Risk Assessment Table - v1 - August 2014

	A	B	C	D	E	F	G	H	I	J	K	L	M	N
1	Asset	Attack Surface	Threat Description	What could go wrong?	Impact	Likelihood	Control Effectiveness	Inherent Risk Level Scale: 1 - 25	Residual Risk Level Scale: 0-25	Current Controls	Comments	Action/Mitigation Plan	Further Mitigation Warranted?	Mitigation Activity Owner
2	Email (Data)	Personnel Personal Cell Phone	Thief steals cell phone and accesses data on phone, including project email that owner has checked using the device.	3rd party data we're responsible for protecting is breached; we may have to inform everyone; may have to support mitigating damages, investigation, manage reputation	3	3	2	9	7			Consider new policy for securing mobile devices: Password protected, encrypt data, etc.	Maybe	ISO
3	"	Project-Issued Laptop	Thief steals laptop and accesses data stored there, including email cached by IMAP client.	3rd party data we're responsible for protecting is breached; we may have to inform everyone; may have to support mitigating damages, investigation, manage reputation	3	3	4	9	4			Maintain current practice. IT sets up encryption on laptop before issuing to anyone. All laptops have remote-wipe functionality.	No	IT Support Specialist
4	"	Email Server	A third party exploits a vulnerability or misconfiguration in server to access emails stored on the server or observe them being received or transmitted by the server.	3rd party data we're responsible for protecting is breached; we may have to inform everyone; may have to support mitigating damages, investigation, manage reputation	3	3	5	9	2			Maintain current practice. Server only allows encrypted connections; all configuration changes are checked by Senior Systems Administrator before going into production; security updates to server software are applied promptly.	No	Senior Systems Administrator
5	Email (Server & Service)	Postfix (mail transfer agent)	An attacker could use our mail server to send spam.	Consumes our bandwidth, delays legitimate emails, we (our project or whole parent organization) get blocklisted and can't send email at all until resolved.	4	5	3	20	12			Server software is currently kept up to date; administrative access to the server is limited to the local network and requires two-factor authentication. However, users currently don't have to authenticate to the server for sending mail if they have received mail recently. This should be changed so that users' email clients must authenticate each connection.	Yes	Senior Systems Administrator
6	Instrument Control System	Web-Based Control Interface	An attacker could exploit the web application we use to remotely turn our instruments' sensors on and off, causing sensors to be turned off or become unavailable when needed.	Loss of valuable sensor telemetry, possibly during a once-in-a-lifetime event.	5	2	3	10	6			Consider 2FA. The control server is behind a firewall, but security could be increased by using two-factor authentication instead of passwords alone, and/or making it accessible only from the VPN.	Maybe	ISO
7								0	0
8								0	0
9								0	0
10								0	0
11								0	0
12								0	0
13								0	0
14								0	0
15								0	0
16								0	0
17								0	0
18								0	0
19								0	0
20								0	0
21								0	0
22								0	0
23								0	0
24								0	0
25								0	0
26								0	0
27								0	0
28								0	0
29								0	0
30								0	0
31								0	0
32								0	0
33								0	0
34								0	0
35								0	0
36								0	0
37								0	0
38								0	0
39								0	0
40								0	0
41								0	0
42								0	0
43								0	0
44								0	0
45								0	0
46								0	0
47								0	0
48								0	0
49								0	0
50								0	0
51								0	0
52								0	0
53								0	0
54								0	0
55								0	0
56								0	0
57								0	0
58								0	0
59								0	0
60								0	0
61								0	0
62								0	0
63								0	0
64								0	0
65								0	0
66								0	0
67								0	0
68								0	0
69								0	0
70								0	0
71								0	0
72								0	0
73								0	0
74								0	0
75								0	0
76								0	0
77								0	0
78								0	0
79								0	0
80								0	0
81								0	0
82								0	0
83								0	0
84								0	0
85								0	0
86								0	0
87								0	0
88								0	0
89								0	0
90								0	0
91								0	0
92								0	0
93								0	0
94								0	0
95								0	0
96								0	0
97								0	0
98								0	0
99								0	0
100								0	0