Part 2 - Risk Assessment for Dual ISP – Bypass Proxy Feature In understanding and assessing the level of risk that exists in relation to Department information assets, school management needs to consider the potential impact should any identified risks arise, as well as the likelihood of such an event. This will provide the basis for the overall assessment of the level of risk that is faced. The process and documentation outlined in this section is required under the SA Government’s mandated Information Security Management Framework (ISMF). Most risks introduced by bypassing features are common to all schools considering this approach. To aid schools in understanding these risks, this document outlines these common risks. It is important to acknowledge that every school environment is different, and it is the Principal’s responsibility to review these risks and consider their environment for any additional risks that may be present. In assessing the Consequence, Likelihood and Overall Risk rating, the site should follow the Risk Ratings within the matrix in Appendix A. RISK DESCRIPTION SUMMARY OF RISK MANAGEMENT PRACTICES (CONTROLS) ALREADY IMPLEMENTED CONSEQUENCE (1—5) LIKELIHOOD (1—5) OVERALL RISK RATING RISK TREATMENT Further actions required to monitor risk or improve controls, or comment on acceptance of risk. These actions will contribute to minimising identified risks Activity associated with client devices cannot be attributed to the exact individual user at the time of client asset use. The McAfee Web Gateway solution provides for the logging of IP addresses and the web activity. Reports can be produced that can attribute activity to an IP address. 3 5 H This risk is inherent to the bypass request. Technical controls the site could possibly implement that will assist in associating the activity to a device and/or user include; Retain DHCP logs (when combined with the available reporting) Register of Device/MAC Address and allocated user/owner (when combined with the available reporting) Force static based IP addresses on MAC address Implement an alternative form of authentication that integrates with the school network Access to inappropriate content by users when accessing the Internet on devices in bypass list. ICT Assurance release communications to assist site leaders to evaluate and review access rights and risk minimisation strategies that provide confidence that policy and procedures are understood and complied with to assure ongoing improvement in this area. 3 3 M School to ensure user acceptance policy is signed-off by student/parent/guardian. Client assets that are configured in the bypass list are generally used by students when under staff supervision. Staff will need to ensure that this is adhered to.
Appendix A: Risk Ratings Matrix Consequence 5 Critical Ongoing loss of critical infrastructure and systems M H H E E 4 Major Major disruption of business M M H H E 3 Moderate Moderate disruption of business L M M H H 2 Minor Minor disruption of business L L M M M 1 Insignificant Negligible impact on customer base. L L L M M 1 Rare Possibility of occurrence less than 5% 2 Unlikely Possibility of occurrence between 5% - 25% 3 Possible Possibility of occurrence between 25% - 50% 4 Likely Possibility of occurrence between 50% - 75% 5 Almost Certain Possibility of occurrence more than 75% KEY L = Low M = Moderate H = High E = Extreme Likelihood Low Moderate High Extreme