## 8 Security and Privacy Risk Assessment
### Security and Privacy Risk Assessment at the Requirements Analysis Phase
#### 8.3.1 Risk Analysis
##### 8.3.1.1 Identify and Document the Assets  
Assets of a WBAN application include sensor devices, information collected by the sensor devices, and server instances which are used to process and store the data. If the application interfaces with any external services such as third-party libraries or third-party application services, these also need to be taken into consideration. The assets will be documented in the security and privacy risk assessment report, along with the date that the assets were identified, and the name of the persons with their role as presented in Table  
Using Table A1 in Appendix A, select the threats related to the assets identified in the previous section.
* As the threat landscape is changing rapidly, it is recommended to check for newly discovered threats at the time of threat identification. To gather information about newly discovered threats, the assessor team can use various sources such as research articles, blog posts, OWASP ([[https://owasp.org/www-community/attacks/](https://owasp.org/www-community/attacks/)]([https://owasp.org/www-community/attacks/](https://owasp.org/www-community/attacks/)) access on 30 July 2021), governmental agencies such as US-CERT ([[https://www.us-cert.gov/resources/cybersecurity-framework](https://www.us-cert.gov/resources/cybersecurity-framework)]([https://www.us-cert.gov/resources/cybersecurity-framework](https://www.us-cert.gov/resources/cybersecurity-framework)) access on 30 July 2021), ENISA ([[https://etl.enisa.europa.eu/](https://etl.enisa.europa.eu/)]([https://etl.enisa.europa.eu/](https://etl.enisa.europa.eu/)) access on 30 July 2021), NIST ([[https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf)]([https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf)) access on 30 July 2021), BSI ([[https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi-standard-2003_en_pdf.pdf?_blob=publicationFile&v=2](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi-standard-2003_en_pdf.pdf?_blob=publicationFile&v=2)]([https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi-standard-2003_en_pdf.pdf?_blob=publicationFile&v=2](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi-standard-2003_en_pdf.pdf?_blob=publicationFile&v=2)) access on 30 July 2021) and private organizations such as HITRUST ([[https://hitrustalliance.net/threat-catalogue/](https://hitrustalliance.net/threat-catalogue/)]([https://hitrustalliance.net/threat-catalogue/](https://hitrustalliance.net/threat-catalogue/)) access on 30 July 2021). Each newly discovered threat needs to be analyzed by studying the threat description, threat agents, possible attack scenarios and checking whether the same attack scenario can occur within the WBAN application. If a threat is applicable to WBAN applications, then the assessor team needs to identify the assets which will be affected if the threat occurs.
* Document the following in the security and privacy risk assessment report:
* List of threats and respective affected assets.
* Date when the threat identification was conducted.
* The name and role of the person who conducted the threat identification.