II. Recommendations

[[[One hundred seventy]]] vulnerabilities were identified which, if not corrected, could result in considerable loss to ETU.

Immediate steps which can be taken are:

[[[

Correct the fire detection and control vulnerabilities identified during the walk-through.

Publish and disseminate ETU Disaster Recovery Plan.

Develop a system-generated cover page for and improve the control of sensitive output listings.

Review the security of terminals at the Parkview Building.

Test the adequacy of current system software and user file backups.

Remind users of the importance of backing up tape files.

Provide additional training on and enforce existing security policies and procedures.

Publish and disseminate an ETU-wide policy on the handling of sensitive documents and develop a uniform cover sheet for these documents.

Review ETU staffing and separation of duties.

ETU System Security Officer, in coordination with ETU management, should develop a Risk Management Plan to address the implementation of the safeguards with the greatest return on investment.

]]]

[[[

Twelve major safeguards (see CHAPTER IX., Applicable Safeguard Cost Benefit Analysis Summary Table) were recommended which, if implemented, would substantially reduce losses if these threats occurred or prevent the threats from occurring altogether.

ETU System Security Officer should develop a Risk Management Plan in cooperation with ETU management, who will make the final decision as to the selection of applicable safeguards. The Plan will identify the specific steps required to implement the selected safeguards and recommend to ETU management the priority for safeguard implementation.

]]]

2.2 Assets within category

Assets are identified, by category, by commonly used name; associated with each individual asset there is other related information. Depending on the asset category, other data is also provided for each asset. This will include the level of sensitivity for data, the quantity of a duplicated hardware item, etc.. When the information is available, an indication is included about the basic attribute(s) of each assets that states whether the asset is

critical (in the sense that the mission of the enterprise depends on the correct and timely functioning of this asset), or

financial (with respect to the need to control modification), or

sensitive (with respect to disclosure), or

supportive (non of the above).

The definition of each asset category is also provided

The monetary values assigned represent the estimated replacement or purchase cost of the asset, not its current value. For example, the recruitment cost, the training cost, and the staff salaries and benefits were used to determine personnel costs. For leased equipment, replacement cost of obtaining a new lease is used since the organization is responsible for obtaining a replacement resource.

The value of sensitive resources could be greater than the replacement value to account for the loss of future opportunity and the extent of exposure that agencies have resulting from the disclosure of data subject to the Privacy Act; awards of $1,000 to $5,000 per individual record have been assessed by the courts based on the sanctions included in the Privacy Act of 1974.

The sections below deal, in turn, with each of the asset categories included in the analysis.

2.2.1 Accounts Payable

There are no assets in this category.

2.2.2 Accounts Receivable

There are no assets in this category.

2.2.3 Applications

There are no assets in this category.

2.2.4 Cash Accounts

There are no assets in this category.

2.2.5 Communications Hardware

There are no assets in this category.

2.2.6 Communications Software

There are no assets in this category.

2.2.7 Databases

There are no assets in this category.

2.2.8 Documentation

There are no assets in this category.

2.2.9 Facilities

There are no assets in this category.

2.2.10 Fire Detection/Sup.

There are no assets in this category.

2.2.11 Hardware

There are no assets in this category.

2.2.12 Intangibles

There are no assets in this category.

2.2.13 Negotiable Instruments

There are no assets in this category.

2.2.14 Office Equipment

There are no assets in this category.

2.2.15 Personnel

There are no assets in this category.

2.2.16 Procedures

There are no assets in this category.

2.2.17 Security

There are no assets in this category.

2.2.18 Supplies and Consumable

There are no assets in this category.

2.2.19 Support Systems

There are no assets in this category.

2.2.20 System Software

There are no assets in this category.

2.2.21 Utilities

There are no assets in this category.

CHAPTER 2. ASSETS

The ETU risk analysis included 21 asset categories. [[[Some of the categories were divided into more descriptive sub-categories. For example, communication consisted of three resource names (Communication Support Hardware, Communication Diagnostic Equipment, and Communication Modem/DSU).]]] The determination of categories and values of assets was accomplished through interviews with [[[NAME and NAME personnel]]]. A review of the assets was performed by the Risk Analysis Team and ETU [[[and NAME]]] management.

The asset values were determined based on the cost of replacing the particular asset. The largest replacement value was for Accounts Payable, which is estimated at $0. (see Figure 4) and which constitutes 0.0% (see Figures 4 and 6) of the total value of all DATA CENTER assets. The next highest values for replacement cost were for categories Accounts Receivable and Applications. The values and percentages of the whole are, respectively, $0., at 0.0% and $0. at 0.0%.