Common Attack Pattern Enumeration and Classification

About CAPEC

CAPEC Glossary

This page defines specific terms used throughout CAPEC. A shared understanding of these terms is important during discussions of attack patterns and their related weaknesses.

The terms are presented in an order such that each term builds off of the previous terms:

• Cyber-Enabled Capability
• Weakness Type
• Weakness
• Negative Technical Impact
• Exploit
• Vulnerability
• Attack
• Attack Pattern
• View
• Graph
• Explicit Slice
• Implicit Slice
• Category
• Meta Attack Pattern
• Standard Attack Pattern
• Detailed Attack Pattern

A weakness type is a specific type of mistake or condition that, if left unaddressed, could under the proper conditions contribute to a cyber-enabled capability being vulnerable to attack, allowing an adversary to make items function in unintended ways. This term applies throughout the development life cycle and includes types of mistakes that occur during implementation, design, coding, or other phases. Common Weakness Enumeration (CWE™) provides a formal list of known software-related weakness types.

Weakness

A weakness is a condition in a software, firmware, hardware, or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.

Negative Technical Impact

A negative technical impact is the specific effect of successfully violating a reasonable security policy for the cyber-enabled capability. Denial of service, execution of unauthorized code, and bypassing protection mechanisms are examples of negative technical impacts.

Exploit

An exploit (noun) is an input or action designed to take advantage of a weakness (or multiple weaknesses) and achieve a negative technical impact. The existence (even if only theoretical) of an exploit is what makes a weakness a vulnerability.

Vulnerability

A vulnerability is a flaw in a software, firmware, hardware, or service component resulting from a weakness that can be exploited, causing a negative impact to the confidentiality, integrity, or availability of an impacted component or components.

Attack

An attack (noun) is the use of an exploit(s) by an adversary to take advantage of a weakness(s) with the intent of achieving a negative technical impact(s). An attack is part of the bigger "Cyber Attack Lifecycle" that includes the following tasks: reconnaissance, weaponize, deliver, exploit, control, execute, and maintain.

Attack Pattern

An attack pattern is the common approach and attributes related to the exploitation of a weakness in a software, firmware, hardware, or service component.

View

A view in CAPEC represents a perspective with which one might look at the collection of attack patterns defined within CAPEC. There are three different types of views: graphs, explicit slices, and implicit slices.

Graph

A graph in CAPEC is a hierarchical representation of attack patterns based on a specific vantage point that a user may take. The hierarchy often starts with a category, followed by a meta attack pattern/standard attack pattern, and ends with a detailed attack pattern.

Explicit Slice

An explicit slice in CAPEC is a subset of attack patterns that are related through some external factor. For example, a view may be used to represent mappings to external groupings like a Top-N list.

Implicit Slice

An implicit slice in CAPEC is a subset of attack patterns that are related through a specific attribute. For example, a slice may refer to all attack patterns in draft status, or all existing meta attack patterns.

Category

A category in CAPEC is a collection of attack patterns based on some common characteristic. More specifically, it is an aggregation of attack patterns based on effect/intent (as opposed to actions or mechanisms, such an aggregation would be a meta attack pattern). An aggregation based on effect/intent is not an actionable attack and as such is not a pattern of attack behavior. Rather, it is a grouping of patterns based on some common criteria.

Meta Attack Pattern

A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high-level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.

Standard Attack Pattern

A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.

Detailed Attack Pattern

A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.