diagram, so it is the one place where a single change reaches the whole estate. It is also the only complete list of accounts, which makes it the answer to the question most organisations cannot answer.", "commonlyAttacked": [ "Control of the top account, which carries authority over every account beneath it", "Accounts opened outside the agreed structure, and therefore outside its rules", "Rules applied to some branches of the structure and quietly not to others" ], "defences": [ "Treat the top account as the most privileged thing you own, and use it almost never", "Reconcile the billing list against the structure, because an account outside it is outside every rule", "Check rule coverage per branch rather than assuming it inherits" ], "defaultSide": "ours" }, { "id": "cloud-control-plane", "name": "Cloud control panel", "aliases": [ "control plane", "management console", "cloud portal", "cloud API", "management plane" ], "group": "cloud", "icon": "CloudCog", "oneLine": "The website and commands used to configure the cloud itself, as opposed to the systems running inside it.", "whyItMatters": "This is the difference between a cloud diagram and a network diagram. It answers to who you are signed in as rather than where you are connecting from, it is reachable from anywhere in the world by design, and one change made here can undo every network control drawn elsewhere on the page.", "commonlyAttacked": [ "Reached from any location, because the network controls on the diagram do not apply to it", "Long-lived keys that carry the same power as the sign-in page without any of its checks", "Changes made through it that leave no trace on the systems they affect" ], "defences": [ "Sign-in rules on it, since this is the perimeter and the firewall rules are not", "Replace long-lived keys with short-lived, issued identities wherever the platform allows", "Record control-plane changes separately from the systems they alter" ], "defaultSide": "ours" }, { "id": "saas-app", "name": "Supplier-run application", "aliases": [ "SaaS", "software as a service", "cloud application", "business application" ], "group": "cloud", "icon": "AppWindow", "oneLine": "An application a supplier runs entirely, which the organisation subscribes to and puts its data into.", "whyItMatters": "You cannot patch it, scan it, or sign in to the machine it runs on. The only controls you hold are who has an account, what those accounts may do, and what you choose to put in it. What you can find out afterwards usually depends on a subscription tier chosen on price.", "commonlyAttacked": [ "Sign-in reachable from anywhere, with the organisation's own network controls not applying to it", "Sharing settings that make documents readable by anyone holding a link", "Administrative accounts far more numerous than anyone intended" ], "defences": [ "Route sign-in through your own identity provider so your rules apply", "Audit sharing links and expire them, because they outlive the reason they were made", "Check the audit tier at purchase, not during the incident" ], "defaultSide": "ours" }, { "id": "connected-app", "name": "Connected app", "aliases": [ "OAuth application", "app registration", "enterprise application", "app consent", "add-in" ], "group": "cloud", "icon": "Puzzle", "oneLine": "An outside program that somebody has allowed to reach company data on their behalf.", "whyItMatters": "Its access survives a password change and usually survives the second factor as well, because the permission was granted deliberately rather than stolen. It appears on almost no diagrams, and it is frequently the one thing still connected after everything else has been shut down.", "commonlyAttacked": [ "Permission granted by a member of staff in no position to judge what was being asked for", "Applications registered by an attacker and left in place as a way back", "Requests that copy the name and appearance of a familiar product" ], "defences": [ "Turn off user consent and route requests through an administrator", "Include connected apps in incident response, because resetting passwords does not remove them", "Review the registered list on a schedule; nobody notices an addition otherwise" ], "defaultSide": "bystander" }, { "id": "managed-database", "name": "Managed database", "aliases": [ "RDS", "Azure SQL", "Cloud SQL", "database as a service", "DBaaS" ], "group": "cloud", "icon": "DatabaseZap", "oneLine": "A database the cloud provider runs, where the data and the settings are yours but the machine is never touched.", "whyItMatters": "It usually holds the data an incident is actually about, and it can be reached two ways: the ordinary database sign-in, and the platform's own controls, which can copy it or open it up without ever connecting to it.", "commonlyAttacked": [ "Left reachable from the internet when it only ever needed to answer one application", "Copies taken for safekeeping and then shared or moved somewhere with weaker controls", "Reads of the data not recorded, so the size of a loss cannot be established afterwards" ], "defences": [ "Reach it through a private service link and switch off the public address separately", "Apply the live controls to snapshots and copies, which are the same data", "Switch on read logging before you need it" ], "defaultSide": "ours" }, { "id": "serverless-function", "name": "On-demand function", "aliases": [ "serverless", "Lambda", "Azure Functions", "Cloud Run", "FaaS" ], "group": "cloud", "icon": "Zap", "oneLine": "A small piece of code that runs only when something asks for it, with no server to look after.", "whyItMatters": "It carries an identity of its own, so what it can reach is settled by permissions rather than by where it sits. It appears on no network diagram and in no server inventory, while holding access that reaches real data.", "commonlyAttacked": [ "Permissions attached to the code that are far wider than the job it does", "Set going by content from outside, so untrusted input reaches it directly", "Gone in seconds by design, leaving little behind unless records were arranged in advance" ], "defences": [ "Scope the identity to the one job, since there is no host to constrain it", "Treat trigger content as untrusted, because that is how it arrives", "Arrange logging in advance; there is nothing to examine afterwards" ], "defaultSide": "ours" }, { "id": "container-platform", "name": "Container platform", "aliases": [ "Kubernetes", "K8s", "cluster", "EKS", "AKS", "GKE", "OpenShift" ], "group": "cloud", "icon": "Container", "oneLine": "The system that decides where each packaged application runs, and starts it again when it stops.", "whyItMatters": "It keeps its own list of who may do what, separate from the cloud account's, and its own internal network where by default everything can reach everything else. Control of it is control of every application it runs.", "commonlyAttacked": [ "Its own list of permissions treated as an afterthought beside the cloud account's", "Anything inside able to reach anything else inside, because no internal restrictions were set", "Its administrative interface reachable from far more places than the few that need it" ], "defences": [ "Review its permission list as a first-class identity system, because it is one", "Set internal network rules; the default is that everything reaches everything", "Restrict the administrative interface to the few places that need it" ], "defaultSide": "ours" }, { "id": "container-registry", "name": "Container image store", "aliases": [ "container registry", "image registry", "ECR", "ACR", "artefact store" ], "group": "cloud", "icon": "PackageOpen", "oneLine": "The library of packaged applications that machines fetch from whenever they start something.", "whyItMatters": "Everything in it is trusted and run automatically, so changing what it holds changes what runs everywhere, without touching a single server.", "commonlyAttacked": [ "Permission to publish held far more widely than the few systems that actually publish", "A label reused, so the same name quietly begins to mean different contents", "Packages pulled from outside stores with no check on who produced them" ], "defences": [ "Restrict publish rights to the pipeline, not to people", "Refer to images by their content rather than by a label that can be moved", "Verify the publisher of anything pulled from outside" ], "defaultSide": "ours" }, { "id": "iac-state", "name": "Infrastructure blueprint", "aliases": [ "infrastructure as code", "IaC", "Terraform", "state file", "CloudFormation", "Bicep" ], "group": "cloud", "icon": "FileCode", "oneLine": "The written description of what the cloud should contain, together with the record of what was actually built.", "whyItMatters": "It is a second way to change the estate that goes around every console, every approval and most of this diagram. The record it keeps is also a map of everything you own, and it often contains the passwords used along the way in readable form.", "commonlyAttacked": [ "The record file kept where more people can read it than can change the estate", "Changes applied straight from a proposal before anyone has approved it", "Building blocks pulled in from public sources and then run with full permissions" ], "defences": [ "Protect the record file as a secret, because it contains them", "Never apply from an unreviewed proposal", "Pin and review third-party building blocks; they run with your permissions" ], "defaultSide": "ours" }, { "id": "key-service", "name": "Encryption key service", "aliases": [ "KMS", "key management service", "key vault", "HSM", "customer-managed key" ], "group": "security", "icon": "LockKeyhole", "oneLine": "The service that holds the keys used to scramble stored data, and decides who may use them.", "whyItMatters": "Scrambling data at rest is only as good as the list of who may use the key, and that is a second set of permissions most reviews never open. It cuts both ways: losing access to a key makes the data unreadable to you as surely as to anybody else.", "commonlyAttacked": [ "Use of a key permitted to a far wider set of accounts than the data itself is", "One key shared across environments, so a test system can read live data", "Records of key use not collected, leaving no way to show what was unscrambled" ], "defences": [ "Read the key policy as carefully as the data permissions, because it is the real control", "Separate keys per environment, so test cannot read live", "Log key use, or you cannot establish what was decrypted" ], "defaultSide": "ours" }, { "id": "cloud-audit-log", "name": "Cloud activity record", "aliases": [ "CloudTrail", "activity log", "control plane log", "audit trail" ], "group": "security", "icon": "FileClock", "oneLine": "The provider's own record of every change made to the cloud, and of who made it.", "whyItMatters": "It is the first thing anyone investigating a cloud incident asks for, and the answer decides whether the rest of the investigation is possible at all. It is a record an intruder can stop but cannot rewrite, which makes a gap in it a finding in its own right.", "commonlyAttacked": [ "Switched off, or never switched on, in an account or a location nobody was watching", "Recording changes to a store but not reads from it, so a copy taken leaves no trace", "Kept only inside the account it describes, where whoever controls the account controls the evidence" ], "defences": [ "Switch it on in every account and every region, enforced by an account-wide rule", "Enable data-level read logging separately; change logging alone will not show a copy taken", "Write it to an account the recorded one cannot reach, and alert on it stopping" ], "defaultSide": "ours" }, { "id": "threat-actor", "name": "Attacker", "aliases": [ "threat actor", "adversary", "intrusion set", "activity cluster", "APT", "advanced persistent threat" ], "group": "threat", "icon": "UserX", "oneLine": "The person or group carrying out the attack.", "whyItMatters": "What they are after changes which defences matter. Who they are is a separate question, and a diagram should keep the two apart: the activity you observed is a fact, the group you match it to is a judgement.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "insider", "name": "Insider", "aliases": [ "insider threat", "disgruntled employee", "malicious insider" ], "group": "threat", "icon": "UserMinus", "oneLine": "Someone inside the organisation deliberately acting against it.", "whyItMatters": "They start with legitimate access, so a control that decides who may cross the boundary never gets the chance to refuse them. What sees them is whatever watches behaviour afterwards.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "malware", "name": "Malicious software", "aliases": [ "malware", "trojan", "worm", "backdoor", "RAT" ], "group": "threat", "icon": "Bug", "oneLine": "Software written to do harm.", "whyItMatters": "It is what turns a single click into persistent access.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "ransomware", "name": "Ransomware", "aliases": [ "crypto-locker", "extortion malware" ], "group": "threat", "icon": "Lock", "oneLine": "Software that scrambles your files and demands payment to unlock them.", "whyItMatters": "Modern operations steal the data first, so paying does not undo the disclosure.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "phishing", "name": "Phishing lure", "aliases": [ "phish", "lure", "spear-phishing", "business email compromise", "BEC", "vishing", "smishing" ], "group": "threat", "icon": "MailWarning", "oneLine": "A message or call designed to get somebody to act against their own interest.", "whyItMatters": "It targets the person rather than the technology, so no amount of patching removes it.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "stolen-credentials", "name": "Stolen credentials", "aliases": [ "valid accounts", "compromised account", "leaked password" ], "group": "threat", "icon": "KeySquare", "oneLine": "A real username and password now in the wrong hands.", "whyItMatters": "The intruder is signing in legitimately, so nothing looks like an attack.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "c2-server", "name": "Attacker control server", "aliases": [ "C2", "command and control", "C&C" ], "group": "threat", "icon": "RadioTower", "oneLine": "Where hostile software phones home for instructions.", "whyItMatters": "The connection out to it is often the most detectable moment in an entire intrusion.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "rogue-access-point", "name": "Look-alike wireless network", "aliases": [ "evil twin", "rogue access point", "fake hotspot", "malicious AP" ], "group": "threat", "icon": "WifiHigh", "oneLine": "A wireless network set up by somebody else that uses a name people already trust.", "whyItMatters": "Devices and people choose a network by its name, so a copied name is enough to collect connections meant for you. What makes the copy fail is certificate-based joining with the device configured to check the server certificate against a named authority. Without that check the copy still succeeds, and a stronger password never helps.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "fake-base-station", "name": "Fake mobile mast", "aliases": [ "IMSI catcher", "false base station", "rogue cell site" ], "group": "threat", "icon": "TowerControl", "oneLine": "Equipment that pretends to be a mobile phone mast so that nearby phones connect to it.", "whyItMatters": "A phone will attach to whichever mast presents the strongest usable signal, so physical proximity is most of what the equipment needs. From 3G onwards the network authenticates itself to the handset, so these work by forcing a downgrade to 2G, or by abusing the messages exchanged before authentication happens. The defence is to disable 2G on managed handsets where the platform allows it, and to encrypt above the mobile network in every case rather than treating it as trusted.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "signal-jammer", "name": "Signal jammer", "aliases": [ "jammer", "radio interference", "denial of service radio" ], "group": "threat", "icon": "SignalZero", "oneLine": "Equipment that drowns out a radio signal so that nothing can use it.", "whyItMatters": "Anything depending on a radio can be taken away without touching a network: alarms, door systems, site radios, telemetry. Deliberate interference is an offence in the United Kingdom under the Wireless Telegraphy Act 2006, so this is an object to draw and never to procure.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "counterfeit-location-signal", "name": "Counterfeit location signal", "aliases": [ "GPS spoofing", "GNSS spoofing", "time spoofing" ], "group": "threat", "icon": "Navigation", "oneLine": "A false satellite signal that makes a receiver report the wrong place or the wrong time.", "whyItMatters": "This is a lie rather than an outage, so nothing fails and nothing alerts. The defence is a second, independent source of time and an alarm on disagreement.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "cloned-badge", "name": "Cloned badge", "aliases": [ "copied credential", "card clone", "duplicated fob" ], "group": "threat", "icon": "Copy", "oneLine": "A copy of somebody's door card that the reader cannot tell from the original.", "whyItMatters": "It converts a moment of physical proximity into a working credential, and the entry it produces appears in the access log under a real person's name. Drawing it shows that a badge log is evidence of a card, not of a person.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "planted-device", "name": "Planted device", "aliases": [ "drop box", "hardware implant", "rogue device", "malicious cable" ], "group": "threat", "icon": "PackagePlus", "oneLine": "Hardware left behind in a building so that somebody outside can reach in.", "whyItMatters": "It converts a single visit into standing access, and it usually carries its own way out over a radio, so it never appears in the traffic anybody inspects.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "botnet", "name": "Hijacked device network", "aliases": [ "botnet", "zombie network" ], "group": "threat", "icon": "Boxes", "oneLine": "A large group of hijacked computers, all taking orders from one attacker at once.", "whyItMatters": "It provides the scale behind overwhelming traffic and mass password guessing.", "commonlyAttacked": [], "defaultSide": "attacker" }, { "id": "exfil-store", "name": "Attacker's data store", "aliases": [ "exfil server", "drop site", "upload destination", "data drop" ], "group": "threat", "icon": "CloudUpload", "oneLine": "Where stolen data is sent and kept.", "whyItMatters": "Data arriving here is the evidence that turns a suspected intrusion into a confirmed loss, which is usually when the legal and contractual clocks start. Whether it is notifiable depends on what the data was and whom it belonged to.", "commonlyAttacked": [], "defaultSide": "attacker" } ] }