## 5 Framework Application
### Risk and Threat Monitoring  
While following up on the existing risks and the planned treatments, new threat intelligence information emerges about a new risk origin exploiting a zero-day vulnerability for profit. The vulnerability exists in one of the public-facing applications. Thus, according to the framework, we re-contact workshops two to five:  
1. Threat Assessment/Risk Origins: The new risk origin (RO-05) is an organized crime group. RO-05 has a lucrative objective to deploy ransomware, hold data captive, and blackmail by re-selling organizations' data. RO-05 is assessed as highly motivated with significant resources.
2. Strategic Scenarios: The ecosystem stakeholders are still the same. However, they are separate since the threat intelligence information specifies that RO-05 relies on a direct attack path. Figure 7 presents the corresponding strategic scenario. The impact of this scenario is assessed as critical since the vulnerability has been proven to exist in the public-facing application.
3. Operational Scenarios: Operational threat intelligence about the risk origin reveals the following potential operational scenario; after actively scanning the public-facing systems, RO-05 can identify the used vulnerable application. RO-05 has to develop and customize an exploit and ransomware. After exploitation, a command and control server connection is established to enumerate the internal network and environment. After propagation and lateral movement through internal services, the ransomware is executed. It infects the majority of the internal systems and exfiltrates data through encrypted channels. Then, existing data are encrypted, and a ransom is demanded. Figure 8 presents the operational scenario of the newly identified risk origin. The likelihood of this attack path is assessed as nearly certain.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**ID** & **Treatment** & **Affected Risks** & **Priority** \\ \hline \multirow{2}{*}{TR-01} & Establish proper incident response, cyber crisis management, & \multirow{2}{*}{All} & High \\  & and business continuity procedures. & & \\ \hline \multirow{2}{*}{TR-02} & Perform regular penetration tests on a yearly basis. & All & Medium \\ \hline \multirow{2}{*}{TR-03} & Implement security information event management (SIEM) & \multirow{2}{*}{All} & Medium \\  & solution along with a security operations center (SOC). & & \\ \hline \multirow{2}{*}{TR-04} & Require stakeholders to raise cybersecurity & \multirow{2}{*}{R-03} & Medium \\  & awareness among employees. & & \\ \hline \multirow{2}{*}{TR-05} & Establish a change management policy. & \multirow{2}{*}{R-04} & Medium \\ \hline \multirow{2}{*}{TR-06} & Enhance the efficiency of vulnerability management & \multirow{2}{*}{R-01, R-02} & Low \\  & and patch management processes already in place. & & \\ \hline \multirow{2}{*}{TR-07} & Implement a privilege access management (PAM) & \multirow{2}{*}{R-01, R-04} & \multirow{2}{*}{Low} \\  & solution to better control user accesses. & & \\ \hline \hline \end{tabular}
\end{table}
Table 9: Treatment plan.  
Figure 7: Strategic scenario of the newly identified risk origin.  
Risk Treatment: The newly identified risk (R-05) is that an organized crime can sabotage Internet gateway services for lucrative purposes. To remediate this risk, the treatment plan is modified as follows:  
* New treatment TR-08 to implement new rules on the firewall to detect any abuse of the vulnerable services. Priority: high.
* Modify TR-03 priority from medium to high to ensure the detection of anomalies for zero-day vulnerabilities until patches are released.
* Modify TR-05 priority from medium to low since more demanding actions are required.