Databreach Risk Event Data Model
This is the documentation of the Databreach Risk Event Data Model (and associated Cyber Incident Risk Events) used in Open Risk Data to capture Databreach Risk Events
The Data Model derives from the Vocabulary for Event Recording and Incident Sharing (VERIS), adapted to fit into the Wikibase Data Model
In terms of the overall risk taxonomy, a databreach risk event is
- roughly equivalent to IT Security Risk]
- which is a subtype of IT Risk]
- which is a subtype of Operational Risk] (for a managed entity such as a corporation or other organization)
- which is a subtype of Business Risk], the highest level category, capturing a variety of intangible risks to an organization that are not linked to specific contractual agreements
Contents
Event Subcategories
Databreach risk events are further subdivided according to the type of threat action used (membership of multiple classes is possible and not all categories are a form of "attack"):
NB this segmentation follows the VERIS approach, other approaches are possible, see eg. here the EBA Taxonomy and can be used in parallel (future work)
The Data Model Structure
The primary entity documented is a Databreach Risk Event (NB: Several auxiliary entities must be defined). The full description of Items and Properties is currently (version 0.1) as follows:
Databreach Item
The databreach item follows the general pattern of the wikibase datamodel:
- Item identifier (a serial ID number, prefixed with Q). This is a unique ID for an Item in the context of the Open Risk Data instance. This is assigned automatically by the system when an item is first inserted into the database. NB: This is not the same as the incident_id which is used to identify events in the VCDB and is here added as a statement
- Fingerprint, consisting of:
- Multilingual label, a human readable label. This is a unique textual description of an Item.
- Multilingual description, a longer description of the item constructed with snippets from the action
- Multilingual aliases, other possible labels for an item (NORMALLY NOT USED)
- Statements, associated with the item, each consisting of:
- Claim, consisting of:
- Property
- Value
- Qualifiers (additional property-value pairs)
- References (each consisting of one or more property-value pairs)
- Rank (NORMALLY NOT USED)
- Claim, consisting of:
Fingerprint
The fingerprint label is constructed out of incident data as a concatenated string of the form ENTITY + DATE + CATEGORY, where the DATE is MM/YEAR format obtained from timeline/incident data. The objective of the label is to create a user friendly field to help identify each incident
Claims about Items
The list of claims (statements) is as follows
- is instance of: the risk event type <- mapped from the type of threat "action"
- is same as item defined by external identifier (P15): mapped from VERIS incident_id
* has internal actor (subclass of has actor)
- has external actor (subclass of has actor)
- has loss amount
- involves entity
- has date: the date of occurence <- mapped from "timeline" / incident
- has textual description: mapped from VERIS summary, with reference URL from VERIS reference