Lab #4
Student Name: Bạch Quang Lâm_HE172445
Class: IA1803
Risk – Threat – Vulnerability Primary Domain Impacted Risk Impact/Factor
Unauthorized access from pubic Internet Remote Access Domain 1
User destroys data in application and deletes System/Application Domain 3
all files
Hacker penetrates your IT infrastructure LAN-to-WAN Domain 1
and gains access to your internal network
Intra-office employee romance gone bad User Domain 3
Fire destroys primary data center System/Application Domain 1
Service provider SLA is not achieved WAN Domain 3
Workstation OS has a known software Workstation Domain 2
vulnerability
Unauthorized access to organization owned Workstation Domain 1
workstations
Lab Assessment Questions:
Loss of production data System/Application Domain 2
Denial of service attack on organization LAN-to-WAN Domain 1
DMZ and e-mail server
Remote communications from home office Remote Access Domain 2
LAN server OS has a known software LAN Domain 2
vulnerability
User downloads and clicks on an unknown User Domain 1
unknown e-mail attachment
Workstation browser has software vulnerability Workstation Domain 3
Mobile employee needs secure browser access Remote Access Domain 2
to sales order entry system
Service provider has a major network outage WAN Domain 2
Weak ingress/egress traffic filtering LAN-to-WAN Domain 3
degrades performance
User inserts CDs and USB hard drives User Domain 2
with personal photos, music, and videos on0
1. For each of the identified risks, threats, and vulnerabilities, prioritize them
by listing a “1”, “2”, and “3” next to each risk, threat, vulnerability found
within each of the seven domains of a typical IT infrastructure. “1” =
Critical, “2” = Major, “3” = Minor. Define the following qualitative risk
impact/risk factor metrics:
“1” Critical – a risk, threat, or vulnerability that impacts compliance (i.e.,
privacy law requirement for securing privacy data and implementing proper
security controls, etc.) and places the organization in a position of increased
liability.
“2”Major – a risk, threat, or vulnerability that impacts the C-I-A of an
organization’s intellectual property assets and IT infrastructure.
“3”Minor – a risk, threat, or vulnerability that can impact user or employee
productivity or availability of the IT infrastructure.
User Domain Risk Impacts: 5
Workstation Domain Risk Impacts: 3
LAN Domain Risk Impacts: 2
LAN-to-WAN Domain Risk Impacts: 2
WAN Domain Risk Impacts: 4
Remote Access Domain Risk Impacts: 2
Systems/Applications Domain Risk Impacts: 3
Lab Assessment Questions & Answers
1. What is the goal or objective of an IT risk assessment?
Identify and mitigate risks.
2. Why is it difficult to conduct a qualitative risk assessment for an IT
infrastructure?
Because it is hard to tell what kind of impact a given attack will have on
the infrastructure.
3. What was your rationale in assigning “1” risk impact/ risk factor value of
“Critical” for an identified risk, threat, or vulnerability?
Assigned critical impact values for threats that severely compromise
patient data or that made the system useless such as DoS attacks.
4. When you assembled all of the “1” and “2” and “3” risk impact/risk factor
values to the identified risks, threats, and vulnerabilities, how did you prioritize
the “1”, “2”, and “3” risk elements? What would you say to executive
management in regards to your final recommended prioritization?
Management should acquire a SLA so that our systems will always be
functioning optimally. I would also recommend that the appropriate
countermeasures for threats are in place.
5. Identify a risk mitigation solution for each of the following risk factors:
User downloads and clicks on an unknown e-mail attachment –
Attachments are a significant security risk associated with emails.
Workstation OS has a known software vulnerability – Define a
workstation operating system vulnerability window policy definition.
Start periodic workstation domain vulnerability tests to find all
vulnerabilities.
