According to the specification, these have no predefined list. These are defined as required for the situation.
291 This section of the security problem definition
shows the threats that are to be countered by the TOE, its operational
environment, or a combination of the two.
292 A threat consists of a
threat agent, an asset and an adverse action of that threat agent on
293 Threat agents are entities that can adversely act on
assets. Examples of threat agents are hackers, users, computer
processes, TOE development personnel, and accidents. Threat agents may
be further described by aspects such as expertise, resources,
opportunity and motivation.
294 Threat agents may be described as
individual entities, but in some cases it may be better to describe
them as types of entities, groups of entities etc.
295 Examples of
assets can be found in Section 7.1.
296 Adverse actions are actions
performed by a threat agent on an asset. These actions influence one
or more properties of an asset from which that asset derives its
297 Examples of threats are:
− a hacker (with substantial
expertise, standard equipment, and being paid to do so) remotely
copying confidential files from a company network;
− a worm seriously degrading the performance of a wide-area network;
− a system administrator violating user privacy;
− Someone on the Internet listening in on confidential electronic communication.