Cloud computing Risk management
alisgh
threat_and_risk_assessment_v2.pdf
Threat and Risk Assessment Questionnaire 2 April 2015
Page 1 of 33
Completion date:
Reviewed date:
Responsible ICT division: <Operations or Business Services>
Service: <Enter service being assessed>
Security Classification: Unclassified
Confidentiality category: ICT-IN-CONFIDENCE
Threat and Risk Assessment Questionnaire
Threat and Risk Assessment Questionnaire 2 April 2015
Page 2 of 33
T HREA T AN D RI SK A SSE SS MEN T QUEST I ON N A IRE C OMPLE T ED B Y:
Section Completed by: Completed by: Date
1. Current Operational Status
2. Privacy Focus
3. Documentation Focus
4. Employee Focus
5. Application Focus
6. Data Focus
7. Identity Management Focus
8. Physical Focus
9. Server Focus
10. Network Focus
11. Cloud Services
12. Third Party Agreements
Threat and Risk Assessment Questionnaire 2 April 2015
Page 3 of 33
DOC UMEN T VERSI ON C ON T ROL
Version Date Author Summary of changes
1.0 <date> Author <changes>
Threat and Risk Assessment Questionnaire 2 April 2015
Page 4 of 33
T A B LE OF C ON T EN T S
THREAT AND RISK ASSESSMENT QUESTIONNAIRE COMPLETED BY: ................................................................. 2
DOCUMENT VERSION CONTROL ...................................................................................................................... 3
TABLE OF CONTENTS ........................................................................................................................................ 4
INTRODUCTION ............................................................................................................................................... 5
PURPOSE OF SYSTEM ....................................................................................................................................... 5
SCOPE .............................................................................................................................................................. 5
1. CURRENT OPERATIONAL STATUS ............................................................................................................. 5
2. PRIVACY FOCUS ........................................................................................................................................ 6
3. DOCUMENTATION FOCUS ................................................................... ERROR! BOOKMARK NOT DEFINED.
4. EMPLOYEE FOCUS .................................................................................................................................... 9
5. APPLICATION FOCUS .............................................................................................................................. 10
6. DATA FOCUS .......................................................................................................................................... 13
7. IDENTITY MANAGEMENT FOCUS ............................................................................................................ 16
8. PHYSICAL FOCUS .................................................................................................................................... 18
9. SERVER FOCUS ....................................................................................................................................... 21
10. NETWORK FOCUS ............................................................................................................................... 23
11. CLOUD SERVICES ................................................................................................................................ 26
12. THIRD PARTY AGREEMENTS ............................................................................................................... 28
ASSOCIATED DOCUMENTS ............................................................................................................................. 29
REFERENCES ................................................................................................................................................... 29
DOCUMENT REVIEW ...................................................................................................................................... 29
APPENDIX A ................................................................................................................................................... 30
RACI RESPONSIBILITY MATRIX ................................................................................................................................. 30
APPENDIX B ................................................................................................................................................... 31
SEMI QUANTITATIVE ANALYSIS .................................................................................................................................. 31
Threat and Risk Assessment Questionnaire 2 April 2015
Page 5 of 33
I N T RODUC TI ON
This Threat and Risk Assessment Questionnaire, which is agnostic to the technology being utilised, is designed to assist in categorising and assessing the risks to services they provide to business.
Each section should be completed by the person (or delegate) who is responsible for that part of the system. NOTE: ONLY complete sections of this document which are relevant to the system being assessed.
Each section contains a list of best practice security standards that should be considered during design, development and implementation of the system, and may pose a risk if they have not been considered. For each of these, a description of the current controls in place and their effectiveness should be added, along with the likelihood and the consequence if the risk is not addressed. Refer to Appendix B for an explanation of how to evaluate the Likelihood and Consequence.
PURPOSE OF SYST EM
<Describe the service that is being assessed>
SC OPE
<Describe the scope of the threat and risk assessment including any limitations>
1 . C URREN T OPERAT I ON AL ST A T US
Please select the current operational status of the service being assessed?
Operational (currently in production)
In-Development (being designed, developed, or deployed)
Transition (currently undergoing a major upgrade or transition)
Threat and Risk Assessment Questionnaire 2 April 2015
Page 6 of 33
2 . PRI VA C Y FOC US
Answering Yes to any of the following questions may suggest that consultation with a privacy officer is required or with the NSW Privacy Commissioner who can provide advice on the Privacy and Personal Information Protection Act 1998.
Please answer the following questions about privacy regarding the service being assessed. (Source: Identifying Privacy Issues – IPC NSW)
Qualification (Note: Personal Information = Personally Identifiable Information and Health Information)
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
)
Details Controls to be used
2.1 Does the system involve the collection of personal information, compulsorily or otherwise?
2.2 Does the system envisage a new use for personal information that is already held?
2.3 Will the system change or create any system of regular disclosure of personal information, whether to another part of State or local government, or to the private sector, or to the public at large?
2.4 Will the system restrict access by individuals to their own personal information?
2.5 Will the system establish or amend a public register?
2.6 Does the system change or create any confidentiality provisions or secrecy provisions relating to personal information?
2.7 Are any new or amended offences proposed relating to the misuse of personal information?
2.8 Are any new or amended requirements proposed to store, secure or retain personal information?
2.9 Will the system create an identification
Threat and Risk Assessment Questionnaire 2 April 2015
Page 7 of 33
system, e.g. using a name, a number, or a biometric signature like a fingerscan? Will it require existing ID, such as a driver’s licence?
2.10 Does the system link or match personal information across or within agencies?
2.11 Does the system involve exchange or transfer of personal information outside NSW, whether with another government or otherwise?
2.12 Does the system relate to handling personal information for research or statistics, de- identified or otherwise?
2.13 Does the system contain any other measures that may affect privacy?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 8 of 33
3 . DOC UMEN T A T I ON FOCUS
Please answer the following questions about existing documentation for the service being assessed.
Governance
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
R A
TI N
G
3.1 Are there documented procedures for the system and are they current?
3.2 Is there a system diagram and is it current?
3.3 Is the ICT change management process followed for all changes to the system?
3.4 Is there DR documentation for this system, is it reviewed and tested regularly?
3.5 Is there BCP documentation for this system, is it reviewed and tested regularly?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 9 of 33
4 . EMPLOYEE FOC US
Please answer the following questions about staff resourcing and funding of the service being assessed.
Awareness and Training
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
)
Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
4.1 Have staff completed Information Security Awareness training?
4.2 Are staff members aware of security policy and guideline changes?
4.3 Are staff aware of incident reporting procedures?
4.4 Are there adequate staff to implement/support the system? (i.e. more than one)
4.5 Are staff adequately skilled?
4.6 Is applicable training available and funded for staff?
4.7 Is there sufficient funding to run the system according to business requirements?
4.8 Are staff resources sufficient to manage the system? (Technology, books, journals, etc)
4.9 Are key stakeholders identified and recorded?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 10 of 33
5 . A PPLI C A TI ON FOC US
Please answer the following application questions about the service being assessed.
A. Application Development
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
5.1 Is the ICT System Development Life Cycle (SDLC) followed for this system?
5.2 Do you perform a security code review during each phase of the systems development?
5.3 Are all software developers working on the system given orientation/made aware of the security requirements of the system before commencing work?
B. Application in Production
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
5.4 Are only authorised users able to access and make modifications to production software, configuration files, scripts, databases, etc.?
5.5 Are the interactions by authorised users on the server, to production software, configuration files, scripts, databases, etc. are logged and stored?
5.6 All application database users have the least privilege required to
Threat and Risk Assessment Questionnaire 2 April 2015
Page 11 of 33
perform their application and/or job functions?
5.7 All logs containing restricted/confidential data are stored in a secure and centralized location?
5.8 Stored passwords are encrypted by MD5 or a similar mechanism and salted?
5.9 If a web application processes credit card payments, does it use SSL and does it handle/store card holder data according to PCI-DSS?
5.10 If a web application stores, processes, or transmits restricted data, an application firewall is in place to protect the restricted data?
5.11 Stored SQL data containing restricted or confidential information is not directly manipulated?
5.12 All input fields are validated to mitigate the risk of SQL injection (for web-based and non web- based applications)?
5.13 URL based SQL injections have been addressed and mitigated?
5.14 Load testing has been performed to identify any security bugs related to threading and session
Threat and Risk Assessment Questionnaire 2 April 2015
Page 12 of 33
management?
5.15 Is web application authentication of users conducted over HTTPS and do not proxy, store or retransmit authentication information?
5.16 Once a user has been authenticated on the system, the level of security is not degraded beyond this baseline?
5.17 All authenticated mechanisms and sessions are encrypted?
5.18 All authentication interfaces do not mimic or might reasonably confuse others with official authentication interfaces?
5.19 Development, test and production are separate environments available for the system?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 13 of 33
6 . DA T A FOC US
Please answer the following database and file system questions about the service being assessed.
A. Data Classification
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
6.1 Does all critical business data have an identified owner?
6.2 Data is classified according to the NSW Classifications and Labelling Guidelines?
6.3 Is access to sensitive customer data authorised by the data owner?
6.4 All data files and locations that may contain confidential or restricted data are documented?
B. Database
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
6.5 Is access to database software restricted to privileged users based on a business requirement?
6.6 Is database access regularly reviewed?
6.7 Is confidential and restricted data encrypted in the table columns of the database?
6.8 Restricted data fields are not used as a database key and is consolidated
Threat and Risk Assessment Questionnaire 2 April 2015
Page 14 of 33
into one table?
6.9 All database backup dumps and exports with restricted data are encrypted and have restricted access?
6.10 The test environment is restricted and data is de- identified?
6.11 Database passwords are routinely changed and meet the criteria for strong security standards?
6.12 Database vulnerability assessment scan has been run?
6.13 Database software is patched regularly?
C. Backup
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
6.14 Are backups of business critical data performed regularly?
6.15 Is there an automated way to verify all backups completed?
6.16 Do you periodically restore from backup tapes to ensure integrity?
6.17 Are backup tapes stored in an environmentally controlled and secure area?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 15 of 33
6.18 Are backup tapes stored off-site and how is access protected?
6.19 Is a regular audit conducted to account for all backup tapes?
6.20 If backup tapes are ever destroyed is there a procedure?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 16 of 33
7 . I DEN T IT Y MA N AG EMENT FOC US
Please answer the following questions about authentication for the service being assessed
A. Account Management
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
7.1 Is each customer account owned or sponsored by the customer?
7.2 Is concurrent access prohibited?
7.3 Are accounts locked out after a number of failed attempts?
7.4 Are accounts disabled after a period of inactivity?
7.7 Are accounts periodically reconciled to existing users?
7.8 Are privileged accounts set up for emergency access and logged and subject to regular reviews?
7.9 Do you have a list of accounts with root or admin privileges?
7.10 Are default system accounts disabled? (e.g. Windows default remote assistant accounts, Oracle’s default DBA account)
Threat and Risk Assessment Questionnaire 2 April 2015
Page 17 of 33
B. Password Management
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
7.5 Are users forced to change their password at first login and do passwords expire periodically?
7.6 Are users prevented from re-using passwords?
7.7 All passwords contain 8 characters or more and contain characters from at least two of the following: Alphabetic (a-z, A-Z), Numeric (0-9), Punctuation and other characters?
7.8 Passwords are not sent “in clear text” (unencrypted) and are transmitted securely?
7.9 All systems passwords have been changed from their default?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 18 of 33
8 . PHYSI C A L FOC US
Please answer the following questions about infrastructure regarding the service being assessed.
A. Data Centre Security
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
8.1 A primarily responsible person and their backup has been identified?
8.2 Access to restricted areas is based on a business need and is periodically reviewed?
8.3 Alarms are working, monitored externally, maintained and tested regularly?
8.4 Surveillance equipment is working, backed up, maintained and tested regularly?
8.5 Adequate power supplies are in place and maintained?
8.6 UPS are in place, maintained and tested regularly?
8.7 Adequate aircon is in place, maintained and tested regularly?
8.8 Backup generator is in place, maintained and tested regularly?
8.9 Fire suppression systems are in place, maintained and tested regularly?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 19 of 33
8.10 Environment is regularly cleaned?
8.11 Appropriate work aids (WHS) are provided and in good condition?
8.12 Work Health Safety is reviewed regularly?
8.13 Hardware with confidential or restricted data is physically segmented from non- secure systems?
8.14 Data cables and power cables are separated?
B. Asset Inventory
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls CO
N SE
Q U
EN CE
S
LI KE
LI H
O O
D
Ra ti
ng
8.15 Are their documented processes for removing equipment?
8.16 Is there an inventory kept of physical devices and is it regularly reviewed?
8.17 Are there methods for the secure disposal of unwanted equipment and documents?
8.18 Is there a process to ensure software inventory is maintained and is accurate and current?
8.19 Is there an authorised list maintained of software that can be installed?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 20 of 33
8.20 Is license information kept and reviewed?
8.21 Devices are configured to lock and require a user to re-authenticate if left unattended?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 21 of 33
9 . SERVER FOC U S
Please answer the following questions about the operating system being used by the service being assessed.
Vulnerability and Hardening
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
9.1 Is there a process to obtain the latest security patches and updates?
9.2 Is there a process to identify vulnerabilities?
9.3 Are automated tools used to assess system vulnerabilities?
9.4 Is a pen test conducted against systems to identify vulnerabilities?
9.5 Do you have a security checklist for each operating system deployed?
9.6 Do you perform reviews of your security checklist?
9.7 Are the security checklists updated regularly?
9.8 Are root or admin account privileges regulated on systems and is this documented?
9.9 Are applications regulated from running as root or admin privilege?
9.10 Are login banners on systems?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 22 of 33
9.11 Is anti-virus installed on all operating systems?
9.12 Are the virus definitions automatically updated?
9.13 Are all email and ftp transmissions checked for malware?
9.14 Is access to directories that contain confidential or restricted data, restricted?
9.15 Is security auditing enabled on business critical systems?
9.16 Logging of access to confidential or restricted information is being performed and securely stored?
9.17 Failed logins are logged with IP address and timestamp (archived and backed up) and repeated failures are locked out?
9.18 Are logs reviewed in a timely and consistent manner, with identified events reviewed?
9.19 Is automatic alerting configured for defined thresholds?
9.20 Is an active SMTP service provided that allows unauthorised parties to relay e-mail messages?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 23 of 33
1 0 . N ET WORK FOC US
Please answer the following network questions about the service being assessed
A. Router/Firewall/Switch /Proxy
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
10.1 Is there a current network diagram and is it maintained?
10.2 Have stateful firewalls been deployed at all external connections?
10.3 Is the firewall configured with a policy that all services are denied unless expressly permitted?
10.4 Is the risk of opening protocols and ports assessed before implementing any changes on the firewall?
10.5 Is outgoing traffic directed to external proxy servers and are they in the DMZ?
10.6 Are all services forbidden except when specifically requested?
10.7 Is logging enabled?
10.8 Are logs reviewed regularly and in a consistent manner with identified events reviewed?
10.9 Are network devices hardened and backed up?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 24 of 33
10.10 Is access restricted to those with a business need?
10.11 For remote administration are administrators securely authenticated, if so how?
10.12 Are network devices regularly patched?
10.13 Is the business critical network configured with switches so that sniffer software is ineffective?
B. VPN
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
10.14 Is a personal firewall implemented for computers which use a VPN?
10.15 Is VPN access only granted to computers running antivirus software and a personal firewall?
10.16 IS VPN access cancelled as soon as the business requirement is no longer needed?
C. Intrusion Detection
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
10.17 Is the placement of the IDS reviewed to ensure appropriate coverage?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 25 of 33
10.18 Is there automated alerting configured?
10.19 Is the NIPS monitoring interconnections (internet, web-hosting platforms, third party connections)?
D. Cryptography Ye
s /
N o
/ N
A
(N ot
A pp
lic ab
le ) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
10.20 Is there a register of all SSL certificates and their expiry date?
10.21 Do SSL certificates match domains?
10.22 Is SSL/HTTPS enforced for all web applications accessing confidential and restricted data?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 26 of 33
1 1 . C LOUD SERVI C ES
Please answer the following questions if the service being assessed is hosted outside of the organisation and is managed by a service provider.
Access/Change/BCP/Service
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
11.1 Access Control: Is the solution Security Assertion Markup Language 2.0 (SAML 2.0) compliant for authenticating users?
11.2 Change Control: Authorisation – what degree of granularity does the system offer in defining roles?
11.3 Change Control: Isolation – what security standards are followed in the operation of the service?
11.4 Change Control: Isolation – is compliance with internal security standards assessed by a compliance audit at least annually?
11.5 Change Control: Isolation – what external application vulnerability scans / assessments / audits are done and how often?
11.6 Change Control: Isolation – does data transit non – Australian networks, if so where?
11.7 Change Control: Isolation – is data stored outside of
Threat and Risk Assessment Questionnaire 2 April 2015
Page 27 of 33
Australia, if so where?
11.8 Business Continuity: what level of availability does the service offer?
11.9 Business Continuity: what provisions are in place to exit the service?
11.10 Business Continuity: what provisions are in place to protect intellectual property?
11.11 Business Continuity: what provisions are in place for decryption key escrow, for encrypted solutions?
11.12 Access, Change and Fault Reporting: what activity and resource usage reports are provided?
11.13 Service Details: does the solution follow web standards? e.g. OWASP
11.14 Service Details: if handling credit card details, is the solution PCI-DSS compliant?
11.15 Service Details: what other auditable IT standards are followed and how often are audits performed?
11.16 Service Details: are the results of audits and certifications made available to customers?
Threat and Risk Assessment Questionnaire 2 April 2015
Page 28 of 33
1 2 . T HI RD PA RT Y A G REEMEN T S
Please answer the following questions about professional services supplied to the organisation for the service being assessed.
Contractors
Ye s
/ N
o /
N A
(N
ot A
pp lic
ab le
) Proposed Controls
CO N
SE Q
U EN
CE S
LI KE
LI H
O O
D
Ra ti
ng
12.1 Have the appropriate HR checks been completed and a non-disclosure agreement signed?
12.2 Do the (proposed) team members have IT security certifications? e.g. CISSP, TOGAF
12.3 Have the (proposed) team members worked on projects of similar size, nature and complexity in the past?
12.4 Do the (proposed) team members have vendor or technology specific certifications?
12.5 Are security standards such as OWASP or TOGAF followed in development of solutions?
12.6 What coding methodology, review practices are followed in the development of solutions?
12.7 Has the developer anticipated the need to perform a Privacy Impact Assessment (PIA) and Threat and Risk Assessment (TRA) and
Threat and Risk Assessment Questionnaire 2 April 2015
Page 29 of 33
budgeted time to do so?
12.8 If so, how much time has been reserved?
12.9 How has the PIA and TRA been integrated into the development process?
A SSOC I A T ED DOC UME N T S
This Threat and Risk Assessment draws on information from the following locations:
ICT Service Catalogue
<resources>
REFEREN C ES
Information and Privacy Commission, New South Wales, Identifying Privacy Issues - Checklist
University of California, Los Angeles (UCLA), Information Security Office, Server Security Checklist
University of Toronto Information Risk and Risk Management Assessment Questionnaire For Information Services, 09 April 2014
Manzoor, K. Vendor Security Risk Assessment Report, University of Illinois
DOC UMEN T R EVI EW
This document shall be reviewed annually, or as required to reflect changing requirements.
Threat and Risk Assessment Questionnaire 2 April 2015
Page 30 of 33
A PPEN DI X A
RACI RESP ON SIBIL ITY M ATRIX
Project Step Tasks Director,
ICT Info Sec
Team
Technical Services
Team
Communications Team
Customer Services Team
Development Services
Other specialist
units Startup
1. Identification of requirements
2. Document scope 3. Resources 4. Audience
Initiate
5. Review of existing document
6. Risk assessment
Plan
7. Areas to address 8. Control selection 9. Risk treatment plan 10. Consultation 11. Draft document
Execute & Monitor
12. Approval and sign-off
Close/Review 13. Measurement program entry
14. Communication to stakeholders
15. Initiating flow-on reviews
R = Responsible A = Accountable C = Consulted I = Informed
Threat and Risk Assessment Questionnaire 2 April 2015
Page 31 of 33
A PPEN DI X B
SEM I QUANTIT ATIVE A NAL YSI S
EFFECTIVENESS OF CURRENT CONTROLS Unsatisfactory No recovery plan; Change is across multiple systems / sites; Change to a critical system that is a dependency for key business system(s); Evidence is present
that controls are non-existent or completely ineffective and urgent improvements are required; No contingencies are identified and activity disruption is likely;
Inconsistent Change cannot be verified until under normal load; Change requires support from multiple sources (suppliers etc.); Pilot/Go live of a new application; Controls are largely ineffective and there is likelihood that controls will be breached; Few contingencies are in place and significant activity disruptions are expected;
Effective Recovery plan untested; Previous change(s) have had issues; Change is to a non critical system; Change tested successfully but test environment does not replicate live environment; Most controls are functioning, but areas for improvement are identified; There is some likelihood that controls may be breached; There is recent evidence that a small number of controls have been breached; Contingencies are in place for a few key areas to manage potential activity disruptions;
Highly Effective Change replicates normal user behavior; History of successful implementation; Successful implementation of pilot and subsequent phases; Controls are effective but small improvements could be made; There is a low likelihood that controls may be breached; There are no recent examples of control breaches; Control effectiveness is assessed regularly; Contingencies are in place for key business areas to manage potential activity disruptions;
Exceptional Recovery plan is known and tested; Non-complex change; Change tested successfully in test environment that fully replicates live environment; Controls are effective and stable; There is an extremely low probability of controls being breached; There are no previous incidents of control breaches; Control effectiveness is assessed frequently (more than once per year); Comprehensive contingencies are in place to manage most potential activity;
Threat and Risk Assessment Questionnaire 2 April 2015
Page 32 of 33
CONSEQUENCES Catastrophic Characteristics: Total loss of Data Centre; total loss of operations > 48 hours; total loss of strategic data sets and backups;
Causes: Building fire, natural disaster (earthquake) affecting the city and surrounding area and/or building, pathogen, bomb, etc. Recovery Time: Potentially very long (e.g. total loss of building), significant staff losses including key IT disaster recovery personnel.
Extreme (Outage likely to exceed 3 days)
Characteristics: Total data centre failure (retain business areas), Retain data centre but business areas lost; data availability lost > 24 hours; Causes: Data centre fire, multiple supply systems failure (power combined with UPS), Building fire that partially destroys the building, pathogen. Recovery Time: Long depending on cause, some staff losses that could include key IT disaster recovery personnel.
Major (Outage likely to exceed 24 hours)
Characteristics: Partial data centre failure; major data storage failure >24 hours; major communications loss >24 hours; Causes: Multiple critical systems fail at the same time possible due to power loss or fire/flood in the data centre. Recovery Time: Medium-long depending on the equipment impacted, staff losses unlikely.
Minor (Outage will not exceed 24 hours)
Characteristics: The failure impacts business units and or floors but the majority of staff can continue to operate. Causes: Failure of one or more major applications, network failure impacting one or more floors. Recovery Time: Short-medium, DR unlikely to be initiated.
Isolated (Outage will not exceed 4 hours)
Characteristics: Impact the delivery of one major business application. Causes: Server floor, database failure, application level failure. Recovery Time: Short – normally handled within normal IT support timeframes.
LIKELIHOOD Almost certain Is expected to occur in most circumstances. Could occur within ‘days to weeks’. Likely Will probably occur in most circumstances. Could occur within ‘weeks to months’. Possible Might occur at some time. Could occur ‘within a year or so’. Unlikely Could occur at some time. Could occur ‘after several years’. Rare May occur only in exceptional circumstances. A ‘100 year event’ or greater.
Threat and Risk Assessment Questionnaire 2 April 2015
Page 33 of 33
RISK RATI NG
Likelihood rating Consequence rating
Isolated Minor Major Extreme Catastrophic
Almost certain Moderate Moderate High High High
Likely Moderate Moderate Moderate High High
Possible Low Moderate Moderate Moderate High
Unlikely Low Low Moderate Moderate Moderate
Rare Low Low Low Moderate Moderate
- threat and Risk assessment questionnaire completed by:
- Document version control
- Table of contents
- Introduction
- Purpose of system
- Scope
- 1. current operational status
- 2. privacy focus
- 3. documentation focus
- 4. employee focus
- 5. application focus
- 6. data focus
- 7. identity management focus
- 8. physical focus
- 9. server focus
- 10. network focus
- 11. cloud services
- 12. third party agreements
- Associated documents
- references
- Document review
- Appendix A
- RACI Responsibility Matrix
- Appendix b
- semi quantitative analysis
- Risk Rating
