Enumeration of threats. To use this approach, one must find a way to enumerate potential threats representing the possible causes of adverse user experiences. Some of these threats are evident in the analysis of selected use cases described in Section 5.2, but this will only find some of the possible threats even when extended to cover all the use cases from Deliverable D2.1. It is therefore important to understand how such a threat catalogue could be created. It turns out that different sources of information are available for each of the broad classes of threats identified above, and the largest number of threats arise from malicious attacks, where fortunately there is a large corpus available for analysis. Malicious stakeholder threats: in 5G networks are likely to be covered quite well by the analysis of use cases from D2.1, plus additional scenarios that may be identified during the project. To become a stakeholder in a socio-technical system, one must adopt a legitimate role with respect to that system, so malicious stakeholder threats normally arise where there is a potential conflict of interests, e.g. between the Subscriber’s desire to use a service and the Service Provider’s requirement that they be paid for the service. A typical threat may involve a Subscriber seeking to defraud the Service Provider to get some services without paying. These types of threats will provide a basis for modelling U2U trust (between stakeholders), and help 5G stakeholders determine what issues should be addressed through service level or subscriber agreements. Internal failures and non-malicious actions: these types of threats represent error conditions. They arise because they were not foreseen during the development of a system, in the sense that errors that are foreseen are usually eliminated during the system implementation phase. Because the specific bugs or user errors are unforeseen, the most important issue for a threat modeller is to capture their consequences and potential measures to mitigate these consequences. It is relatively easy to classify such threats in those terms, e.g. by considering whether the error leads to a compromise in confidentiality, integrity or availability in the affected system or component. External disasters: are also relatively easy to classify in terms of their effect on the integrity or availability of the affected system(s) or component(s). From a trust perspective, the most relevant threats are localised threats affecting particular parts of the net...
