Incident Classification Taxonomy

Incident Classification Taxonomy
INCIDENT CLASSIFICATION INCIDENT EXAMPLES DESCRIPTION
1 Abusive content Child/Sexual/Violence/… Child pornography, glorification of violence, …
Spam «Unsolicited Bulk Email», this means that the recipient has not granted verifiable permission for the message to be sent and that the message is sent as part of a larger collection of messages, all having a functionally comparable content.
Harmful Speech Discreditation or discrimination of somebody.
2 Malicious Code Malware, Virus, Worm, Trojan, Spyware, Dialler, Rootkit Software that is intentionally included or inserted in a system for a harmful purpose. A user interaction is normally necessary to activate the code.
3 Information Gathering Scanning Attacks that send requests to a system to discover weak points. This includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …), port scanning.
Sniffing Observing and recording of network traffic (wiretapping).
Social engineering Gathering information from a human being in a non‐technical way (e.g. lies, tricks, bribes, or threats).
4 Intrusion Attemps Login attempts Multiple login attempts (Guessing / cracking of passwords, brute force).
Exploiting known vulnerabilities An attempt to compromise a system or to disrupt any service by exploiting vulnerabilities with a standardised identifier such as CVE name (e.g. buffer overflow, backdoor, cross site scripting, etc.).
New attack signature An attempt using an unknown exploit.
5 Intrusions Privileged account compromise A successful compromise of a system or application (service). This can have been caused remotely by a known or new vulnerability, but also by an unauthorized local access. Also includes being part of a botnet.
Unprivileged  account compromise
Application compromise, Bot
6 Availability Denial of Service (DoS / DDoS) By this kind of an attack a system is bombarded with so many packets that the operations are delayed or the system crashes. DoS examples are ICMP and SYN floods, Teardrop attacks and mail-bombing. DDoS often is based
on DoS attacks originating from botnets, but also other scenarios exist like DNS Amplification attacks. However, the availability also can be affected by local actions (destruction, disruption of power supply, etc.) – or by Act of God, spontaneous failures or human error, without malice or gross neglect being involved.
Sabotage
Outage (no malice)
7 Information Content Security Unauthorised access to information Besides a local abuse of data and systems the information security can be endangered by a successful account or application compromise. Furthermore, attacks are possible that intercept and access information during transmission (wiretapping, spoofing or hijacking). Human/configuration/software error can also be the cause.
Unauthorised modification of information
8 Fraud Phishing Masquerading as another entity in order to persuade the user to reveal a private credential
Copyright Offering or Installing copies of unlicensed commercial software or other copyright protected materials (Warez).
Unauthorized use of resources Using resources for unauthorized purposes including profit-making ventures (E.g. the use of e-mail to participate in illegal profit chain letters or pyramid schemes).
Masquerade Type of attacks in which one entity illegitimately assumes the identity of another in order to benefit from it.
9 Vulnerable Open for abuse Open resolvers, world readable printers, vulnerability apparent from Nessus etc scans, virus signatures not up-to-date, etc
10 Other All incidents which do not fit in one of the given categories should be put into this class
If the number of incidents in this category increases, it is an indicator that the classification scheme must be revised.
11 Test Meant for testing Meant for testing

Reference: ENISA