whereby an entity gains access to data for which the entity is not authorized. (See: data confidentiality.). The following threat actions can cause unauthorized disclosure: "Exposure" A threat action whereby sensitive data is directly released to an unauthorized entity. This includes: "Deliberate Exposure" Intentional release of sensitive data to an unauthorized entity. "Scavenging" Searching through data residue in a system to gain unauthorized knowledge of sensitive data. * "Human error" Human action or inaction that unintentionally results in an entity gaining unauthorized knowledge of sensitive data. * "Hardware/software error" System failure that results in an entity gaining unauthorized knowledge of sensitive data. "Interception": A threat action whereby an unauthorized entity directly accesses sensitive data travelling between authorized sources and destinations. This includes: "Theft" Gaining access to sensitive data by stealing a shipment of a physical medium, such as a magnetic tape or disk, that holds the data. "Wiretapping (passive)" Monitoring and recording data that is flowing between two points in a communication system. (See: wiretapping.) "Emanations analysis" Gaining direct knowledge of communicated data by monitoring and resolving a signal that is emitted by a system and that contains the data but is not intended to communicate the data. "Inference" A threat action whereby an unauthorized entity indirectly accesses sensitive data (but not necessarily the data contained in the communication) by reasoning from characteristics or byproducts of communications. This includes: "Traffic analysis" Gaining knowledge of data by observing the characteristics of communications that carry the data. "Signals analysis" Gaining indirect knowledge of communicated data by monitoring and analyzing a signal that is emitted by a system and that contains the data but is not intended to communicate the data. "Intrusion" A threat action whereby an unauthorized entity gains access to sensitive data by circumventing a system's security protections. This includes: "Trespass" Gaining unauthorized physical access to sensitive data by circumventing a system's protections. "Penetration" Gaining unauthorized logical access to sensitive data by circumventing a system's protections. "Reverse engineering" Acquiring sensitive data by disassembling and analyzing the design of a system component. "Cryptanalysis" Transforming encrypted data into plain text without having prior knowledge of encryption parameters or processes. "Deception" (a threat consequence) A circumstance or event that may result in an authorized entity receiving false data and believing it to be true. The following threat actions can cause deception: "Masquerade" A threat action whereby an unauthorized entity gains access to a system