ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
No.Information Assets affectedThreats/Threat Vector(s)Risk #Threat vectorThreatRisk AppititeVulnerabilityIntentional or AccidentalUntreated Threat ConsequenceUntreated Risk rating (VH/H/M/L)ControlsSOA-Clause
2
Time Cost $ Political(H/M/L)
3
Internal
External
CIA1h1d1w 1h 1d 1w
4
1Customers dataClient data lost103YY/MediumInsufficient backupI2-$51.37$1,232.88$8,630.14LMInformation backupOperations security
5
Client data stolen104YY//Stored in unsesure placeI/A-2-MMSecuring offices, rooms and facilitiesPhysical and environmental security
6
Client data exposed105Y/Not securely protectedI -1-HMManagement of technical vulnerabilitiesOperations security
7
Client data modified106Y//Execisive priviledgesI/A-1 LMManagement of privileged access rightsAccess control
8
2Partners dataPartner data exposed201YY /MediumNot securely protectedI-1-$27.40$657.53$4,602.74MMManagement of technical vulnerabilitiesOperations security
9
Partner data modified202Y//Execisive priviledgesI-2-LMManagement of privileged access rightsAccess control
10
Partner data lost203Y/Insufficient backupA -3-LMInformation backupOperations security
11
Partner data stolen204Y/Stored in unsesure placeA--1LLSecuring offices, rooms and facilitiesPhysical and environmental security
12
3BookEat webpageWebsite attacks301
Y///MediumNot securely protectedI1--$18.26$438.36$3,068.49HHManagement of technical vulnerabilities
System acquisition, development & maintenance
13
Website malfunction302YY/Poor development practicesA1--HHAccess Control policyAccess Control
14
Website unauthorized access
303YY/Improper access rightsI-1-MMRemoval or adjustment of access rightsAccess Control
15
4Governance, Support ContractsContractual data exposed401YY//MediumNot securely protectedI/A--1$4.57$109.59$767.12MLManagement of technical vulnerabilitiesOperations security
16
Contractual data modified
402YY/Execisive priviledgesI--1LLManagement of privileged access rightsAccess control
17
Contractual data stolen403Y/Stored in unsesure placeI--1LLSecuring offices, rooms and facilitiesPhysical and environmental security
18
Contractual data lost 404YY///Insufficient backupI/A--1LLInformation backupOperations security
19
5LicenseOrganizational asset lost501Y/MediumInsufficient checkingA--1$3.42$82.19$575.34LL
Identification of applicable legislation and contractual requirements
Compliance
20
6Financial ReportsFinancial data exposed601YY/MediumNot securely protectedI-1-$18.26$438.36$3,068.49LMManagement of technical vulnerabilitiesOperations security
21
Financial data lost602Y/Insufficient backupI/A--1MLInformation backupOperations security
22
Financial data stolen603YY//Stored in unsesure placeI -3-MMSecuring offices, rooms and facilitiesPhysical and environmental security
23
Financial data modified604YY/Execisive priviledgesI -1-HMManagement of privileged access rightsAccess Control
24
7Payment RecordsPayment data lost701Y/MediumInsufficient backupI/A--1$5.48$131.51$920.55HLInformation backupOperations security
25
payment data stolen702YY//Stored in unsesure placeI --1HLSecuring offices, rooms and facilitiesPhysical and environmental security
26
payment data exposed703YY/Not securely protectedI--1HLManagement of technical vulnerabilitiesOperations security
27
Payment data modified704YY/Execisive priviledgesI --1HLManagement of privileged access rightsAccess Control
28
8Operating policiesOperation data lost801Y/LowInsufficient backupI/A--1$2.74$65.75$460.27LLInformation backupOperations security
29
Operation data stolen802YY//Stored in unsesure placeI --1LLSecuring offices, rooms and facilitiesPhysical and environmental security
30
Operation data exposed803YY/Not securely protectedI--1MLManagement of technical vulnerabilitiesOperations security
31
Operation data modified804Y/Execisive priviledgesI -3-LMManagement of privileged access rightsAccess Control
32
9Network Devices
Device configuration modified
901YY//MediumInsecure network devicesI-1-$13.70$328.77$2,301.37LMSecurity of network servicesCommunications security
33
Device exposed902YY//Insecure network designA-2-LMSegregation in networksCommunications security
34
Unauthorized access903YY//Execisive priviledgesI -1-MMReview of user access rightsAccess control
35
Hardware failure904YY/Not properly maintainedI-1-LMEquipment maintenancePhysical and environmental security
36
System unplanned down905YY/Not properly managed for maintenanceI1--LHChange managementOperations security
37
10BookEat Application
Application configuration modified
1001Y/MediumImproper access rightsI1--$22.83$547.95$3,835.62LHAccess control to program source codeAccess control
38
Unauthorized access1002YY//Execisive priviledgesI--1LLReview of user access rightsAccess control
39
Application unplanned down
1003YY//Not properly managed for maintenanceA1--MVHChange managementOperations security
40
Data leakage1004YY///Source code trail can cause misuse of dataA-1-HMPolicies for information securitySecurity Policy
41
Cryptography error1005Y//Security leakage from sesitive data storageA-1-LMKey managementCryptography
42
11ServersNatural disaster1101Y/HighNo disaster recovery management planA--4119.86$2,876.71$20136.98LLProtecting against external and environmental threats
Physical and environmental security
43
Electric fault1102YY//UPS system not properly installedI/A1--LHSupporting utilitiesPhysical and environmental security
44
System unplanned down1103Y//Not properly managed for maintenanceI1--LVHChange managementOperations security
45
Server exposed1104Y//Insecure network designI/A-1-LMSegregation in networksCommunications security
46
Unauthorized access1105YY///Execisive priviledgesI-1-LMManagement of privileged access rightsAccess Control
47
12WorkstationsUnauthorized access1201Y//Low
Bad passwords setup, no periodic changing password
A-3-$1.71$41.10$287.67LMPassword management systemAccess Control
48
Workstation exposed1202Y//User install unauthorized softwareI--1LLReview of user access rightsAccess Control
49
Malware and virus1203Y///Outdated antivirus systemI/A-1-LMRemoval or adjustment of access rightsAccess Control
50
13Employee DataEmployee data exposed1301YY//HighNot securely protectedI/A-3-$7.31$175.34$1,227.40HMManagement of technical vulnerabilitiesOperations security
51
Employee data modified1302YY/Execisive priviledgesI--1LLManagement of privileged access rightsAccess Control
52
Employee data stolen1303Y/Stored in unsesure placeI--1MLSecuring offices, rooms and facilitiesPhysical and environmental security
53
Employee data lost1304Y//Insufficient backupI/A-1-MMInformation backupOperations security
54
14Training Materials
Learning resource exposed
1401YY//MediumNot securely protectedI/A--1$1.14$27.40$191.78LLManagement of technical vulnerabilitiesOperations security
55
Learning resource modified
1402YY/Execisive priviledgesI--1LLManagement of privileged access rightsAccess Control
56
Learning resource stolen1403Y/Stored in unsesure placeI--1LLSecuring offices, rooms and facilitiesPhysical and environmental security
57
Learning resource lost1404Y//Insufficient backupI/A-1-LMInformation backupOperations security
58
15EmailsUnauthorized access1501YY//Huge
Bad passwords setup, no periodic changing password
I/A-1-$4.11$98.63$690.41LMPassword management systemAccess Control
59
Email data lost1502Y//Insufficient backupI--1MLInformation backupOperations security
60
Email unplanned down1503YY//Not properly managed for maintenanceI1--LHChange managementOperations security
61
Email attacks1504Y///Not securely protectedI-1-MMManagement of technical vulnerabilitiesOperations security
62
16Patents
Intellectual property stolen
1601Y//MajorStored in unsecure placeI--1$5.71$136.99$958.90MMSecuring offices, rooms and facilitiesPhysical and environmental security
63
Intellectual property lost1602Y///Insufficient backupI/A--1MMInformation backupOperations security
64
Intellectual property exposed
1603Y//Not securely protectedI--1HHManagement of technical vulnerabilitiesOperations security
65
Intellectual property modified
1604Y///Execisive priviledgesI--1LHManagement of privileged access rightsAccess Control
66
17Advertisement materialsAds material stolen1701Y///MajorStored in unsecure placeI-1-$5.71$136.99$958.90MVHSecuring offices, rooms and facilitiesPhysical and environmental security
67
Ads material lost1702Y//Insufficient backupI/A-1-MHIntellectual property rightsInformation security incident management
68
Ads material exposed1703Y/Not securely protectedA--1HHInformation backupInformation security incident management
69
Ads material modified1704YY//Execisive priviledgesI-1-LVHManagement of privileged access rightsCompliance
70
18Delivery dataDelivery data stolen1801YY///MajorStored in unsecure place I-1-$8.22$197.26$1,380.82MMSecuring offices, rooms and facilitiesPhysical and environmental security
71
Delivery data exposed1802YY//Not securely protected I-1-HHManagement of technical vulnerabilitiesOperations security
72
Delivery data lost1803Y//Insufficient backupI4--MMInformation backupOperations security
73
Delivery data modified1804YY//Execisive priviledges I-1-LHManagement of privileged access rightsAccess control
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100