Organizational Risk Analysis
- Information Asset Categories and Threat Communities
Information Asset Categories Threat Communities
Customer Information Privileged insiders
Payment information Non-privileged insiders
Password and encryption keys Visitors
Equipment Cleaners - Description of Information Asset Categories
Information asset category Loss scenario Asset Threat community Threat type Effect Likelihood Example of the loss event
Customer information Hacking predisposes information to extortion Customer’s address and contact details Privileged insiders Privileged and non-privileged insider Privacy liability involving the mismanagement of both personal and corporate private information.
Incident response expenses including forensic investigations, legal consultation, and management fees.
Cyber extortion costs. High The network of the organization was hacked leading to exposure of vital client information to risk. Some aspects of the information that were at risk include patent technology, and prospectus.
Payment information Unauthorized access Account information including email addresses, financial account statements, and national ID numbers Hackers,
Privileged insiders, and non-privileged insiders. Cybercriminals and hackers Irregularities and disparities in financial account statements thus leading to accounting and reconciliation problems. High Some cybercriminals illegally accessed the payment information of clients of the organization and distorted the information thus leading to inconsistencies and loss of vita information.
Password and encryption keys Denial of service attacks The organization’s website Hackers and privilege insiders Hackers and cybercriminals Inability to login to the organization’s computer and information systems. Medium Hackers and cybercriminals tampered with the organization’s password thus making it difficult for login to be done normally.
Equipment Mistakes and vulnerabilities in design, poor testing, and malware attacks Software and hardware Hackers, privileged insiders, and non-privileged insiders Privileged and non-privileged insider Frequent dysfunction leading to loss and exposure of vital organizational information. Medium The technology company that was hired to install software and hardware in the organization did the work poorly thus leading to security threats. - 2 Most Important Loss Scenarios
Among the loss scenarios listed above, hacking is the most important. Hacking can be done by anyone regardless of their location and relationship with the organization. In other words, a hacker need not be a member of the organization to gain access to the company’s information systems. However, what makes hacking even more important is the fact that most hackers usually gain easier access by the help of both privileged and non-privileged insiders. These insiders provide the hackers with passwords and other encryption details thus speeding up the hacking process. Hacking may compromise with the confidentiality of both client and corporate information thus placing the organization at risk. It is therefore important for appropriate preventive mechanisms to be installed to prevent the occurrence of hacking.
Apart from hacking, denial of service attacks is another important loss scenarios. Denial of service attacks basically refers to the tendency of employees or other personnel denying the likelihood of a threat occurring when it is occurring. Such denial is usually promoted by the lack of adequate expertise and knowledge to detect the occurrence of system attacks. Denial of service attacks can predispose the organization to huge losses because the attacks can persist for a very long time before they are noticed and remedied. Other liabilities that may cause by such denial include the exposure to network traffic leading to failure in the network of the organization. Therefore, the organization should implement appropriate measures to ensure there is adequate protection against denial-of-service attacks.