Thus, disgruntled insiders might have both the motive and the means to steal the information. First, the important infrastructure components were identified through an examination of the layout of the physical and IT infrastructures. Because sensitive financial information was an important information asset, the server that contained the database with that information was identified as a high-priority component. A vulnerability evaluation for the server was performed. The server is accessed remotely.
Authentication is required when a user accesses the server.
As soon as a password is known, the insider can access the sensitive information and use it for personal gain or make it public. The likelihood of such an attack was judged to be moderate to high. The impact would be high in terms of damage to the company s reputation. This was judged to be a big risk to the enterprise. The senior managers understood the nature of this risk.