impact on the organization? or regulatory Restriction of consequences from the license or loss of disclosure, modification, licenses report with report with report with non-availability and/or Central Bank, major observations minor destruction of the Ministry of observations and penalty / observations information asset Business & Trade and fine of less resulting in regulatory / and other amount (e.g. government heavy penalty regulatory less than QAR warning / / fine imposed Legal bodies) 5M) notice (e.g. greater than QAR 5M) Vulnerability Factor Rating Vulnerability Factors / Very High (4) High (3) Medium (2) Low (1) Rating - How Detailed General Can be done Can be done Ease of discovery easy is it for this group of knowledge about knowledge with without any threat agents to discover the information about the knowledge knowledge this vulnerability? asset is required information about the about the e.g. professional asset is information information experience sufficient e.g. asset e.g. asset training procedure / manual Ease of exploit - How easy Special Generally without any Automated tools is it for this group of threat equipment and available additional available or no agents to actually exploit expertise equipment can equipment specific skill this vulnerability? required be used and used or basic required special skill required required Awareness - How well Unknown zero Known only to Known only to public – known is this vulnerability day information information knowledge to this group of threat security experts security experts agents? and users Threat Likelihood (TL) Rating Threat Likelihood Rating Consideration Frequency The capability of the threat is limited, and compensating controls are in Very Unlikely (VU) 1 Once a year or null that effectively reduces the probability of vulnerability exploitation Between 1 and 10 times The capability of the threat is medium, Unlikely (U) 2 per year and implemented compensating
impact on the organization? Legal / regulatory or regulatory consequences from the disclosure, modification, non-availability and/or destruction of the information asset Restriction of license or loss of licenses Central Bank, Ministry of Business & Trade and other regulatory bodies) report with major observations and heavy penalty / fine imposed (e.g. greater than QAR 5M) report with observations and penalty / fine of less amount (e.g. less than QAR 5M) report with minor observations resulting in government warning / notice Vulnerability Factor Rating Vulnerability Factors / Rating Very High (4) High (3) Medium (2) Low (1) Ease of discovery - How easy is it for this group of threat agents to discover this vulnerability? Detailed knowledge about the information asset is required e.g. professional experience General knowledge about the information asset is sufficient e.g. training Can be done with knowledge about the information asset e.g. procedure / manual Can be done without any knowledge about the information asset Ease of exploit - How easy is it for this group of threat agents to actually exploit this vulnerability? Special equipment and expertise required Generally available equipment can be used and special required without any additional equipment used or basic skill required Automated tools available or no specific skill required Awareness - How well known is this vulnerability to this group of threat agents? Unknown – zero day Known only to information security experts Known only to information security experts and users public knowledge Threat Likelihood (TL) Rating Threat Likelihood Rating Consideration Frequency Very Unlikely (VU) 1 The capability of the threat is limited, and compensating controls are in that effectively reduces the probability of vulnerability exploitation Once a year or null Unlikely (U) 2 The capability of the threat is medium, and implemented compensating Between 1 and 10 times per year
cs-information_security_risk_management_framework-appendix_eng_v1.2.docx