Revenge Unintentional errors and omissions (e.g., data entry error, programming error) Browsing of proprietary information Computer Fraud and theft Information bribery Input of falsified, corrupted data Interception Malicious code (e.g., virus, logic bomb, Trojan horse) of personal information System bugs System intrusion System sabotage Unauthorized system access An estimate of the motivation, resources, and capabilities that may be required to carry out a successful attack should be developed after the potential threat-sources have been identified, in order to determine the likelihood of a threat’s exercising a vulnerability. Output from Step 2 - A threat statement containing a list of threat-sources that could exploit system vulnerabilities. STEP 3: VULNERABILITY IDENTIFICATION The analysis of the threat to an information system must include an analysis of the vulnerabilities associated with the system environment. The goal of this step is to develop a list of system vulnerabilities (flaws or weaknesses) that could be exploited by the potential threat-sources. Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy. Table 2 presents examples of vulnerability/threat pairs. Table 1 - Vulnerability/Threat Pairs Vulnerability Threat-Source Threat Action Terminated employees’ system identifiers (ID) are not removed from the system Terminated employees Dialing into the company’s network and accessing company proprietary data Company firewall allows inbound telnet, and guest ID is enabled on XYZ server Unauthorized users (e.g., hackers, terminated employees, computer criminals, terrorists) Using telnet to XYZ server and browsing system files with the guest ID The vendor has identified in the security design of the system; however, new Unauthorized users (e.g., hackers, disgruntled employees, computer Obtaining unauthorized
control mechanisms, identification and authentication mechanisms, encryption methods, intrusion detection software). Nontechnical controls are management and operational controls, such as security policies; operational procedures; and personnel, physical, and environmental security. 4.2 Control Categories The control categories for both technical and nontechnical control methods can be further classified as either preventive or detective. These two subcategories are explained as follows: Preventive controls inhibit attempts to violate security policy and include such controls as access control enforcement, encryption, and authentication. Detective controls warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums. The implementation of such controls during the risk mitigation process is the direct result of the identification of deficiencies in current or planned controls during the risk assessment process (e.g., controls are not in place or controls are not properly implemented). 4.3 Control Analysis Technique As discussed in Section 3.3, development of a security requirements checklist or use of an available checklist will be helpful in analyzing controls in an efficient and systematic manner. The security requirements checklist can be used to validate security noncompliance as well as compliance. Therefore, it is essential to update such checklists to reflect changes in ITSD’s control environment (e.g., changes in security policies, methods, and requirements) to ensure the checklist’s validity. Output from Step 4 - List of current or planned controls used for the information system to mitigate the likelihood of a vulnerability being exercised and reduce the impact of such an adverse event. STEP 5: LIKELIHOOD DETERMINATION To derive an overall likelihood rating that indicates the probability that a potential vulnerability may be exercised within the construct of the associated threat environment; the following governing factors must be considered: Threat-source motivation and capability Nature of the vulnerability Existence and effectiveness of current controls The likelihood that a potential vulnerability could be exercised by a given threat-source can be described as high, medium, or low. Table 4 below describes these three likelihood levels. Table 4 - Likelihood Definitions Likelihood Level Likelihood Definition High The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective. Medium The threat-source is motivated and capable, but controls are in that may impede successful exercise of the vulnerability.