Threats on a network diagram
The adversary and the things they bring.
18 objects in this group, each named in plain English with the technical terms kept as searchable aliases. 3 of them carry attack notes, and every one of those ships beside the defences that reduce it. 15 are defined in full below, and the other 3 have entries of their own.
Attacker
threat actor · adversary · intrusion set · activity cluster · APT · advanced persistent threat
The person or group carrying out the attack.
Why it matters on a security diagram
What they are after changes which defences matter. Who they are is a separate question, and a diagram should keep the two apart: the activity you observed is a fact, the group you match it to is a judgement.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Insider
insider threat · disgruntled employee · malicious insider
Someone inside the organisation deliberately acting against it.
Why it matters on a security diagram
They start with legitimate access, so a control that decides who may cross the boundary never gets the chance to refuse them. What sees them is whatever watches behaviour afterwards.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Malicious software
malware · trojan · worm · backdoor · RAT
Software written to do harm.
Why it matters on a security diagram
It is what turns a single click into persistent access.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Ransomware
crypto-locker · extortion malware
Software that scrambles your files and demands payment to unlock them.
Why it matters on a security diagram
Modern operations steal the data first, so paying does not undo the disclosure.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Phishing lure
phish · lure · spear-phishing · business email compromise · BEC · vishing · smishing
A message or call designed to get somebody to act against their own interest.
Why it matters on a security diagram
It targets the person rather than the technology, so no amount of patching removes it.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Stolen credentials
valid accounts · compromised account · leaked password
A real username and password now in the wrong hands.
Why it matters on a security diagram
The intruder is signing in legitimately, so nothing looks like an attack.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Attacker control server
C2 · command and control · C&C
Where hostile software phones home for instructions.
Why it matters on a security diagram
The connection out to it is often the most detectable moment in an entire intrusion.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Look-alike wireless network
evil twin · rogue access point · fake hotspot · malicious AP
A wireless network set up by somebody else that uses a name people already trust.
Why it matters on a security diagram
Devices and people choose a network by its name, so a copied name is enough to collect connections meant for you. What makes the copy fail is certificate-based joining with the device configured to check the server certificate against a named authority. Without that check the copy still succeeds, and a stronger password never helps.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Fake mobile mast
IMSI catcher · false base station · rogue cell site
Equipment that pretends to be a mobile phone mast so that nearby phones connect to it.
Why it matters on a security diagram
A phone will attach to whichever mast presents the strongest usable signal, so physical proximity is most of what the equipment needs. From 3G onwards the network authenticates itself to the handset, so these work by forcing a downgrade to 2G, or by abusing the messages exchanged before authentication happens. The defence is to disable 2G on managed handsets where the platform allows it, and to encrypt above the mobile network in every case rather than treating it as trusted.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Signal jammer
jammer · radio interference · denial of service radio
Equipment that drowns out a radio signal so that nothing can use it.
Why it matters on a security diagram
Anything depending on a radio can be taken away without touching a network: alarms, door systems, site radios, telemetry. Deliberate interference is an offence in the United Kingdom under the Wireless Telegraphy Act 2006, so this is an object to draw and never to procure.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Counterfeit location signal
GPS spoofing · GNSS spoofing · time spoofing
A false satellite signal that makes a receiver report the wrong place or the wrong time.
Why it matters on a security diagram
This is a lie rather than an outage, so nothing fails and nothing alerts. The defence is a second, independent source of time and an alarm on disagreement.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Cloned badge
copied credential · card clone · duplicated fob
A copy of somebody's door card that the reader cannot tell from the original.
Why it matters on a security diagram
It converts a moment of physical proximity into a working credential, and the entry it produces appears in the access log under a real person's name. Drawing it shows that a badge log is evidence of a card, not of a person.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Planted device
drop box · hardware implant · rogue device · malicious cable
Hardware left behind in a building so that somebody outside can reach in.
Why it matters on a security diagram
It converts a single visit into standing access, and it usually carries its own way out over a radio, so it never appears in the traffic anybody inspects.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Hijacked device network
botnet · zombie network
A large group of hijacked computers, all taking orders from one attacker at once.
Why it matters on a security diagram
It provides the scale behind overwhelming traffic and mass password guessing.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Attacker's data store
exfil server · drop site · upload destination · data drop
Where stolen data is sent and kept.
Why it matters on a security diagram
Data arriving here is the evidence that turns a suspected intrusion into a confirmed loss, which is usually when the legal and contractual clocks start. Whether it is notifiable depends on what the data was and whom it belonged to.
No attack notes, because this object is the attacker's. It is the thing arriving rather than the thing defended, and the defences sit on whatever it reaches.
Whose side, by default · Attacker. Working against the organisation.
Extortion site
leak site · data leak site · DLS · shame site · negotiation portal · victim blog
The page an extortion group uses to name victims and publish what they took.
Look-alike domain
typosquat · cousin domain · homoglyph domain · impersonating domain · spoofed domain
A name registered to be mistaken for a real one at a glance.
Injected instruction
prompt injection · indirect prompt injection · hostile prompt · poisoned content · instruction injection
Text written to be read by an automated system rather than by a person, telling it to do something its owner did not ask for.
The other groups
- Network7The paths traffic travels along.
- Wireless and radio11The parts of the network that travel through the air, and how far they reach.
- Cloud and subscribed services14Things that only exist because somebody else runs the platform underneath them.
- Security and edge14The things that sit in front of something else and check what is trying to reach it.
- Servers14Machines that run something for other machines.
- Storage4Where data sits still.
- Endpoints and devices9The things people and processes touch directly.
- Identity7Who something claims to be, and what proves it.
- People and organisations5The humans and the entities they belong to.
- Places4Physical locations and regions.
- Process flow7Shapes for describing a procedure rather than a network.
Draw it rather than read it
Every object above is in the editor. Press N, type a few letters of the plain name or the acronym, and it is placed and connected to whatever was selected. Nothing is uploaded, because the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram makerThe catalogue behind this page is published as open data under CC BY 4.0, last reviewed . Every attack note describes a mechanism and contains no procedure. Corrections are welcome.