Malicious programs and Moderate Moderate Perform periodic system testing to code could be injected by ensure that the system checks for a malicious user and used accuracy, completeness, validity and to obtain back door access authenticity to prevent malicious to the system or improper code or unauthorized software system configurations; changes. which could lead to vulnerabilities that when Request an application scan be exploited could lead to: performed by Michigan Cyber 8. Lack of System & Security (MCS) Information Integrity Unauthorized access to State’s information system Secure coding techniques are based on guidance such the OWASP Compromise of guide confidentiality and ( integrity of data Compliance with NIST 800-53; SI-9 Information Input & SI-10 Information Input Validation Improper guidance in the EASA (Enterprise Low Moderate Compliancy with DTMB Policy development, Architecture Solutions 1360.00 Systems Engineering enhancement, and Assessment) submitted Methodology maintenance of an and approved. application could lead to: Compliance with NIST 800-53; SA-3 Life Cycle Support & Unreliable, unpredictable, SA-8 Security Engineering 9. Lack of a consistent, and inconsistent IT Principles structured systems solution. engineering methodology More costs to the agency to implement and operate. Lack of clear and consistent documented solution, decisions, and recommendations. Weaknesses may develop Servers are scanned Low Moderate Agency request to DTMB Technical on servers in zone 2, only if a new firewall Services to scan servers on a which are not scanned on rule is requested and quarterly and resolve any a regular basis, and a vulnerabilities are vulnerabilities in a timely manner to malicious individual may remediated before reduce the likelihood of a exploit them which could firewall rule is vulnerability being exploited and result in: implemented. potential compromise of the system. 10. Lack of Identity Theft System is in compliance Compliance with NIST 800-53; vulnerability scan on with DTMB Technical CA-7 Continuous Monitoring & servers in SOM zone 2 Fraud Procedure RA-5 Vulnerability Scanning 1345.00.50.08, defines Financial Loss the detailed outline of the patching process for Compromise of updating the operating confidentiality and system (O/S), hot integrity of data and security updates for servers within the State Legal Ramifications of Michigan
8. Lack of System & Information Integrity Malicious programs and code could be injected by a malicious user and used to obtain back door access to the system or improper system configurations; which could lead to vulnerabilities that when exploited could lead to: Unauthorized access to State’s information system Compromise of confidentiality and integrity of data Moderate Moderate Perform periodic system testing to ensure that the system checks for accuracy, completeness, validity and authenticity to prevent malicious code or unauthorized software changes. Request an application scan be performed by Michigan Cyber Security (MCS) Secure coding techniques are based on guidance such the OWASP guide ( Compliance with NIST 800-53; SI-9 Information Input & SI-10 Information Input Validation 9. Lack of a consistent, structured systems engineering methodology Improper guidance in the development, enhancement, and maintenance of an application could lead to: Unreliable, unpredictable, and inconsistent IT solution. More costs to the agency to implement and operate. Lack of clear and consistent documented solution, decisions, and recommendations. EASA (Enterprise Architecture Solutions Assessment) submitted and approved. Low Moderate Compliancy with DTMB Policy 1360.00 Systems Engineering Methodology Compliance with NIST 800-53; SA-3 Life Cycle Support & SA-8 Security Engineering Principles 10. Lack of vulnerability scan on servers in SOM zone 2 Weaknesses may develop on servers in zone 2, which are not scanned on a regular basis, and a malicious individual may exploit them which could result in: Identity Theft Fraud Financial Loss Compromise of confidentiality and integrity of data Legal Ramifications Servers are scanned only if a new firewall rule is requested and vulnerabilities are remediated before firewall rule is implemented. System is in compliance with DTMB Technical Procedure 1345.00.50.08, defines the detailed outline of the patching process for updating the operating system (O/S), hot and security updates for servers within the State of Michigan Low Moderate Agency request to DTMB Technical Services to scan servers on a quarterly and resolve any vulnerabilities in a timely manner to reduce the likelihood of a vulnerability being exploited and potential compromise of the system. Compliance with NIST 800-53; CA-7 Continuous Monitoring & RA-5 Vulnerability Scanning