ID Threat Name Type Description Typical Impact to Data or System Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification Audit Compromise P An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. Modification or Destruction Unavailable Accurate Records Bomb P An intentional explosion. Modification or Destruction Denial of Service Failure U, E Cut of fiber optic lines, trees falling on telephone lines. Denial of Service Compromising Emanations P Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. Disclosure Cyber Brute Force P Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. Disclosure Modification or Destruction Denial of Service Data Disclosure Attack P An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in the design or configuration. Disclosure Data Entry Error U Human inattention, lack of knowledge, and failure to cross-check system activities could contribute to errors becoming integrated and ingrained in automated systems. Modification Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service
Malicious Software P Software that damages a system such a virus, Trojan, or worm. Modification or Destruction Denial of Service Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service Power Interruptions E Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g. spike, surge, brownout, or blackout). Denial of Service Procedural Error U An error in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service Sabotage P Underhand interference with work. Modification or Destruction Denial of Service Scavenging P Searching through disposal containers (e.g. dumpsters) to acquire unauthorized data. Disclosure
Login URL IP Address of Login Host Function Comments Table E-1 – Inventory of Web Applications Scanned The following raw scan results files are included: <List files here include Title, Filename (including extension)> ID # Scanner Severity Level Page & IP Address Finding False Positive Explanation 1-FP-WS 2-FP-WS 3-FP-WS 4-FP-WS Table E-2 – Web Application Scans: False Positive Reports
Total <#> <#> Table F-2 – Final Summary of System Security Risks Table F-3, Open POA&Ms, shows the number of POA&Ms with Ongoing status as of <date>. The third column shows POA&Ms identified as closed in the <date> POA&M that not had been validated by the AO or by <3PAO>. The Duplicate Open POA&M Entries column shows POA&M items where the same vulnerability, typically from scanning was open under different vulnerability IDs and can be consolidated. Adding the POA&Ms with ongoing status column to the POA&Ms closed but not validated and subtracting the duplicate open POA&Msresults in the numbers in the Open POA&Ms column (as of <date>. Severity POA&Ms with Ongoing Status as of <date> POA&Ms Closed (as of <date>) but not Validated by AO or 3PAO Duplicate Open POA&M Entries Open POA&Ms (as of <date>) High Moderate Low Total Table F-3 – Open POA&Ms Table F-4, Summary of Existing POA&Ms, shows the number of Open POA&Ms as of <date> from Table F-3. Some of these POA&Ms can be closed as a result of testing performed by <3PAO> during this annual assessment The number of open POA&Ms minus the number of POA&Ms closed through testing results in the total number of remaining POA&Ms that need to be carried