A type of threat action whereby an unauthorized entity
directly accesses sensitive data while the data is traveling
between authorized sources and destinations. (See: unauthorized
disclosure.)
Usage: This type of threat action includes the following subtypes:
- "Theft": Gaining access to sensitive data by stealing a
shipment of a physical medium, such as a magnetic tape or disk,
that holds the data.
- "Wiretapping (passive)": Monitoring and recording data that is
flowing between two points in a communication system. (See:
wiretapping.)
- "Emanations analysis": Gaining direct knowledge of communicated
data by monitoring and resolving a signal that is emitted by a
system and that contains the data but was not intended to
communicate the data. (See: emanation.)