The table below represents the aggregate risk identified from the assessment. High risks are <number>% of total risks for the system. Moderate risks are<number>% of total risks for the system. Low risks are <number>% of total risks for the system. There <are/ are not> risks identified that are required for continued operation of the system. Risk Category Total % of Total Risks High XX% Moderate XX% Low XX% Operationally Required XX% Total Risks 100% Table ES-1 – Executive Summary of Risks Template Revision History Date Page(s) Description Author 12/03/2015 Template creation ESRMO
ID Threat Name Type Identifier Description Typical Impact to Data or System Confidentiality Integrity Availability Alteration U, P, E Alteration of data, files, or records. Modification Audit Compromise P An unauthorized user gains access to the audit trail and could cause audit records to be deleted or modified, or prevents future audit records from being recorded, thus masking a security relevant event. Modification or Destruction Unavailable Accurate Records Bomb P An intentional explosion. Modification or Destruction Denial of Service Communications Failure U, E Cut of fiber optic lines, trees falling on telephone lines. Denial of Service Compromising Emanations P Eavesdropping can occur via electronic media directed against large scale electronic facilities that do not process classified National Security Information. Disclosure Cyber Brute Force P Unauthorized user could gain access to the information systems by random or systematic guessing of passwords, possibly supported by password cracking utilities. Disclosure Modification or Destruction Denial of Service Data Disclosure Attack P An attacker uses techniques that could result in the disclosure of sensitive information by exploiting weaknesses in the design or configuration. Disclosure Data Entry Error U Human inattention, lack of knowledge, and failure to system activities could contribute to errors becoming integrated and ingrained in automated systems. Modification Denial of Service Attack P An adversary uses techniques to attack a single target rendering it unable to respond and could cause denial of service for users of the targeted information systems. Denial of Service Distributed Denial of Service Attack P An adversary uses multiple compromised information systems to attack a single target and could cause denial of service for users of the targeted information systems. Denial of Service Earthquake E Seismic activity can damage the information system or its facility. Refer to the following document for earthquake probability maps . Destruction Denial of Service
Electromagnetic Interference E, P Disruption of electronic and wire transmissions could be caused by high frequency (HF), very high frequency (VHF), and frequency (UHF) communications devices (jamming) or sun spots. Denial of Service Espionage P The illegal covert act of copying, reproducing, recording, photographing or intercepting to obtain sensitive information. Disclosure Modification Fire E, P Fire can be caused by arson, electrical problems, lightning, chemical agents, or other unrelated proximity fires. Destruction Denial of Service Floods E Water damage caused by flood hazards can be caused by proximity to local flood plains. Flood maps and base flood elevation must be considered. Destruction Denial of Service Fraud P Intentional deception regarding data or information about an information system could compromise the confidentiality, integrity, or availability of an information system. Disclosure Modification or Destruction Denial of Service Hardware or Equipment Failure E Hardware or equipment may fail due to a variety of reasons. Denial of Service Hardware Tampering P An unauthorized modification to hardware that alters the proper functioning of equipment in a manner that degrades the security functionality the asset provides. Modification Denial of Service Hurricane E A category 1, 2, 3, 4, or 5 land falling hurricane could impact the facilities that house the information systems. Destruction Denial of Service Malicious Software P Software that damages a system such a virus, Trojan, or worm. Modification or Destruction Denial of Service
Phishing Attack P Adversary attempts to acquire sensitive information such as usernames, passwords, or SSNs, by pretending to be communications from a legitimate/trustworthy source. Typical attacks occur via email, instant messaging, or comparable means; commonly directing users to Web sites that appear to be legitimate sites, while actually stealing the entered information. Disclosure Modification or Destruction Denial of Service Power Interruptions E Power interruptions may be due to any number of reasons such as electrical grid failures, generator failures, uninterruptable power supply failures (e.g. spike, surge, brownout, or blackout). Denial of Service Procedural Error U An error in procedures could result in unintended consequences. Disclosure Modification or Destruction Denial of Service Procedural Violations P Violations of standard procedures. Disclosure Modification or Destruction Denial of Service Resource Exhaustion U An errant (buggy) process may create a situation that exhausts critical resources preventing access to services. Denial of Service Sabotage P Underhand interference with work. Modification or Destruction Denial of Service Scavenging P Searching through disposal containers (e.g. dumpsters) to acquire unauthorized data. Disclosure Severe Weather E Naturally occurring forces of nature could disrupt the operation of an information system by freezing, sleet, hail, heat, lightning, thunderstorms, tornados, or snowfall. Destruction Denial of Service Social Engineering P An attacker manipulates people into performing actions or divulging confidential information, as well as possible access to computer systems or facilities. Disclosure Software Tampering P Unauthorized modification of software (e.g. files, programs, database records) that alters the proper operational functions. Modification or Destruction
& ID # IP Address Tool/Scanner Severity Level Finding False Positive Explanation 1-FP-OT 2-FP-OT 3-FP-OT 4-FP-OT Table F-5 – Other Automated & Misc. Tool Results: False Positive Reports IP Address Hostname Software & Version Function Comment Table F-6 – Unauthenticated Scans ID # IP Address Scanner Severity Level Finding False Positive Explanation 1-FP-US 2-FP-US 3-FP-US 4-FP-US Table F-7 – Infrastructure Scans: False Positive Reports