I. Executive Summary

Scope

• This risk analysis was limited to SpecOrg Data Center.

• [[[Minicomputers and microcomputers were included in the analysis only to the extent they posed a risk to SpecOrg.]]]

Risk Analysis Steps

• Questionnaire diskettes or network sub-directories were developed containing [[[532]]] questions covering all areas of SpecOrg AIS security;

• [[[One hundred eleven]]] SpecOrg employees and users of the SpecOrg answered and returned the responses to the questions;

• The RiskWatch software determined SpecOrg vulnerabilities based on information on diskettes;

• Identified vulnerabilities were validated by SpecOrg management;

• A risk analysis report was prepared.

Key Risk Analysis Report Findings

Assets

[[[

• The asset replacement cost for SpecOrg is approximately $100M.

• Hardware, personnel (government and contractor), and intangibles (reputation) are the major asset categories at SpecOrg.

• Important assets, such as system software, applications, and databases can be replaced relatively inexpensively because they are backed-up. ]]]

Vulnerabilities

[[[

• The risk analysis identified 170 vulnerabilities covering twenty-two vulnerability areas.

• SpecOrg is most vulnerable in five areas: (see Figure 1)

  1. The labeling and control of output listings.

  2. The security of remote terminals.

Executive Summary 2

3. The level and extent of security training.

3. The level of staffing and separation of duties at the DATA CENTER.

4. The level of training for the identification of Privacy Act records and insufficient labeling of Privacy Act-related materials.

• A physical survey of DATA CENTER revealed four fire detection and control vulnerabilities not identified by the questionnaire diskettes (see Chapter VII). ]]]

Threats

[[[

The four most significant threats to SpecOrg on an annual basis are: (see Figure 2)

1. Data Destruction

2. Misuse of the Computer

3. Theft of Assets

4. Data integrity loss.

]]]

Safeguards

[[[

The safeguards with the greatest return on investment, which are also among the least costly safeguards, are: (see Figure 3)

1. Property Management

2. Organizational Structure

3. Visitor Control

4. Security Plan

5. Application Control

]]]

Asset Summary

CHAPTER 2. ASSETS

The SpecOrg risk analysis included 12 asset categories. [[[Some of the categories were divided into more descriptive sub-categories. For example, communication consisted of three resource names (Communication Support Hardware, Communication Diagnostic Equipment, and Communication Modem/DSU).]]] The determination of categories and values of assets was accomplished through interviews with [[[NAME and NAME personnel]]]. A review of the assets was performed by the Risk Analysis Team and SpecOrg [[[and NAME]]] management.

The asset values were determined based on the cost of replacing the particular asset. The largest replacement value was for Accounts Receivable, which is estimated at $50,000. (see Figure 4) and which constitutes 20.8% (see Figures 4 and 6) of the total value of all DATA CENTER assets. The next highest values for replacement cost were for categories Applications and Communications Hardware. The values and percentages of the whole are, respectively, $50,000., at 20.8% and $50,000. at 20.8%.