Revenge Browsing of Unintentional errors and proprietary omissions (e.g., data entry information error, programming error) Computer Fraud and theft Information bribery Input of falsified, corrupted data Interception Malicious code (e.g., virus, logic bomb, Trojan horse) of personal information System bugs System intrusion System sabotage Unauthorized system access An estimate of the motivation, resources, and capabilities that may be required to carry out a successful attack should be developed after the potential threat-sources have been identified, in order to determine the likelihood of a threat’s exercising a vulnerability. Output from Step 2 - A threat statement containing a list of threat-sources that could exploit system vulnerabilities. STEP 3: VULNERABILITY IDENTIFICATION The analysis of the threat to an information system must include an analysis of the vulnerabilities associated with the system environment. The goal of this step is to develop a list of system vulnerabilities (flaws or weaknesses) that could be exploited by the potential threat-sources. Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy. Table 2 presents examples of vulnerability/threat pairs. Table 1 - Vulnerability/Threat Pairs Vulnerability Threat-Source Threat Action Terminated employees’ Terminated employees Dialing into the system identifiers (ID) are not company’s removed from the system network and accessing company proprietary data Company firewall allows Unauthorized users (e.g., Using telnet to XYZ inbound telnet, and guest ID hackers, terminated server is enabled on XYZ server employees, computer and browsing system criminals, terrorists) files with the guest ID The vendor has identified Unauthorized users (e.g., Obtaining in the security design of the hackers, disgruntled unauthorized system; however, new employees, computer
Revenge Unintentional errors and omissions (e.g., data entry error, programming error) Browsing of proprietary information Computer Fraud and theft Information bribery Input of falsified, corrupted data Interception Malicious code (e.g., virus, logic bomb, Trojan horse) of personal information System bugs System intrusion System sabotage Unauthorized system access An estimate of the motivation, resources, and capabilities that may be required to carry out a successful attack should be developed after the potential threat-sources have been identified, in order to determine the likelihood of a threat’s exercising a vulnerability. Output from Step 2 - A threat statement containing a list of threat-sources that could exploit system vulnerabilities. STEP 3: VULNERABILITY IDENTIFICATION The analysis of the threat to an information system must include an analysis of the vulnerabilities associated with the system environment. The goal of this step is to develop a list of system vulnerabilities (flaws or weaknesses) that could be exploited by the potential threat-sources. Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy. Table 2 presents examples of vulnerability/threat pairs. Table 1 - Vulnerability/Threat Pairs Vulnerability Threat-Source Threat Action Terminated employees’ system identifiers (ID) are not removed from the system Terminated employees Dialing into the company’s network and accessing company proprietary data Company firewall allows inbound telnet, and guest ID is enabled on XYZ server Unauthorized users (e.g., hackers, terminated employees, computer criminals, terrorists) Using telnet to XYZ server and browsing system files with the guest ID The vendor has identified in the security design of the system; however, new Unauthorized users (e.g., hackers, disgruntled employees, computer Obtaining unauthorized
Risk-Assessment-for-Information-Systems-Process-2010-Mar-10.docx