- •Risk Analysis of Skynet
- •Table of contents
- •Executive Summary
- •Recommendations
- •Operational Environment and System Configuration
- •The Risk Assessment Team
- •Organization Details of SpecOrg
- •Physical Plant and Physical Security
- •System Configuration
- •Terms and Definitions
- •Risk Analysis Methodology
- •RiskWatch Parameters and Data Analysis
- •Executive Summary Scope
- •Risk Analysis Steps
- •Key Risk Analysis Report Findings
- •Summary of asset categories
- •Assets within category
- •Recommendations
- •Physical Access Control
- •Application Controls
- •Classification Markings
- •Contract Specifications
- •Data Encryption
- •Detection System
- •Life Cycle Management
- •Passwords/Authenticaion
- •Personnel Clearances
- •Personnel Control
- •Quality Assurance
- •Risk Analysis
- •Security Policy
- •Summary of safeguards
- •Initial costs
Executive Summary Scope
This risk analysis was limited to SpecOrg Data Center.
[[[Minicomputers and microcomputers were included in the analysis only to the extent they posed a risk to SpecOrg.]]]
Risk Analysis Steps
Questionnaire diskettes or network sub-directories were developed containing [[[532]]] questions covering all areas of SpecOrg AIS security;
[[[One hundred eleven]]] SpecOrg employees and users of the SpecOrg answered and returned the responses to the questions;
The RiskWatch software determined SpecOrg vulnerabilities based on information on diskettes;
Identified vulnerabilities were validated by SpecOrg management;
A risk analysis report was prepared.
Key Risk Analysis Report Findings
Assets [[[
The asset replacement cost for SpecOrg is approximately $100M.
Hardware, personnel (government and contractor), and intangibles (reputation) are the major asset categories at SpecOrg.
Important assets, such as system software, applications, and databases can be replaced relatively inexpensively because they are backed-up.
]]]
Vulnerabilities [[[
The risk analysis identified 170 vulnerabilities covering twenty-two vulnerability areas.
SpecOrg is most vulnerable in five areas: (see Figure 1)
The labeling and control of output listings.
The security of remote terminals.
The level and extent of security training.
The level of staffing and separation of duties at the DATA CENTER.
The level of training for the identification of Privacy Act records and insufficient labeling of Privacy Act-related materials.