need help with this

Vulnerability

Threat

Probability

Impact

Suggested Mitigation Steps

Activity Monitoring

Security scans and Intrusion deception systems

3 (High)

3(High)

(6) Firewall and Security System monitoring will be up-to-date and logs will be looked at once a week unless others needed

Patch levels

Unnecessary exposure to known attack vectors

3 (High)

3 (High)

(6) Use of vulnerability scanning tools to monitor unpatched systems. A policy that includes the governance, standards and schedule of patching. Employment of best practice patch methods and procedures.

Insiders (poorly trained, disgruntled, malicious, negligent, dishonest, or terminated employees)

Potentially allowing attackers to cause excessive heating, furnace failures or frozen water pipes by manipulating thermostat functionality.

3 (High)

3 (High)

(6) Ensure company security policy is in effect immediately following a terminated employee.

Poor implementation of file export capability in business enterprise software.

Asset leakage which can happen through brute force attacks and even guesswork.

3 (High)

3 (High)

(6) Enterprise Resource Planning (ERP).

Use of session cookies to maintain state over HTTP browsers.

The cookies could be reverse engineered and leading to attackers identifying loopholes in the logic.

2 (Med)

3(High)

(5) Store no sensitive or secure data in cookies or other headers, insure you have an expirations time

OS command execution in function modules.

An attacker could have the ability to execute OS commands even without authorization.

2 (Med)

3 (High)

(5) CALL 'SYSTEM'/ SAP authorizations

Door locks and padlocks from vendors like Quicklock, iBlulock, Plantraco, Ceomate, were found to be vulnerable to password sniffing and replay attacks.

A captured command can be replayed later to open the locks. Giving access to Highly Secured Areas. - Loosing Critical Information and Data within Organizational systems.

2 (Med)

3 (High)

(5) Ensure latest door lock and padlock software, along with all drivers are updated.

Susceptibility to dust, heat and humidity

- Hardware failure

2 (Med)

3 (High)

(5) Prepare and initiate proper preventive maintenance techniques on equipment. Properly weatherproof all locations with IT equipment.

Data centers in geographical locations prone to natural disasters

- Full-scale service outage

2 (Med)

3 (High)

(5) Evaluate and implement measures that support Disaster Recovery (DR) capabilities in geographical locations not prone to natural disasters.

The use of tokens in conducting authenticated application

Profile extractions using these tokens

2 (Med)

3 (High)

(5) Enterprise IT Policy/Standard Statement

Unsecured administrative interfaces

Open attack or abuse broadsides to mission critical systems

2 (Med)

3 (High)

(5) Properly secure administrative interfaces, assign IP access lists and install SSL certificates.

User Account Management

Restrictions on Folders,

Directories - Read or Modified

2 (Med)

3(High)

(5) Only people that need access to certain groups will have access to files for RW modification

Insiders (poorly trained, disgruntled, malicious, negligent, dishonest, or terminated employees

Potentially allowing attackers to cause excessive heating, furnace failures or frozen water pipes by manipulating thermostat functionality.

2 (Med)

3(High)

(5) Training of employees will be 6-12 months with employees that are 1-5 years’ new hires will be trained for 6 months and then again at end of year.

Firewalls

Access from an IP that is not blocked on network

1(Low)

3 (High)

(4) Firewalls will have the latest Firmware and will be Pen tested regularly

Inadequate continuity planning

Extended outages and business loss

1 (Low)

3 (High)

(4) Develop a concise Business Continuity Plan (BCP) that covers all business processes.

Access Control w/ Auditing

Un-authorization to a controlled area

2 (Med)

2 (Med)

(4) Badge employees only match with PIN access.

Violation and Security Activity Reports .

Manipulation of logs

2 (Med)

2 (Med)

(4) Logs will be checked and backed up in different locations and more than one person will have access to them

Physical access to critical equipment (Data Center)

Damage or unauthorized access to enterprise assets

1(Low)

3 (High)

(4) Properly secured physical data center access points. The use of NFC key cards, access lists and controlled access hours.

Default credentials on network devices

Unauthorized of unintended access to network devices

1 (Low)

3 (High)

(4) Policy and procedure regrading password policy on network devices as well as policy or procedure for the installation that addresses changing the default password.

Rogue access points

Unmonitored insecure network access

1 (Low)

3 (High)

(4) Port security and MAC filtering prevent rogue devices from obtaining DHCP addresses of going outside of the port they are attached to.

Rogue access points

Unmonitored insecure network access

1 (Low)

3 (High)

(4) Port security and MAC filtering prevent rogue devices from obtaining DHCP addresses of going outside of the port they are attached to.

Wheelchair Technology

A wheelchair from an unknown vendor had a vulnerability that could be exploited to disable a safety feature and take control of the device. Using technology in highly populated areas, and hacking medical devices etc.

1 (Low)

3 (High)

(4) Configure security settings on wheelchair technology to prevent access.

Social engineering attacks.

Employees are a weak link that can be exploited. They could click on infected links and download infected files. They could infect computer systems or even create backdoors that could be used later to access the company networks

3 (High)

1 (Low)

(4) Install anti-virus software, firewalls, email filters and keep these up-to-date. Set your operating system to automatically update, and if your smartphone doesn’t automatically update, manually update it whenever you receive a notice to do so. Use an anti-phishing tool offered by your web browser or third party to alert you to risks.

Inadequate video surveillance (internal)

- Internal threats; stolen secrets or product; physical activities not reviewable

1 (Low)

2 (Med)

(3) Implement surveillance cameras in all locations holding products or sensitive equipment.

Inadequate video surveillance (external)

- External threats; competitor surveillance; staff safety; physical activities not reviewable

1 (Low)

1 (Low)

(2) Implement surveillance cameras covering entrance and exit points, as well as early/late staff parking.

Compromise of user credentials due to inadequate user training.

Damage to the CIA triad

2 (Med)

1 (Low)

(3) Proper role based access and adequate user training will prevent or significantly limit the impact of this threat.

Overlooking non-traditional IP devices I.E. building controls, POS, medical equipment

Unsecured unmonitored devices on the network

1 (Low)

1 (Low)

(2) Ensuring that non-essential building controls or equipment resides on its own physical and logical network.

Thermostat Vulnerability

A thermostat from Trane used a weak plain text protocol.

- Potentially allowing attackers to cause excessive heating, furnace failures or frozen water pipes by manipulating thermostat functionality.

1 (Low)

2 (Med)

(3) Secure capabilities of thermostat functionality via plain text protocol.

Running head: RANKING THE PAIRS

1

RANKING THE PAIRS

4