Operations and storage (OP)

Operations and storage (OP), layer 09 of 09: the path a message takes through the email stack, with this layer highlighted.

Taxonomies › Email infrastructure › Operations and storage

Layer 09 of 09 · 13 threats · prefix OP

The operational plane holds more copies of every message than the mailbox store does, each under a weaker access model. These entries cover archive, backup, search and logs, support and export tooling, configuration, credentials and offboarding.

Scope: The operational plane: archive, backup, search, logs, support access, configuration, offboarding.

Table: Operations and storage (OP), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the email infrastructure taxonomy overview page.

Text version: every entry on this page is in the PDF and Excel downloads on the overview page, where it can be searched and copied.

The threats

  • OP·A Support Access
  • OP·K Bulk Export
  • OP·Q Archive as Second Mailbox
  • OP·J Backup Exposure
  • OP·10 Unreviewed Configuration Change
  • OP·9 Connector Credentials
  • OP·8 Retention and Deletion Gap
  • OP·7 Content in Logs
  • OP·6 Search Index Leakage
  • OP·5 Audit Gap
  • OP·4 Offboarding Residue
  • OP·3 Alert Flood
  • OP·2 Production Data Elsewhere

Where this layer touches others

  • Operations and the other layers: delivery pipeline, client protocols and DNS each cover a corner of operations (admin routing changes in DP·2, mailbox state in CP·10, dangling records in DN·K). Operations and storage covers the stores and tooling around the message path: the copies, the credentials and the people with access.

STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 8 cleanly and 5 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, only a generic parent pattern for 9, and nothing for 3. CWE 4.20 names the weakness directly for 3, has only a broader weakness for 10,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in Mapping the Email Threat Taxonomy to STRIDE, CAPEC and CWE. The Excel, SKOS and STIX downloads carry the same mapping as text.

Table: STRIDE, CAPEC and CWE mapping for Operations and storage (OP), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the email infrastructure taxonomy overview page.

← Human-facing layer (HF) · Email infrastructure overview · Structural hazards (T) →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the email infrastructure overview.