Impact Type Severity Lowest Highest None/negligible Minor Moderate High Very high Risk to individual safety None/negligible Any risk to personal safety Threatens life directly Distress caused to any party None/negligible Short term distress Limited long term distress Substantial long term distress Damage to any party’s standing or reputation None/negligible Minor local impact and/or limited short term damage Moderate embarrassment and/or short term damage Significant embarrassment, loss of public confidence and/or limited long term damage Severe embarrassment, loss of public confidence and/or substantial long term damage Inconvenience to any party None/negligible Minor inconvenience Moderate inconvenience Significant inconvenience Substantial inconvenience Public order None or negligible Measurable impact Prejudice Seriously prejudice Unauthorised disclosure of personally or commercially sensitive information No or negligible disclosure of sensitive information Minor impact Measurable impact, breach of regulations or commitment to confidentiality Significant impact to person, agency or business Substantial impact to person, agency or business Impact on Government finances or economic and commercial interests No or negligible impact Cause financial loss or loss of earning potential Work significantly against Substantial damage
Cause Deliberate The intrusion has been deliberate, because it has led to website defacement. Origin External The intrusion has occurred from outside the agency network. Severity type C. High: Significant embarrassment, loss of public confidence and/or limited long term damage. The network intrusion has caused damage to the agency’s reputation (as a result of the subsequent website defacement) D. Moderate: Moderate inconvenience The agency has been inconvenienced as a result of the efforts required to respond to the attack. J. High: Agency business operations impaired in any way The agency’s business operations have been impacted on following the intrusion of their network. N. Minor: Small areas within a single agency The incident affected a small number of areas within the agency. P. Moderate: Requires additional resources (e.g. overtime, engagement of third parties or purchase of tools) In the affected area had to work extra hours to resolve the incident. Severity High The highest severity rating is recorded Incident 2 – Website Defacement Category type Selection Rationale Definition Incident The agency website was defaced. Category Defacement of public information The website contained publicly accessible information, which was modified without authorisation. Compromises Integrity; Availability The integrity and availability of the website content was compromised, as it was altered and/or removed from
the website. Downtime to restore the website further compromised availability. Cause Deliberate The attack was deliberate – the website was defaced indicating malicious intent. Origin External The intrusion occurred from outside the agency network. Severity type B. Moderate: Short term distress Distress was caused to the public, since the web service was unavailable. In addition, the public were exposed to offensive material. C. High: Significant embarrassment, loss of public confidence and/or limited long term damage. The incident has caused damage to the agency’s reputation amongst the public. D. Moderate: Moderate inconvenience Service downtime causes inconvenience to both the agency and the public. J. High: Agency business operations impaired in any way. The agency business operations are disrupted while they restore the website. K. High: Significant interruptions or delays. Loss of completed transactions. The services provided on the agency website are adversely affected during the downtime. P. Moderate: Requires additional resources (eg. staff overtime, engagement of third parties or purchase of tools) Efforts to restore the website to full functionality can be done with relative ease. Some staff from the affected area were required to work overtime to resolve the issue, Severity High The highest severity rating is recorded Example 5