Spreadsheet: 81d09999-3736-4e6d-abaf-f7bfccbfb6f3
Sheet: Vulnerabilities

Vulnerabilities [of the tangible / intangible assets]
No | Vulnerability Description | Exposure  [[NAME] are 1-3]* | Severity  [Metric Values are 1-3]* | Vulnerability Assessment  Value* | Comments / Additional Info |  | LOOKUP
V1. | Flawed/insufficient design, implementation and/or capacity of devices and systems. Includes software bugs and design flaws. | 2 | 2 | 3
V2. | Inadequate policy framework | 1 | 2 | 2
V3. | Inadequate privacy/security interfaces (poor interface design) | 2 | 2 | 3
V4. | Increase in centralization of data storage and processing and over-reliance on these centralised facilities | 2 | 3
V5. | Inherent features of smart devices (size, material etc.): easy to lose or steal | 3 | 3 | 5
V6. | Lack of appropriate, common or harmonized legislation in EU Member States | 2 | 2 | 3
V7. | Lack of interoperability between devices/ services/ technologies and/or systems | 3 | 3 | 5
V8. | Lack of or inadequate user identification, authentication and access controls; e.g. use of new devices as authentication tools | 3 | 3 | 5
V9. | Lack of third party system reviews and software integrity certification | 2 | 2 | 3
V10. | Over reliance and excessive dependency on electronic devices and systems | 3 | 3 | 4
V11. | PC and home infrastructure vulnerabilities | 3 | 3 | 4
V12. | Smart phone vulnerabilities | 3 | 3 | 5
V13. | Lack of revocation/correction/deletion mechanisms | 3 | 2 | 3
V14. | Lack of (usable) privacy controls, e.g., overly permissive defaults, too coarse granularity, ... | 2 | 1 | 2
V15. | Lack of (usable) logging controls/policies/ reminders. E.g. capturing some embarrassing scene of someone else or yourself | 3 | 2 | 3
V16. | Lack of secure transmission and storage of data; also includes lack of (usable) transmission control (who gets the data) | 3 | 3 | 5
V17. | Lack of mechanisms to validate reputation or trustworthiness of service provider | 3 | 3 | 4
V18. | Lack of noticeable (and usable) notification systems | 2 | 2 | 2
V19. | Increased complexity of controls (making it difficult for users to follow) | 2 | 2 | 3
V20. | Increase of (unprotected) data storage capacity in smart-devices | 3 | 3 | 5
V21. | Reliance on legacy, un-patched systems or integration mistakes | 2 | 2
V22. | Lack of appropriate assurance procedures (e.g. third party audits) or enforcement of such, regarding the implementation of security controls, especially from the state, other regulatory and public authority | 3 | 2
V23. | Lack of transparency and “social translucency”, i.e., audit logs (who accessed my profile/data) | 3 | 3 | 4
V24. | Social reliance/over-confidence and trust on individual’s digital identity | 2 | 2
V25. | Inadequate user education, lack of awareness and training particularly in security and privacy; lack of context awareness | 3 | 3
V26. | Psychological vulnerability (low self esteem and confidence to self, high influence potential by others, naïve and suggestible, etc ; weak perception of self) | 2 | 4
V27. | Cognitive biases – Some people accept what they should not… | 2 | 3
V28. | Data linkability / lifelogging data can be aggregated with other data | 2 | 2