HB-10Level 4 · Breach scenarioDBIR: Lost and Stolen Assets · VERIS: Physical
Lost & stolen devices
- Level 4 · Breach scenario
- 15 signals
- 4 risk domains
A breach in which a laptop, phone or storage medium holding company data is lost or stolen and was unencrypted, unmanaged or reported too late to wipe.
Classification
- Fed by risk domains One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Dimensions Every signal answers one of 3 questions.
- Evidence level
- Anchor
-
- DBIR: Lost and Stolen Assets · VERIS: Physical
- NIST CSF 2.0
-
- PR.DS-01
- PR.PS-01
- MITRE ATT&CK
-
- T1052.001
-
0
Sequences
End in this breach scenario.
-
0
Cohorts
Predict it.
-
15
Signals
Feed it.
-
4
Risk domains
Where those signals come from.
Sequences that lead here
No sequence ends here.
None of the 11 sequences in this version ends in Lost & stolen devices, and no cohort predicts it. The 15 signals below feed it.
-
DH-B-09
Disposes of data and devices securely
-
EP-T-05
Device quarantined or flagged compromised
-
EP-B-02
Connects USB storage
-
EP-B-03
Uses a rooted or jailbroken device
-
EP-B-04
Device fails MDM or encryption policy
-
EP-B-07
Leaves devices unlocked or unattended
-
EP-B-08
Lost or stolen device reported late
-
EP-B-09
Tailgates or shares badge access
-
EP-B-11
Keeps a compliant, protected device
-
EP-B-12
Reports lost devices within 24 hours
-
WC-B-07
Uses public Wi-Fi without VPN
-
RR-B-06
Reports a real incident or near miss
-
RR-T-01
Incident opened and attributed to the person
-
RR-B-10
Responds to emergency notification tests
-
RR-B-11
Participates in incident exercises
The definition, in detail
Definition
It is the Lost and Stolen Assets pattern in the Verizon DBIR and the Physical action in VERIS, which covers loss and theft.
Example
A field technician's unencrypted laptop is taken from a car, and the loss is reported four days later, after the device is already offline.
How it is measured
- Anchor
- DBIR: Lost and Stolen Assets · VERIS: Physical
- SOC signals
- Lost device tickets
- Fed by
- 15 signals across 4 risk domains
How it is used
Programs measure toward Lost & stolen devices by counting the 15 signals, 0 cohorts and 0 sequences that point to it, and tie them to the incidents the SOC records as lost device tickets.
A breach scenario names what the evidence beneath it points toward. The organization’s own incidents confirm it; the signals, cohorts and sequences show where it is likely.
Continue exploring
"Lost & stolen devices" (HB-10), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/breach-scenarios/hb-10-lost-and-stolen-devices
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · What's new in 2.0. This page describes one breach scenario.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.