Risk managent
ssai@1151
cybersecurity.docxChapter 6
1) If an organization has three information assets to evaluate for risk management purposes, as shown in the accompanying data, which vulnerability should be evaluated for additional controls first? Which vulnerability should be evaluated last?
· Switch L47 connects a network to the Internet. It has two vulnerabilities:
1. susceptibility to hardware failure, with a likelihood of 2, and
2. susceptibility to an SNMP buffer overflow attack, with a likelihood of 1.
There is a 75 percent certainty of the assumptions and data.
· Operators use the MGMT45 control console to monitor operations in the server room. It has no passwords and is susceptible to unlogged misuse by the operators. Estimates show the likelihood of misuse is 2. There are no controls in place on this asset, which has an impact rating of 4. There is a 90 percent certainty of the assumptions and data.
3) Using the list of threats to InfoSec presented in this chapter, identify and describe three instances of each that were not mentioned in the chapter.
5) Using the asset valuation method presented in this chapter, conduct a preliminary risk assessment on the information contained in your home. Answer each of the valuation questions listed in this chapter. What would it cost if you lost all your data?
Chapter 7
1) Using the following table, calculate the SLE, ARO, and ALE for each threat category listed.
XYZ Software Company (Asset value: $1,200,000 in projected revenues)
|
Threat Category |
Cost per Incident |
Frequency of Occurrence |
|
Programmer mistakes |
$5,000 |
1 per week |
|
Loss of intellectual property |
$75,000 |
1 per year |
|
Software piracy |
$500 |
1 per week |
|
Theft of information (hacker) |
$2,500 |
1 per quarter |
|
Theft of information (employee) |
$5,000 |
1 per 6 months |
|
Web defacement |
$500 |
1 per month |
|
Theft of equipment |
$5,000 |
1 per year |
|
Viruses, worms, Trojan horses |
$1,500 |
1 per week |
|
Denial-of-service attack |
$2,500 |
1 per quarter |
|
Earthquake |
$250,000 |
1 per 20 years |
|
Flood |
$250,000 |
1 per 10 years |
|
Fire |
$500,000 |
1 per 10 years |
3) How could we determine EF if there is no percentage given? Which method is easier for determining the SLE: a percentage of value lost or cost per incident?
4) Assume a year has passed and XYZ has improved its security. Using the following table, calculate the SLE, ARO, and ALE for each threat category listed.
XYZ Software Company (Asset value: $1,200,000 in projected revenues)
|
Threat Category |
Cost per Incident |
Frequency of Occurrence |
Cost of Controls |
Type of Control |
|
Programmer mistakes |
$5,000 |
1 per month |
$20,000 |
Training |
|
Loss of intellectual property |
$75,000 |
1 per 2 years |
$15,000 |
Firewall/IDS |
|
Software piracy |
$500 |
1 per month |
$30,000 |
Firewall/IDS |
|
Theft of information (hacker) |
$2,500 |
1 per 6 months |
$15,000 |
Firewall/IDS |
|
Theft of information (employee) |
$5,000 |
1 per year |
$15,000 |
Physical security |
|
Web defacement |
$500 |
1 per quarter |
$10,000 |
Firewall |
|
Theft of equipment |
$5,000 |
1 per 2 years |
$15,000 |
Physical security |
|
Viruses, worms, Trojan horses |
$1,500 |
1 per month |
$15,000 |
Antivirus |
|
Denial-of-service attack |
$2,500 |
1 per 6 months |
$10,000 |
Firewall |
|
Earthquake |
$250,000 |
1 per 20 years |
$5,000 |
Insurance/backups |
|
Flood |
$50,000 |
1 per 10 years |
$10,000 |
Insurance/backups |
|
Fire |
$100,000 |
1 per 10 years |
$10,000 |
Insurance/backups |
