jjjj

Case Exercise 1: Writing a security policy for an asset

We did the exercise by brainstorming about the most critical aspects of maintaining a secure database, and these ideas came to our minds.

Our chosen asset is a database containing product cost data information. In our example, the database has never been breached before and therefore it is an object-based approach. The asset is also a mix between an information asset and a software asset.


When writing the policy, we must consider at least the following issues regarding the database and its contents:

Identifying the asset:

The following aspects should be taken into account when creating a security policy for a database.

- Available budget: How much resources we can appoint to securing this critical asset.

- Location: In the server room, located in the IT department.

- Characteristic properties: Contains vital information for the continuation of the business. Information is in digital-form.

- Sensitivity: Critical, confidential (the business depends on the database being available for proper use)

- Availability: Can only be used or modified by authorized employees.

- Impact to profitability: High (contains product cost data)

Identifying the threats (Using threat taxonomy)

- Natural threats: Low (Major natural incidents are very rare in Finland)

 -Man-made threats

- Accidental: Medium (Human Error, Software Fault, Hardware Fault)

The largest risk is the human error when handling the database, because software and hardware are usually more reliable than people.

- Intentional: Medium (Hacker, Insider)

There is always a risk with some employees leaking data outside for personal gain or a chance of getting hacked.

Identifying Vulnerabilities:

Possible vulnerabilities in our system could be:

An out of date operating system or software versions on the server.(Impact: High Likelihood: Low)

An out of date software versions on other linked devices such as routers etc.(Impact: High Likelihood:Very high)

An E-mail attack targeting our Database users.(Impact:Low to High Likelihood: Very high)

Authors: Tomi Lindfors & Juuso Myllylä

Case Exercise 3:  Choose an asset, and using the worksheet for assessing impact and impact levels of a threat, explain your choice of impact levels for each of the 4 impacts.
The worksheet can be found on slide 44 of the Security Risk Management slides, and page 82 of Raggad, 2010.

Asset: Database containing customer credit card information

Impact 1: Unauthorized Disclosure of information

Level of impact: Very High

A leaking of our database information would have a high business impact, since our customers credit card information could potentially spread around.
This would likely make our both current and new customers less likely to trust us in security matters and also in our products. Could possibly even lead to bankruptcy.

Impact 2: Unauthorized Modification of Data

Level of impact Low to High

Varies greatly of the modified data, but any modifications made by unauthorized users results in loss of integrity. This could result in confused employees and customers, since some clients could be charged with payments they did not make etc.

Impact 3: Disruptions of Functions/Services

Level of impact: Low to Medium

This could possibly be caused by an DDOS attack, which could take our severs down and make our systems unable to process transactions. If the attack lasts longer than a couple of hours, it might result in higher loss of profits.

Impact 4: Deceptive Actions

Level of impact: None

We couldn't  come up with any deceptive actions against a database.

Authors: Tomi Lindfors & Juuso Myllylä