лаба_10 / лаб_10_03_2

CHAPTER 2. ASSETS

The SpecOrg risk analysis included 12 asset categories. [[[Some of the categories were divided into more descriptive sub-categories. For example, communication consisted of three resource names (Communication Support Hardware, Communication Diagnostic Equipment, and Communication Modem/DSU).]]] The determination of categories and values of assets was accomplished through interviews with [[[NAME

and NAME personnel]]]. A review of the assets was performed by the Risk Analysis Team and SpecOrg [[[and NAME]]] management.

The asset values were determined based on the cost of replacing the particular asset. The largest replacement value was for Accounts Receivable, which is estimated at $50,000. (see Figure 4) and which constitutes 20.8% (see Figures 4 and 6) of the total value of all DATA CENTER assets. The next highest values for replacement cost were for categories Applications and Communications Hardware. The values and percentages of the whole are, respectively, $50,000., at 20.8% and $50,000. at 20.8%.

2.1SUMMARY OF ASSET CATEGORIES

The following table provides a summary of the total replacement costs for each of the asset categories considered in the analysis.

FIGURE 4

This information is presented below as a barchart.

S/W

Personne

l Acct s

Pay

Dollars

FIGURE 5

The percentage of the total replacement cost for each category is indicated in the following diagram.

VULNERABILITY AREA

REPORT OVERALL

COMPLIANCE:

Compliance (1.4%)

Non-Compliance (98.6%)

VULNERABILITY AREA: Access Control

Compliance (5.3%)

Non-Compliance (94.7%)

VULNERABILITY AREA: Accountability

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Administration

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Data Integrity

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Disclosure

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Documentation

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Evaluation

There is 100% non-compliance in this area of vulnerability.

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Privacy Act

There is 100% non-compliance in this area of vulnerability. VULNERABILITY AREA: Reliability

There is 100% non-compliance in this area of vulnerability.

Assets are identified, by category, by commonly used name; associated with each individual asset there is other related information. Depending on the asset category, other data is also provided for each asset. This will include the level of sensitivity for data, the quantity of a duplicated hardware item, etc.. When the information is available, an indication is included about the basic attribute(s) of each assets that states whether the asset is

critical (in the sense that the mission of the enterprise depends on the correct and timely functioning of this asset), or

financial (with respect to the need to control modification), or sensitive (with respect to disclosure), or

supportive (non of the above).

The definition of each asset category is also provided

The monetary values assigned represent the estimated replacement or purchase cost of the asset, not its current value. For example, the recruitment cost, the training cost, and the staff salaries and benefits were used to determine personnel costs. For leased equipment, replacement cost of obtaining a new lease is used since the organization is responsible for obtaining a replacement resource.

The value of sensitive resources could be greater than the replacement value to account for the loss of future opportunity and the extent of exposure that agencies have resulting from the disclosure of data subject to the Privacy Act; awards of $1,000 to $5,000 per individual record have been assessed by the courts based on the sanctions included in the Privacy Act of 1974.

The sections below deal, in turn, with each of the asset categories included in the analysis.

2.2.1 Accounts Payable

Figure 7.1

This information about replacement costs is presented below as a barchart.

1,337

RTG

Dollars

Figure 8.1

2.2.2 Accounts Receivable

Figure 7.2

This information about replacement costs is presented below as a barchart.

Figure 7.3

This information about replacement costs is presented below as a barchart.

50,000

345

Dollars

Figure 8.3

2.2.4 Communications Hardware

Figure 7.4

This information about replacement costs is presented below as a barchart.

50,000

Dollars

Figure 8.4

2.2.5 Communications Software

Figure 7.5

This information about replacement costs is presented below as a barchart.

25,000

EWQ

Figure 8.5

2.2.6 Databases

This information about replacement costs is presented below as a barchart.