Threat Impact on data integrity, confidentiality, and availability of information associated with finding, fixing, repairing, and restoring a system Impact on productivity Financial losses Other issues affecting operations and reputation Data: copied without permission 1 1 This would cost, just not for the reasons listed in the column header. 3 This could impact management’s productivity as it copes with the potential problems that arise from someone getting our data. 4 The copying of data, itself, is not the problem. The problem is what is then done with that data, and correcting it. There would be significant costs both in staff time and financial resources in correcting problems. 5 If our data were copied by an unauthorized party, they could use that data for any number of purposes that would damage our operations and cause us to spend significant resources correcting the problem. Of particular concern: the reputation hit that our credit union would take. Data: disclosed to people who have no right to know it 5 By definition, if the data were disclosed to unauthorized persons, it is no longer confidential. 1 This would cost, but not for the reasons listed above 3 This could impact management’s productivity as it copes with the potential problems that arise from 4 The copying of data, itself, is not the problem. The problem is what is then done with that data, and correcting it. 5 If our data were copied by an unauthorized party, they could use that data for any number of purposes that
someone getting our data. There would be significant costs both in staff time and financial resources in correcting problems. would damage our operations and cause us to spend significant resources correcting the problem. Of particular concern: the reputation hit that our credit union would take. Data: deleted 5 If our data were deleted, it not be accessible. We would need to restore it. If the backup were also deleted, this could be crippling, and perhaps destroy the credit union. Imagine: all of our members’ history, balances, 3 Under normal circumstances, with a backup working properly, costs should be minimal to restore data. Until it is restored, however, our operations would be interrupted, which would mean lost opportunities, and potential increases in staff 5 Significant hits in productivity across the credit union. Some activities would grind to a complete halt. Depending on the type of data deletion, some activities might continue relatively unharmed. But if it is member data, impact is very high. 3 With a backup working properly, financial losses will mostly take the shape of lost opportunities and staff time. 5 depending on the data deleted, some areas will be drastically affected, while others not so much. Some operations could continue in a manual mode, but others would be completely shut down. Either way, our reputation would take big hits.
time to manually do some things. Data: corrupted en 5 This is the epitome of data not having integrity. At this point, we cannot rely on any of the data, and will need to restore a backup. 4 normal circumstances, with a backup working properly, costs should be minimal to restore data. Until it is restored, however, our operations would be interrupted, which would mean lost opportunities, and potential increases in staff time to manually do some things. 5 Significant hits in productivity across the credit union. Some activities would grind to a complete halt. Depending on the type of data corruption, some activities might continue relatively unharmed. But if it is member data, impact is very high. 3 With a backup working properly, financial losses will mostly take the shape of lost opportunities and staff time. 5 Again, depending on the data corrupted, some areas will be drastically affected, while others not so much. Some operations could continue in a manual mode, but others would be completely shut down. Either way, our reputation would take big hits, especially if information about the threat went public. Data: held hostage 5 Data being held has many potential problems. Suddenly its integrity, confidentiality, 4 Under normal circumstances, with a backup working properly, costs should be minimal to restore 5 Significant hits in productivity across the credit union. Some activities would grind to a 5 Financial loss be very high if we pay a ransom for our data, and especially if we pay and then lose 5 depending on the data held hostage, some areas will be drastically affected, while
not. Non-normal activity is halted and reported immediately. Access monitoring Monitors all folders and logs all activity into folders, and notifies administrators of unusual activity Honeypot Functions as a relatively target for hackers to hit, but serves no business purpose. This is the trap to catch hackers. What corrective controls are in place? Corrective controls facilitate the termination of harmful actions, and reduce damage. Control Control description How effectiveness of control is measured Effectiveness level (high, moderate, low) Fail safe policies Requires that if resources fail, they fail to a safe and protected mode Workstation images/restoration An image is made of each workstation once it is properly configured, so that if something goes wrong with the workstation, it can easily be restored to a clean state. Backups Backups of all critical data for restoration of key data.