# A Perfect Match: Converging and Automating Privacy and Security Impact Assessment On-the-Fly
## 4 APSIA Conceptual Architecture and Building Blocks
### Privacy Impact Scoring System
#### 4.3.2 Privacy Impact
Given the above, the proposed scoring system takes into consideration the type of the vulnerability in order to convey this information to the final score, which will be used by the decision maker in the privacy risk mitigation actions. \begin{tabular}{l l l} \(\bullet\) & Denial of Service & \(\bullet\) & XSS \\ \(\bullet\) & Bypass Something & \(\bullet\) & Directory Traversal \\ \(\bullet\) & Execute Code & \(\bullet\) & File Inclusion \\ \(\bullet\) & Gain Information & \(\bullet\) & Memory Corruption \\ \(\bullet\) & Overflow & \(\bullet\) & CSRF \\ \(\bullet\) & Gain Privilege & \(\bullet\) & Http Response Splitting \\ \(\bullet\) & SQL Injection & \\ \end{tabular}   
**Sensitivity of ICT asset:** In order to define the level of impact in a more reliable way,the privacy sensitivity of an asset is considered. More specifically, as the infrastructure assets are engaged in the data processing activities of an organisation, undoubtedly some may have a more crucial role in the data processing contrary to others that simply support the activity. For example, a central database which is used to store the Personal or Sensitive information of a hospital's patients, is of greater importance -in terms of privacy- than an ICT network component. To materialise this, we use a 4-tier scale to categorise the assets into the Low, Medium, High, Very High tiers. Given the above, the scoring system takes into consideration the importance of the assets in order to convey this information to the final score, which will be used by the decision maker in the privacy risk mitigation actions. The definition of the level of impact factor is the product of the two above-mentioned notions namely, the type of the vulnerability and the sensitivity of the assets, following the mapping illustrated in Table 3. It must be stated that the mapping has been generated based on the domain knowledge of cybersecurity experts and penetration testers of our corporate environment, who have the necessary experience to perceive how a specific type of a vulnerability can affect privacy-sensitive assets. Although the proposed mapping conveys the domain knowledge of experts, it cannot be considered foolproof, as security experts of different expertise and different organisations may have a different point of view on the mapping. The exact definition of the map is part of the configuration steps of the tool and depend also on the cybersecurity posture and risk appetite of the assessor. \begin{table}
\begin{tabular}{c l l} \hline
**Level of Impact** & **Description** & **Value** \\ \hline None & Individual will not encounter inconveniences or consequences & 0.0 \\ Low & Individuals may encounter a few minor inconveniences, which they will overcome without any problem (time spent re-entering information, annoyances, irritations, etc.). & 1.0 \\ Medium & Individuals may encounter significant inconveniences, which they will be able to overcome despite a few difficulties (extra costs, denial of access to business services, fear, lack of understanding, stress, minor physical ailments, etc.). & 2.5 \\ High & Individuals may encounter significant consequences, which they should be able to overcome albeit with serious difficulties (misappropriation of funds, blacklisting by financial institutions, property damage, loss of employment, subpoena, worsening of health, etc.). & 4.5 \\ Very High & Individuals which may encounter significant, or even irreversible consequences, which they may not overcome (inability to work, long-term psychological or physical ailments, death, etc.). & 7.0 \\ \hline \end{tabular}
\end{table} 
Table 2: Impact categories on the fundamental rights and freedoms of the individuals, resulting from the possible loss of security of the personal data according to ENISA (European Union Agency for Cybersecurity). B. Scope of impact  
The scope of impact is used to reflect the number of data processing activities affected by an instance of exploiting the vulnerability.