Databreach Risk Event Data Model

This is the documentation of the Databreach Risk Event Data Model (and associated Cyber Incident Risk Events) used in Open Risk Data to capture Databreach Risk Events

The Data Model derives from the Vocabulary for Event Recording and Incident Sharing (VERIS), adapted to fit into the Wikibase Data Model

In terms of the overall risk taxonomy, a databreach risk event is

• roughly equivalent to IT Security Risk]
• which is a subtype of IT Risk]
• which is a subtype of Operational Risk] (for a managed entity such as a corporation or other organization)
• which is a subtype of Business Risk], the highest level category, capturing a variety of intangible risks to an organization that are not linked to specific contractual agreements

Event Subcategories

Databreach risk events are further subdivided according to the type of threat action used (membership of multiple classes is possible and not all categories are a form of "attack"):

• Malware
• Hacking
• Social Engineering
• Misuse
• Physical Action
• Technical Error
• Environmental Hazards

NB this segmentation follows the VERIS approach, other approaches are possible, see eg. here the EBA Taxonomy

The Data Model Structure

The primary entity documented is a Databreach Risk Event (NB: Several auxiliary entities must be defined). The full description of Items and Properties is currently (version 0.1) as follows:

Databreach Item

The databreach item follows the general pattern of the wikibase datamodel:

1. Item identifier (a serial ID number, prefixed with Q). This is a unique ID for an Item in the context of the Open Risk Data instance. This is assigned automatically by the system when an item is first inserted into the database. It is not the same as the incident_id which is used to identify events in the VCDB
2. Fingerprint, consisting of:
   1. Multilingual label, a human readable label. This is a unique textual description of an Item. It is constructed out of incident data as a concatenated string of the form ENTITY + DATE + CATEGORY, where the DATE is MM/YEAR format obtained from timeline/incident data
   2. Multilingual description, a longer description of the item constructed with snippets from the action
   3. Multilingual aliases, other possible labels for an item (NORMALLY NOT USED)
3. Statements, associated with the item, each consisting of:
   1. Claim, consisting of:
      1. Property
      2. Value
      3. Qualifiers (additional property-value pairs)
   2. References (each consisting of one or more property-value pairs)
   3. Rank (NORMALLY NOT USED)

The list of claims (statements) is as follows

• is instance of: the risk event type <- mapped from the type of threat "action"
• is same as item defined by external identifier (P15): mapped from VERIS incident_id

* has internal actor (subclass of has actor)

• has external actor (subclass of has actor)
• has loss amount
• involves entity
• has date: the date of occurence <- mapped from "timeline" / incident
• has textual description: mapped from VERIS summary, with reference URL from VERIS reference