"PREVENTION, PREPAREDNESS AND CONSEQUENCE MANAGEMENT OF TERRORISM AND OTHER RISKS" HOME/2012/CIPS/AG Call identifier: CIPS/ISEC 2012 Project acronym: CYSM Project full title: Collaborative Cyber/Physical Security Management System Grant agreement no.: D2.2 Report on Stakeholder requirements Deliverable Id : D2.2 Deliverable Name : Report on stakeholder requirements Due date of deliverable : M5 Actual submission date : M5 Work Package : WP2 Organisation name of lead contractor for this deliverable: PPA Author(s): I. Papagiannopoulos, Koliousis Partner(s) contributing : PVF, SiLo, UPRC, DITEN Abstract A report (from the desk research and analysis of questionnaires) presents the main requirements of the CYSM Collaborative Approach to Maritime Security Management imposed by the national and international standardization efforts, methodologies, best practices as well as the existing legal and regulatory regime (described in D2.1). The report will also depict the fundamental aspects of the proposed security management system and services. Copyright by CYSM History Version Date Modification reason Modified by
• Illegal information disclosure • Monetary gain • Unauthorized data alteration • Fraudulent act (e.g. replay, impersonation, interception) • Information bribery • Spoofing • System intrusion Terrorist • Blackmail • Destruction • Exploitation • Revenge • Political Gain • Media Coverage • Bomb/Terrorism • Information warfare • System attack (e.g. distributed denial of service) • System penetration • System tampering Industrial espionage (Intelligence, companies, foreign governments, other government interests) • Competitive advantage • Economic espionage • Defence advantage • Political advantage • Economic exploitation • Information theft • Intrusion on personal privacy • Social engineering • System penetration • Unauthorized system access (access to classified, proprietary, and/or technology-related information) Insiders (poorly trained, • Curiosity • Ego • Assault on an employee • Blackmail
disgruntled, malicious, negligent, dishonest, or terminated employees) • Intelligence • Monetary gain • Revenge • Unintentional errors and omissions (e.g. data entry error, programming error) • Browsing of proprietary information • Computer abuse • and theft • Information bribery • Input of falsified, corrupted data • Interception • Malicious code (e.g. virus, logic bomb, Trojan horse) • Sale of personal information • System bugs • System intrusion • System sabotage • Unauthorized system access The following table gives examples for vulnerabilities in various security areas, including examples of threats that might exploit these vulnerabilities. The lists can provide help during the assessment of threats and vulnerabilities, to determine relevant incident scenarios. It is emphasized that in some cases other threats may exploit these vulnerabilities as well. Types Examples of vulnerabilities Examples of threats Hardware Insufficient maintenance/faulty installation of storage media Breach of information system maintainability Hardware Lack of periodic replacement schemes Destruction of equipment or media
Hardware Susceptibility to humidity, dust, soiling Dust, corrosion, freezing Hardware Sensitivity to electromagnetic radiation Electromagnetic radiation Hardware Lack of efficient configuration change controls in use Hardware Susceptibility to voltage variations Loss of power supply Hardware Susceptibility to temperature variations Meteorological phenomenon Hardware Unprotected storage Theft of media or documents Hardware Lack of care at disposal Theft of media or documents Hardware Uncontrolled copying Theft of media or documents Software No or insufficient software testing of rights Software Well-known flaws in the software Abuse of rights Software No 'logout' when leaving the workstation Abuse of rights Software Disposal or reuse of storage media without proper erasure Abuse of rights Software Lack of audit trail Abuse of rights Software Wrong allocation of access rights Abuse of rights Software Widely-distributed software Corruption of data Software Applying application programs to the wrong data in terms of time Corruption of data
Site organization Lack of defined disciplinary process in case of information security incident Theft of equipment Site organization Lack of formal policy on mobile computer usage Theft of equipment Site organization Lack of control of off-premise assets Theft of equipment Site organization Lack or insufficient 'clear desk and clear screen' policy Theft of media or documents Site organization Lack of information processing facilities authorization of media or documents Site organization Lack of established monitoring mechanisms for security breaches Theft of media or documents Site organization Lack of regular management reviews Unauthorized use of equipment Site organization Lack of procedures for reporting security weaknesses Unauthorized use of equipment Site organization Lack of procedures of provisions compliance with intellectual rights Use of counterfeit or copied software