Scribd Logo
Upload

Welcome to Scribd!

  • 105 views

    Security Risk Assessment: Risk # Risk Risk Family

    Uploaded by

    CROST
    1. The security risk assessment identified 8 risks across various risk families related to encryption, user access controls, network security, and vulnerability management. 2. Many of the risks were rated as high likelihood and high impact, such as unencrypted databases, weak password policies, and lack of logical segmentation between application tiers. 3. Without proper mitigating controls, such as stronger encryption, multi-factor authentication, regular patching, and input validation, the organization faces security risks that could lead to data breaches or system compromises.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd

    Security Risk Assessment: Risk # Risk Risk Family

    Uploaded by

    CROST
    105 views7 pages
    1. The security risk assessment identified 8 risks across various risk families related to encryption, user access controls, network security, and vulnerability management. 2. Many of the risks were rated as high likelihood and high impact, such as unencrypted databases, weak password policies, and lack of logical segmentation between application tiers. 3. Without proper mitigating controls, such as stronger encryption, multi-factor authentication, regular patching, and input validation, the organization faces security risks that could lead to data breaches or system compromises.

    Original Description:

    Original Title

    riskassessment

    Copyright

    © © All Rights Reserved

    Available Formats

    XLSX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1. The security risk assessment identified 8 risks across various risk families related to encryption, user access controls, network security, and vulnerability management. 2. Many of the risks were rated as high likelihood and high impact, such as unencrypted databases, weak password policies, and lack of logical segmentation between application tiers. 3. Without proper mitigating controls, such as stronger encryption, multi-factor authentication, regular patching, and input validation, the organization faces security risks that could lead to data breaches or system compromises.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    105 views7 pages

    Security Risk Assessment: Risk # Risk Risk Family

    Uploaded by

    CROST
    1. The security risk assessment identified 8 risks across various risk families related to encryption, user access controls, network security, and vulnerability management. 2. Many of the risks were rated as high likelihood and high impact, such as unencrypted databases, weak password policies, and lack of logical segmentation between application tiers. 3. Without proper mitigating controls, such as stronger encryption, multi-factor authentication, regular patching, and input validation, the organization faces security risks that could lead to data breaches or system compromises.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    of 7

    Se

    Risk # Risk Risk Family

    1 AES-128 Encryption is weak Secure Code

    Unprotected sensitive data leads to identity


    2 theft, fraud, and theft of financial resources User Access
    from employees and customers

    Unprotected sensitive data leads to identity


    2b theft, fraud, and theft of financial resources User Access
    from employees and customers

    Vulnerability
    3 There is a risk of password guessing Management

    A non-expiring password allows attackers the


    Vulnerability
    4 greatest opportunity to maintain access Management
    indefinitely

    5 Remote login attempts will be easily executable Network Security

    Using TLS V1.1 will allow attackers to intercept


    6 and tamper data between websites and their Data at Rest
    users

    Using one system for hosting all 3 tiers


    7 introduces risk that if one tier is compromised, Network Security
    there are no additional protection layers
    available
    Using one system for hosting all 3 tiers
    introduces risk that if one tier is compromised,
    7b Network Security
    there are no additional protection layers
    available

    Unpatched servers are vunlurable to be Vulnerability


    8
    targeted by adversaries Management

    Not scanning for vulnerabilities will cause Cross- Vulnerability


    9 site scripting, SQL Injection, Command Injection
    attacks Management

    * Risk - descriptions should be some reasonable approximation of what is written above but does not need to be exact

    * Reasoning - The reasoning should approximately match to the user's assessment of the liklihood and impact of a potential

    * Mitigating Controls - For the purpose of this exercise we did not include mitigating controls

    * Total Risk Score - Should not be less than a reasonable approximation of the liklihood x impact. For instance, if L=High and
    Security Risk Assessment
    Control Liklihood Impact

    VPC3 File storage only supports AES-128 Encryption Medium Medium

    Databases in production are unencrypted High High

    Databases in production are unencrypted Medium High

    Internal network users require a 7-character


    password Medium High

    Passwords never expire Medium High

    VPN Access does not require MFA High High

    TLS V1.1 is used between the cloud production


    Low Medium
    environment and SwiftTech’s physical location

    Application development Tiers are not logically High High


    segmented from Business Application servers
    Application development Tiers are not logically
    High High
    segmented from Business Application servers

    Development Tier servers are unpatched and contain


    High High
    multiple vulnerabilities

    Application code is not scanned for vulnerabilities


    High High
    before being published into production environment

    Notes:

    n above but does not need to be exact

    nt of the liklihood and impact of a potential risk. If, for instance the liklihood and impact are marked high, the reasoning should reflect

    ting controls

    klihood x impact. For instance, if L=High and I=High (and no mitigating control exists) then Risk cannot equal Low
    Reasoning Mitigating Controls Total Risk Score

    AES-128 encryption is not secure, it must Placeholder High


    be AES-256 Assume none

    Not protecting the database will increase Placeholder


    High
    the likelihood to be hit by a ransomware Assume none

    Databases must not be reachable by Placeholder


    random sources. Assume none High

    Password must be at least 8-12 characters


    Placeholder
    long to harden the passwords and make it Assume none High
    hard for an adversary to crack

    An adversary can easily crack password


    Placeholder
    therefore strengthening the passwords is Assume none High
    a must.

    MFA must be used to reduce the rise in Placeholder High


    credential attacks Assume none

    TLS V1.1 is not secure therefore we must Placeholder


    Medium
    secure our cloud by using TLS V 1.2 Assume none

    Application tiers shall be segmented from Placeholder High


    business application servers. Assume none
    Application tiers shall be segmented from Placeholder
    High
    business application servers. Assume none

    Placeholder
    The servers must be up-to-date High
    Assume none

    The application code must be tested out


    and able to scan for vulnerabilities before Placeholder
    High
    publishing it into the production Assume none
    environment.

    arked high, the reasoning should reflect why it might be high

    cannot equal Low


    Data at Rest
    Data in Transit
    User Access
    Secure Code
    Network Security
    Vulnerability Management

    Low
    Medium
    High

    You might also like