A physical survey of DATA CENTER revealed four fire detection and control vulnerabilities not identified by the questionnaire diskettes (see Chapter VII).

]]]

Threats [[[

The four most significant threats to SpecOrg on an annual basis are: (see Figure 2)

1. Data Destruction

]]]

2. Misuse of the Computer

3. Theft of Assets

4. Data integrity loss.

Safeguards [[[

The safeguards with the greatest return on investment, which are also among the least costly safeguards, are: (see Figure 3)

1. Property Management

2. Organizational Structure

3. Visitor Control

4. Security Plan

5. Application Control

]]]

CHAPTER 2. ASSETS

The SpecOrg risk analysis included 12 asset categories. [[[Some of the categories were divided into more descriptive sub-categories. For example, communication consisted of three resource names (Communication Support Hardware, Communication Diagnostic Equipment, and Communication Modem/DSU).]]] The determination of categories and values of assets was accomplished through interviews with [[[NAME and NAME personnel]]]. A review of the assets was performed by the Risk Analysis Team and SpecOrg [[[and NAME]]] management.

The asset values were determined based on the cost of replacing the particular asset. The largest replacement value was for Accounts Receivable, which is estimated at $50,000. (see Figure 4) and which constitutes 20.8% (see Figures 4 and 6) of the total value of all DATA CENTER assets. The next highest values for replacement cost were for categories Applications and Communications Hardware. The values and percentages of the whole are, respectively, $50,000., at 20.8% and $50,000. at 20.8%.

1. Summary of asset categories

The following table provides a summary of the total replacement costs for each of the asset categories considered in the analysis.

Asset Category	Replacement Cost	Percentage of Total
Accounts Receivable	$50,000.	20.8%
Applications	$50,000.	20.8%
Communications Hardware	$50,000.	20.8%
Communications Software	$25,000.	10.4%
Hardware	$25,000.	10.4%
Office Equipment	$12,500.	5.2%
Documentation	$10,000.	4.2%
Databases	$7,500.	3.1%
System Software	$7,500.	3.1%
Personnel	$2,000.	0.8%
Accounts Payable	$1,337.	0.6%
Utilities FIGURE 4	$0.	0.0%

This information is presented below as a barchart.

Acct s Rec Applicatns Comms H/W Comms S/W Hardware Off Equip Document'n Databases System S/W

Personnel Acct s Pay

5 10 15 20 25 30 35 40 45 50 (x1 ,000)

Dollars

FIGURE 5

The percentage of the total replacement cost for each category is indicated in the following diagram.

Acct s Rec (20.8%)

6 Others (11.8%)

Off Equip (5.2%)

Hardware (10.4%)

Applicatns (20.8%) _{Comms S/W (10.4%)}

Comms H/W (20.8%

FIGURE 6

VULNERABILITY AREA REPORT OVERALL COMPLIANCE:

Compliance (1.4%)

Non-Compliance (98.6%)

VULNERABILITY AREA: Access Control

Compliance (5.3%)

Non-Compliance (94.7%)

VULNERABILITY AREA: Accountability

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Administration

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Data Integrity

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Disclosure

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Documentation

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Evaluation

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Policy

There is 100% non-compliance in this area of vulnerability.

VULNERABILITY AREA: Privacy Act

There is 100% non-compliance in this area of vulnerability. VULNERABILITY AREA: Reliability

There is 100% non-compliance in this area of vulnerability.

2. Assets within category

Assets are identified, by category, by commonly used name; associated with each individual asset there is other related information. Depending on the asset category, other data is also provided for each asset. This will include the level of sensitivity for data, the quantity of a duplicated hardware item, etc.. When the information is available, an indication is included about the basic attribute(s) of each assets that states whether the asset is

critical (in the sense that the mission of the enterprise depends on the correct and timely functioning of this asset), or

financial (with respect to the need to control modification), or sensitive (with respect to disclosure), or

supportive (non of the above).

The definition of each asset category is also provided

The monetary values assigned represent the estimated replacement or purchase cost of the asset, not its current value. For example, the recruitment cost, the training cost, and the staff salaries and benefits were used to determine personnel costs. For leased equipment, replacement cost of obtaining a new lease is used since the organization is responsible for obtaining a replacement resource.

The value of sensitive resources could be greater than the replacement value to account for the loss of future opportunity and the extent of exposure that agencies have resulting from the disclosure of data subject to the Privacy Act; awards of $1,000 to $5,000 per individual record have been assessed by the courts based on the sanctions included in the Privacy Act of 1974.

The sections below deal, in turn, with each of the asset categories included in the analysis.

1. Accounts Payable

Asset Replacement Cost Percentage of Total RTG $1,337. 100.0%

Figure 7.1

This information about replacement costs is presented below as a barchart.

RTG

1 2 3 4 5 6 7 8 9 10 11 12 13 (x 100 )

Dollars

Figure 8.1

2. Accounts Receivable

Asset Replacement Cost Percentage of Total

321 $50,000. 100.0%

Figure 7.2

This information about replacement costs is presented below as a barchart.

321

5 10 15 20 25 30 35 40 45 50 (x 1,000)

Dollars

Figure 8.2

3. Applications

Asset Replacement Cost Percentage of Total

345 $50,000. 100.0%

Figure 7.3

This information about replacement costs is presented below as a barchart.

345

5 10 15 20 25 30 35 40 45 50 (x 1,000)

Dollars

Figure 8.3

4. Communications Hardware

Asset Replacement Cost Percentage of Total

$50,000. 100.0%

Figure 7.4

This information about replacement costs is presented below as a barchart.

5 10 15 20 25 30 35 40 45 50 (x1 ,000)

Dollars

Figure 8.4

5. Communications Software

Asset Replacement Cost Percentage of Total EWQ $25,000. 100.0%

Figure 7.5

This information about replacement costs is presented below as a barchart.

EWQ

25 50 75 100 125 150 175 200 225 250 (x 100)

Dollars

Figure 8.5

6. Databases

Asset Replacement Cost Percentage of Total

456 $7,500. 100.0%

Figure 7.6

This information about replacement costs is presented below as a barchart.

456

1 2 3 4 5 6 7 (x 1,000 )

Dollars

Figure 8.6

7. Documentation

Asset Replacement Cost Percentage of Total OI $10,000. 100.0%

Figure 7.7

This information about replacement costs is presented below as a barchart.

OI

1 2 3 4 5 6 7 8 9 10 (x1 ,000)

Dollars

Figure 8.7

8. Hardware

Asset Replacement Cost Percentage of Total HARD $25,000. 100.0%

Figure 7.8

This information about replacement costs is presented below as a barchart.

HARD

25 50 75 100 125 150 175 200 225 250 (x 100)

Dollars

Figure 8.8

9. Office Equipment

Asset Replacement Cost Percentage of Total QWE $7,500. 60.0%

QWE $5,000. 40.0%

Figure 7.9

This information about replacement costs is presented below as a barchart.

QWE QWE

1 2 3 4 5 6 7 (x 1,000 )

Dollars

Figure 8.9

The percentage of the total replacement cost for this category that is contributed by each asset is indicated in the following diagram.

QWE (40.0%)

QWE (60.0%)

Figure 9.9

10. Personnel

Asset	Replacement Cost	Percentage of Total
PERS	$2,000.	100.0%

Figure 7.10

This information about replacement costs is presented below as a barchart.

PERS

25 50 75 100 125 150 175 200 (x 10 )

Dollars

Figure 8.10

11. System Software

Asset Replacement Cost Percentage of Total HELPMEPLEASE $7,500. 100.0%

Figure 7.11

This information about replacement costs is presented below as a barchart.

LPMEPLEASE

1 2 3 4 5 6 7 (x 1 ,000 )

Dollars

Figure 8.11

12. Utilities

Asset Replacement Cost Percentage of Total

42 $0. 0.0%

42 $0. 0.0%

Figure 7.12

2. INCIDENTS INVOLVING EACH THREAT

Each Incident is defined as triple of the form <threat, loss category, asset category>. By doing things this way it is possible to separate the various forms of loss that a given threat may cause to the enterprise as the result of acting on the same asset category.

The sections below look at each threat and indicate the various incidents that were associated with it in the analysis. For each incident, a table is presented (FIGURES 13.1, 13.2, ...) indicating its SLE and ALE (where the ALE is generated by multiplying the SLE for the incident by the AFE of the threat). The overall ALE for a threat is the sum of the ALEs for each of the associated incidents. This is shown as the total of the third column. The percentage of this total represented by the ALE for each incident is indicated in the fourth column.

Also shown for each threat is a barchart that provides a visual presentation of the relative magnitudes of the ALE for each incident. These are shown as FIGURES 14.1, 14.2, ....

Piecharts are then also provided that indicate the percentage of each threat ALE that is accounted for by each incident that is used in its calculation.

1. Blackmail - AFE: 0.05

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE ALE	% of total ALE
Direct Loss, Personnel Figure 13.1	$20. $1.	0.0%

Direct, Personnel

2 4 6 8 10 12 14 16 18 20

Dollars

Figure 16.1 Blackmail - SLE's

2. Budget Loss - AFE: 0.50

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE	ALE	% of total ALE
Disclosure, Databases Figure 13.2	$25,000.	$12,500.	100.0%

Disclosure, Databases

1 2 3 4 5 6 7 8 9 10 11 12 (x 1,000)

Dollars

Figure 14.2 Budget Loss - ALE's

Disclosure, Databases

25 50 75 100 125 150 175 200 225 250 (x 100)

Dollars

Figure 16.2 Budget Loss - SLE's

3. Cold/Frost/Snow - AFE: 5.00

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE	ALE	% of total ALE
Disclosure, Databases Figure 13.3	$12,500.	$62,500.	100.0%

Disclosure, Databases

5 10 15 20 25 30 35 40 45 50 55 60 (x 1,000)

Dollars

Figure 14.3 Cold/Frost/Snow - ALE's

Disclosure, Databases

1 2 3 4 5 6 7 8 9 10 11 12 (x 1,000)

Dollars

Figure 16.3 Cold/Frost/Snow - SLE's

4. Data Destruction - AFE: 20.00

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE	ALE	% of total ALE
Disclosure, Databases	$250,000.	$5,000,000.	98.9%
Direct Loss, Databases Figure 13.4	$2,751.	$55,027.	1.1%

Disclosure, Databases

5 10 15 20 25 30 35 40 45 50 (x 100,000)

Dollars

Direct, Dat abases

5 10 15 20 25 30 35 40 45 50 55 (x1 ,000)

Dollars

Figure 14.4 Data Destruction - ALE's

Direct, Dat abases (1.1%)

Disclosure, Databases (98.9%)

Figure 15.4 Data Destruction - ALE's

Disclosure, Databases

25 50 75 100 125 150 175 200 225 250 (x 1,000)

Dollars

Direct, Dat abases

25 50 75 100 125 150 175 200 225 250 275 (x 10 )

Dollars

Figure 16.4 Data Destruction - SLE's

5. Data Disclosure - AFE: 3.00

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE	ALE	% of total ALE
Disclosure, Databases Figure 13.5	$1,938.	$5,813.	100.0%

Disclosure, Databases

5 10 15 20 25 30 35 40 45 50 55 (x 100 )

Dollars

Figure 14.5 Data Disclosure - ALE's

Disclosure, Databases

25 50 75 100 125 150 175 (x 10 )

Dollars

Figure 16.5 Data Disclosure - SLE's

6. Data Integrity Loss - AFE: 3.00

The various incident classes associated with this threat are shown in the following table:

Incident Class	SLE	ALE	% of total ALE
Direct Loss, Accounts Receivable	$5,526.	$16,576.	27.8%
Direct Loss, Applications	$5,507.	$16,523.	27.7%
Disclosure, Personnel	$4,500.	$13,500.	22.7%
Direct Loss, Communications Software	$2,723.	$8,171.	13.7%
Direct Loss, System Software	$817.	$2,451.	4.1%
Direct Loss, Databases	$640.	$1,921.	3.2%
Direct Loss, Accounts Payable	$147.	$443.	0.7%
Disclosure, Databases Figure 13.6	$0.	$0.	0.0%

Direct, Accts Rec Direct, Applicatns Disclosure, Personnel Direct, Comms S/W Direct, System S/W Direct, Dat abases

25 50 75 100 125 150 (x 100)

Dollars

Direct, Accts Pay

5 10 15 20 25 30 35 40 (x10)

Dollars

Figure 14.6 Data Integrity Loss - ALE's

4 Ot hers (8.1%)

Direct, Accts Rec (27.8%) _{Direct, Comms S/W (13.7%)}

Disclosure, Personnel (22.7%)

Direct, Applicatns (27.7%)

Figure 15.6 Data Integrity Loss - ALE's

Direct, Accts Rec Direct, Applicatns Disclosure, Personnel Direct, Comms S/W Direct, System S/W Direct, Dat abases Direct, Accts Pay

5 10 15 20 25 30 35 40 45 50 55 (x 100)

Dollars

Figure 16.6 Data Integrity Loss - SLE's

7. Flooding/Water Damage - AFE: 0.01

The various incident classes associated with this threat are shown in the following table: Incident Class SLE ALE % of total ALE

Direct Loss, Communications Hardware $10,001. $100. 93.5%

Direct Loss, Office Equipment	$625.	$6.	5.8%
Disclosure, Databases Figure 13.7	$250.	$3.	2.3%

Direct, Comms H/W

1 2 3 4 5 6 7 8 9 10 (x10)

Dollars

Direct, Off Equip Disclosure, Databases

1 2 3 4 5 6

Dollars

Figure 14.7 Flooding/Water Damage - ALE's

Disclosure, Databases (2.8%) Direct, Off Equip (5.5%)

Direct, Comms H/W (91.7%)

Figure 15.7 Flooding/Water Damage - ALE's

Direct, Comms H/W

1 2 3 4 5 6 7 8 9 10 (x1 ,000)

Dollars

Direct, Off Equip Disclosure, Databases

5 10 15 20 25 30 35 40 45 50 55 60 (x 10)

Dollars

Figure 16.7 Flooding/Water Damage - SLE's

8. Hardware Failure - AFE: 70.00

The various incident classes associated with this threat are shown in the following table: Incident Class SLE ALE % of total ALE

Direct Loss, Hardware $375,000. $26,250,000. 100.0% Disclosure, Databases $0. $0. 0.0%

Figure 13.8

Direct, Hardware

25 50 75 100 125 150 175 200 225 250 (x 100,000)

Dollars

Figure 14.8 Hardware Failure - ALE's

Direct, Hardware

5 10 15 20 25 30 35 (x10,000)

Dollars

Figure 16.8 Hardware Failure - SLE's

9. Pirating Key Personnel - AFE: 1.00

The various incident classes associated with this threat are shown in the following table: There are no incidents associated with this threat.

The section below looks at each safeguard and indicates, for each threat, the ALE before and after the safeguard is implemented. The overall ALE for a threat is the sum of the ALEs for each of the associated incidents. The percentage by which the ALE is reduced by the safeguard is also indicated.

The next section contains a table indicating, for each safeguard, the ALE before (Original ALE) and after the safeguard is implemented.

Safeguard: Physical Access Control

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$5,035,861.	0.38%
Data Disclosure	$5,813.	$4,915.	15.45%
Data Integrity Loss	$59,584.	$43,827.	26.45%

Safeguard: Application Controls

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$4,549,525.	10.00%

Safeguard: Classification Markings

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Disclosure	$5,813.	$3,459.	40.50%

Safeguard: Contract Specifications

Threat

Original ALE

ALE with Safeguard

Percentage Drop

Safeguard: Data Encryption

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$2,527,514.	50.00%
Data Disclosure	$5,813.	$2,861.	50.78%
Data Integrity Loss	$59,584.	$44,688.	25.00%

Safeguard: Detection System

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$5,047,361.	0.15%
Data Disclosure	$5,813.	$5,372.	7.59%
Data Integrity Loss	$59,584.	$53,251.	10.63%

Safeguard: Life Cycle Management

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Integrity Loss	$59,584.	$59,238.	0.58%

Safeguard: Passwords/Authenticaion

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Disclosure	$5,813.	$5,740.	1.26%

Safeguard: Personnel Clearances

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$5,050,854.	0.08%
Data Disclosure	$5,813.	$4,337.	25.39%
Data Integrity Loss	$59,584.	$56,505.	5.17%

Safeguard: Personnel Control

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Disclosure	$5,813.	$5,749.	1.10%
Data Integrity Loss	$59,584.	$59,563.	0.04%

Safeguard: Quality Assurance

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Integrity Loss	$59,584.	$53,627.	10.00%

Safeguard: Risk Analysis

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$5,049,525.	0.11%

Data Disclosure	$5,813.	$5,232.	9.99%
Data Integrity Loss	$59,584.	$54,977.	7.73%

Safeguard: Security Policy

Threat	Original ALE	ALE with Safeguard	Percentage Drop
Data Destruction	$5,055,028.	$4,796,256.	5.12%
Data Disclosure	$5,813.	$4,703.	19.10%
Data Integrity Loss	$59,584.	$52,058.	12.63%

The following is a table indicating, for each safeguard, the ALE before (Original ALE) and after the safeguard is implemented (ALE with Safeguard). This table also indicates the difference between the two ALE values.

Also shown is a barchart that provides a visual presentation of the difference in ALE for each safeguard.

Safeguard	Original ALE	ALE with Safeguard	Difference
Physical Access Control	$31,445,536.	$31,409,712.	$35,824.
Application Controls	$31,445,536.	$30,940,033.	$505,503.
Classification Markings	$31,445,536.	$31,443,182.	$2,354.
Contract Specifications	$31,445,536.	$31,445,536.	$0.
Data Encryption	$31,445,536.	$28,900,174.	$2,545,362.
Detection System	$31,445,536.	$31,431,094.	$14,442.
Life Cycle Management	$31,445,536.	$31,445,189.	$347.
Passwords/Authenticaion	$31,445,536.	$31,445,463.	$73.
Personnel Clearances	$31,445,536.	$31,436,806.	$8,730.
Personnel Control	$31,445,536.	$31,445,451.	$85.
Quality Assurance	$31,445,536.	$31,439,578.	$5,958.
Risk Analysis	$31,445,536.	$31,434,844.	$10,692.
Security Policy	$31,445,536.	$31,178,127.	$267,409.

Data Encryption Application Cont rols Security Policy

25 50 75 100 125 150 175 200 225 250 (x 10 ,000 )

Dollars

Physical Access Control Detection Syst em Risk Analysis Personnel Clearances Quality Assurance

Classification Markings

25 50 75 100 125 150 175 200 225 250 275 300 325 350 (x 100)

Dollars

Life Cycle Management Personnel Control Passwords/Aut henticaion

25 50 75 100 125 150 175 200 225 250 275 300 325

Dollars

Instructions for preparing Final Reports.

In Phase 4, there are many different reports that can be generated. To facilitate the assembly of these smaller specialized reports into a single "Final Report" for submission to management, provision is made to attach the name of each selected report file (each is a .WRI file) to a list that is made available to the analyst at the end of the reporting phase, Phase 4.

A couple of points must be kept in mind when the final report is assembled; it is assumed that a word processor will be used to prepare the Final Report and the following are tasks and ideas that are within the purview of most word processors:

1. On the parameter screen in Phase 1, you indicated that the sensitivity level of the system being analyzed is 1. Because reports that deal with a system must bear markings that indicated that the report is of a similar level of sensitivity, you are warned that the word processor used in the assembly process must also be used to indicate, as both Headers and Footers, this level of sensitivity on EVERY page;

2. There is no provision in the RiskWatch system for the title page or pages that come before paragraphs, sections, or diagrams. The analyst wishing these must provide them himself using the facilities of the word processor employed;

3. The ordering of sections is left to the discretion of the analyst - some people prefer to have the Executive Summary as the very first section, even preceding the Table of Contents, while others may wish to have their Table of Contents immediately following the Cover page;

4. Because of the strong possibility that different enterprises will opt to assemble different pieces (sub-reports) into their respective Final Reports, the Table of Contents for the Final Report is left to the analyst, using the power of a modern word processor.

5. In the text provided by RiskWatch as part of the reports that embody the results of the analysis and the initial data, there are several sections that are enclosed in triple square brackets (that is, [[[ and

]]] ). All text that is between these braces is given SOLELY as a guide to suggested text to surround the numbers that form the basis of the reports. The text serves no other purpose. Please replace this text with other text that is more appropriate to your enterprise.

2. Recommendations

[[[One hundred seventy]]] vulnerabilities were identified which, if not corrected, could result in considerable loss to SpecOrg.

Immediate steps which can be taken are:

[[[

• Correct the fire detection and control vulnerabilities identified during the walk-through.

• Publish and disseminate SpecOrg Disaster Recovery Plan.

• Develop a system-generated cover page for and improve the control of sensitive output listings.

• Review the security of terminals at the Parkview Building.

• Test the adequacy of current system software and user file backups.

• Remind users of the importance of backing up tape files.

• Provide additional training on and enforce existing security policies and procedures.

• Publish and disseminate an SpecOrg-wide policy on the handling of sensitive documents and develop a uniform cover sheet for these documents.

• Review SpecOrg staffing and separation of duties.

• SpecOrg System Security Officer, in coordination with SpecOrg management, should develop a Risk Management Plan to address the implementation of the safeguards with the greatest return on investment.

]]]

[[[

Twelve major safeguards (see CHAPTER IX., Applicable Safeguard Cost Benefit

Analysis Summary Table) were recommended which, if implemented, would substantially reduce losses if these threats occurred or prevent the threats from occurring altogether.

SpecOrg System Security Officer should develop a Risk Management Plan in cooperation with SpecOrg management, who will make the final decision as to the selection of applicable safeguards. The Plan will identify the specific steps required to implement the selected safeguards and recommend to SpecOrg management the priority for safeguard implementation.

]]]

2. FULL SAFEGUARD REPORT

This report contains information about each safeguard, including a cost benefit analysis.

1. Physical Access Control

Lifetime: 3 Implementation Cost: $2,000,000. Annual Maintenance Cost: $500,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$35,824.	$2,000,000.	$32,567.	$1,818,181.	$-1,785,614.
2	$35,824.	$500,000.	$29,606.	$413,223.	$-383,616.
3	$35,824.	$500,000.	$26,915.	$375,657.	$-348,742.

Sum of discounted benefits (0.05): $97,557. Sum of discounted benefits (0.1): $89,088. Sum of discounted benefits (0.15): $81,793. Sum of discounted costs (0.05): $2,790,193. Sum of discounted costs (0.1): $2,607,061. Sum of discounted costs (0.15): $2,445,959. Benefit Cost Ratio (0.05): 0.03

Benefit Cost Ratio (0.1): 0.03

Benefit Cost Ratio (0.15): 0.03

Return On Investment (0.05): 0.01

Return On Investment (0.1): 0.01

Return On Investment (0.15): 0.01

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

2. Application Controls

Lifetime: 3 Implementation Cost: $50,000. Annual Maintenance Cost: $50,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$505,503.	$50,000.	$459,547.	$45,454.	$414,093.
2	$505,503.	$50,000.	$417,770.	$41,322.	$376,448.
3	$505,503.	$50,000.	$379,791.	$37,565.	$342,225.

Sum of discounted benefits (0.05): $1,376,608. Sum of discounted benefits (0.1): $1,257,108. Sum of discounted benefits (0.15): $1,154,175. Sum of discounted costs (0.05): $136,161.

Sum of discounted costs (0.1): $124,341. Sum of discounted costs (0.15): $114,160. Benefit Cost Ratio (0.05): 10.11

Benefit Cost Ratio (0.1): 10.11

Benefit Cost Ratio (0.15): 10.11

Return On Investment (0.05): 3.37

Return On Investment (0.1): 3.37

Return On Investment (0.15): 3.37

Payback period (0.05): 1

Payback period (0.1): 1

Payback period (0.15): 1

3. Classification Markings

Lifetime: 3 Implementation Cost: $500,000. Annual Maintenance Cost: $50,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$2,354.	$500,000.	$2,140.	$454,545.	$-452,405.
2	$2,354.	$50,000.	$1,945.	$41,322.	$-39,376.
3	$2,354.	$50,000.	$1,768.	$37,565.	$-35,796.

Sum of discounted benefits (0.05): $6,410. Sum of discounted benefits (0.1): $5,853. Sum of discounted benefits (0.15): $5,375. Sum of discounted costs (0.05): $564,732. Sum of discounted costs (0.1): $533,432. Sum of discounted costs (0.15): $505,464.

Benefit Cost Ratio (0.05): 0.01

Benefit Cost Ratio (0.1): 0.01

Benefit Cost Ratio (0.15): 0.01

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

4. Contract Specifications

Lifetime: 1 Implementation Cost: $50,000. Annual Maintenance Cost: $100,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$0.	$50,000.	$0.	$45,454.	$-45,454.

Sum of discounted benefits (0.05): $0. Sum of discounted benefits (0.1): $0. Sum of discounted benefits (0.15): $0. Sum of discounted costs (0.05): $47,619. Sum of discounted costs (0.1): $45,454. Sum of discounted costs (0.15): $43,478. Benefit Cost Ratio (0.05): 0.00

Benefit Cost Ratio (0.1): 0.00

Benefit Cost Ratio (0.15): 0.00

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

5. Data Encryption

Lifetime: 5 Implementation Cost: $500,000. Annual Maintenance Cost: $500,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$2,545,362.	$500,000.	$2,313,965.	$454,545.	$1,859,420.
2	$2,545,362.	$500,000.	$2,103,605.	$413,223.	$1,690,381.
3	$2,545,362.	$500,000.	$1,912,368.	$375,657.	$1,536,710.
4	$2,545,362.	$500,000.	$1,738,516.	$341,506.	$1,397,009.
5	$2,545,362.	$500,000.	$1,580,469.	$310,460.	$1,270,009.

Sum of discounted benefits (0.05): $11,020,083. Sum of discounted benefits (0.1): $9,648,923. Sum of discounted benefits (0.15): $8,532,446. Sum of discounted costs (0.05): $2,164,736.

Sum of discounted costs (0.1): $1,895,391. Sum of discounted costs (0.15): $1,676,075. Benefit Cost Ratio (0.05): 5.09

Benefit Cost Ratio (0.1): 5.09

Benefit Cost Ratio (0.15): 5.09

Return On Investment (0.05): 1.02

Return On Investment (0.1): 1.02

Return On Investment (0.15): 1.02

Payback period (0.05): 1

Payback period (0.1): 1

Payback period (0.15): 1

6. Detection System

Lifetime: 3 Implementation Cost: $1,000,000. Annual Maintenance Cost: $200,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$14,442.	$1,000,000.	$13,129.	$909,090.	$-895,961.
2	$14,442.	$200,000.	$11,935.	$165,289.	$-153,353.
3	$14,442.	$200,000.	$10,850.	$150,262.	$-139,412.

Sum of discounted benefits (0.05): $39,328. Sum of discounted benefits (0.1): $35,914. Sum of discounted benefits (0.15): $32,974. Sum of discounted costs (0.05): $1,306,552. Sum of discounted costs (0.1): $1,224,641. Sum of discounted costs (0.15): $1,152,296. Benefit Cost Ratio (0.05): 0.03

Benefit Cost Ratio (0.1): 0.03

Benefit Cost Ratio (0.15): 0.03

Return On Investment (0.05): 0.01

Return On Investment (0.1): 0.01

Return On Investment (0.15): 0.01

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

7. Life Cycle Management

Lifetime: 1 Implementation Cost: $200,000. Annual Maintenance Cost: $0.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$347.	$200,000.	$315.	$181,818.	$-181,502.

Sum of discounted benefits (0.05): $330. Sum of discounted benefits (0.1): $315. Sum of discounted benefits (0.15): $301. Sum of discounted costs (0.05): $190,476. Sum of discounted costs (0.1): $181,818. Sum of discounted costs (0.15): $173,913. Benefit Cost Ratio (0.05): 0.00

Benefit Cost Ratio (0.1): 0.00

Benefit Cost Ratio (0.15): 0.00

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

8. Passwords/Authenticaion

Lifetime: 5 Implementation Cost: $40,000. Annual Maintenance Cost: $200,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$73.	$40,000.	$66.	$36,363.	$-36,297.
2	$73.	$200,000.	$60.	$165,289.	$-165,228.
3	$73.	$200,000.	$54.	$150,262.	$-150,208.
4	$73.	$200,000.	$49.	$136,602.	$-136,552.
5	$73.	$200,000.	$45.	$124,184.	$-124,138.

Sum of discounted benefits (0.05): $313. Sum of discounted benefits (0.1): $274. Sum of discounted benefits (0.15): $242. Sum of discounted costs (0.05): $713,512. Sum of discounted costs (0.1): $612,700. Sum of discounted costs (0.15): $531,298. Benefit Cost Ratio (0.05): 0.00

Benefit Cost Ratio (0.1): 0.00

Benefit Cost Ratio (0.15): 0.00

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

9. Personnel Clearances

Lifetime: 1 Implementation Cost: $50,000. Annual Maintenance Cost: $100,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$8,730.	$50,000.	$7,936.	$45,454.	$-37,518.

Sum of discounted benefits (0.05): $8,314. Sum of discounted benefits (0.1): $7,936. Sum of discounted benefits (0.15): $7,591. Sum of discounted costs (0.05): $47,619. Sum of discounted costs (0.1): $45,454.

Sum of discounted costs (0.15): $43,478. Benefit Cost Ratio (0.05): 0.17

Benefit Cost Ratio (0.1): 0.17

Benefit Cost Ratio (0.15): 0.17

Return On Investment (0.05): 0.17

Return On Investment (0.1): 0.17

Return On Investment (0.15): 0.17

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

10. Personnel Control

Lifetime: 3 Implementation Cost: $200,000. Annual Maintenance Cost: $100,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$85.	$200,000.	$77.	$181,818.	$-181,740.
2	$85.	$100,000.	$70.	$82,644.	$-82,574.
3	$85.	$100,000.	$63.	$75,131.	$-75,067.

Sum of discounted benefits (0.05): $230. Sum of discounted benefits (0.1): $210. Sum of discounted benefits (0.15): $192. Sum of discounted costs (0.05): $367,561. Sum of discounted costs (0.1): $339,593. Sum of discounted costs (0.15): $315,278. Benefit Cost Ratio (0.05): 0.00

Benefit Cost Ratio (0.1): 0.00

Benefit Cost Ratio (0.15): 0.00

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

11. Quality Assurance

Lifetime: 5 Implementation Cost: $400,000. Annual Maintenance Cost: $300,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$5,959.	$400,000.	$5,416.	$363,636.	$-358,219.
2	$5,959.	$300,000.	$4,924.	$247,933.	$-243,009.
3	$5,959.	$300,000.	$4,476.	$225,394.	$-220,917.
4	$5,959.	$300,000.	$4,069.	$204,904.	$-200,834.
5	$5,959.	$300,000.	$3,699.	$186,276.	$-182,576.

Sum of discounted benefits (0.05): $25,795. Sum of discounted benefits (0.1): $22,584. Sum of discounted benefits (0.15): $19,971. Sum of discounted costs (0.05): $1,394,078. Sum of discounted costs (0.1): $1,228,143. Sum of discounted costs (0.15): $1,092,601. Benefit Cost Ratio (0.05): 0.02

Benefit Cost Ratio (0.1): 0.02

Benefit Cost Ratio (0.15): 0.02

Return On Investment (0.05): 0.00

Return On Investment (0.1): 0.00

Return On Investment (0.15): 0.00

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

12. Risk Analysis

Lifetime: 3 Implementation Cost: $100,000. Annual Maintenance Cost: $30,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$10,693.	$100,000.	$9,720.	$90,909.	$-81,188.
2	$10,693.	$30,000.	$8,836.	$24,793.	$-15,956.
3	$10,693.	$30,000.	$8,033.	$22,539.	$-14,505.

Sum of discounted benefits (0.05): $29,117. Sum of discounted benefits (0.1): $26,589. Sum of discounted benefits (0.15): $24,412. Sum of discounted costs (0.05): $148,363. Sum of discounted costs (0.1): $138,241.

Sum of discounted costs (0.15): $129,365. Benefit Cost Ratio (0.05): 0.20

Benefit Cost Ratio (0.1): 0.19

Benefit Cost Ratio (0.15): 0.19

Return On Investment (0.05): 0.07

Return On Investment (0.1): 0.06

Return On Investment (0.15): 0.06

Payback period (0.05): 0

Payback period (0.1): 0

Payback period (0.15): 0

13. Security Policy

Lifetime: 3 Implementation Cost: $70,000. Annual Maintenance Cost: $40,000.

Year	Benefits	Costs	Disc. Ben(0.1)	Disc. Cost(0.1)	DB-DC(0.1)
1	$267,409.	$70,000.	$243,099.	$63,636.	$179,462.
2	$267,409.	$40,000.	$220,999.	$33,057.	$187,941.
3	$267,409.	$40,000.	$200,908.	$30,052.	$170,855.

Sum of discounted benefits (0.05): $728,219. Sum of discounted benefits (0.1): $665,006. Sum of discounted benefits (0.15): $610,553. Sum of discounted costs (0.05): $137,500.

Sum of discounted costs (0.1): $126,745. Sum of discounted costs (0.15): $117,414. Benefit Cost Ratio (0.05): 5.30

Benefit Cost Ratio (0.1): 5.25

Benefit Cost Ratio (0.15): 5.20

Return On Investment (0.05): 1.77

Return On Investment (0.1): 1.75

Return On Investment (0.15): 1.73

Payback period (0.05): 1

Payback period (0.1): 1

Payback period (0.15): 1

Here is a summary of the Return on Investment (R.O.I) for each safeguard.

Safeguard	ROI(10%)	Percentage of Total
Application Controls	3.37	52.6%
Security Policy	1.75	27.3%
Data Encryption	1.02	15.9%
Personnel Clearances	0.17	2.7%
Risk Analysis	0.06	1.0%
Physical Access Control	0.01	0.2%
Detection System	0.01	0.2%
Quality Assurance	0.00	0.1%
Classification Markings	0.00	0.1%
Life Cycle Management	0.00	0.0%
Personnel Control	0.00	0.0%
Passwords/Authenticaion	0.00	0.0%

Contract Specifications

0.00

0.0%

ROI

Application Cont rols Security Policy Data Encryption

1 2 3

Return On Invest ment(ROI). Calculated in order of the 10 highest ROIs.

CHAPTER 5. SAFEGUARDS

The analysis recommends a total of [[[ thirty-six (36) ]]] safeguards out of a possible 42 for use (at the AIS).

Figures 16 through 18 reflect the total cost of each safeguard for the life cycle of the safeguard.

It is generally taken that safeguards can fall into three categories:

1. those that prevent incidents;

2. those that permit the timely detection of incidents that have not been detected;

3. those that aid in the recovery process after an incident has occurred.

The goal of a safeguard is to reduce the Annual Loss Expectancy (ALE) of one or more incidents, thereby reducing the overall ALE for the enterprise. This reduction is calculated by noticing that various safeguards impact the overall system in different ways. Three different forms of impact have been noted:

1. the reduction in certain evaluative parameters for assets (for example the (recovery) safeguard of Insurance can reduce the Replacement Cost of all assets covered by the insurance);

2. the reduction in the level of vulnerability in certain areas (for example the (preventative) safeguard of Data Encryption) can significantly reduce the vulnerability called Disclosure (or Data Disclosure); the (detective) safeguard of Monitor System can act to lessen the difficulty that can arise from the slowly degrading Reliability of hardware components);

3. the reduction in the frequency of a threat (or threat event) (for example, the safeguard called Training is expected to reduce the frequency of the threat of Errors).

Not only is a safeguard intended to reduce ALE, but it must do it in a cost-effect way. RiskWatch II for Windows considers all possible safeguards and their impact on the overall system. For each, in turn, a full Cost-Benefit Analysis (CBA) is performed.

This analysis uses the reduction in ALE, expected annually, as the benefit and the initial and maintenance costs over the lifetime of the safeguard, and considers three different possible discount rates of 5,

10 and 15% to permit the calculation of the net present value of all projected figures.

In the tables below, three figures, one for each discount rate, are provided, for each safeguard,

1. the ratio of Total Benefits over Total Costs;

2. the annualized Rate of Return on Investment obtained by dividing this ratio by the number of years involved;

3. the Pay-back Period - the year in which accumulating benefits overtake the (initially greater) accumulating costs.

The degree to which each safeguard may already be implemented can be derived from the responses to the questions, in each area of vulnerability, that pertain to a particular safeguard.

1. Summary of safeguards

The tables below show information about each of the safeguards considered by RiskWatch. It is sorted on the basis of the annualized Rate of Return on Investment (ROI) using Discount Rate of 10%.

The twelve numeric columns are, respectively,

1. the lifetime of the safeguard in years (Lifetime)

2. the initial cost (Initial Cost)

3. the annual maintenance cost (Maint. Cost)

4. the Basic Ratio of Total Benefits to Total Costs for Discount Rate 5% (B/C-5%)

5. the Annualized ROI with Discount Rate 5% (RoI-5%)

6. the Pay-back Period with Discount Rate 5% (PP-5%)

7. the Basic Ratio of Total Benefits to Total Costs for Discount Rate 10% (B/C-10%)

8. the Annualized ROI with Discount Rate 10% (RoI-10%)

9. the Pay-back Period with Discount Rate 10% (PP-10%)

10. the Basic Ratio of Total Benefits to Total Costs for Discount Rate 15% (B/C-15%)

11. the Annualized ROI with Discount Rate 15% (RoI-15%)

12. the Pay-back Period with Discount Rate 15% (PP-15%).

Safeguards	Lifetime	Initial Cost	Maint. Cost
Application Controls	3	$50,000.	$50,000.
Security Policy	3	$70,000.	$40,000.
Data Encryption	5	$500,000.	$500,000.
Personnel Clearances	1	$50,000.	$100,000.
Risk Analysis	3	$100,000.	$30,000.
Physical Access Control	3	$2,000,000.	$500,000.
Detection System	3	$1,000,000.	$200,000.
Quality Assurance	5	$400,000.	$300,000.
Classification Markings	3	$500,000.	$50,000.
Life Cycle Management	1	$200,000.	$0.
Personnel Control	3	$200,000.	$100,000.
Passwords/Authenticaion	5	$40,000.	$200,000.
Contract Specifications	1	$50,000.	$100,000.

Safeguards	B/C-5%	ROI-5%	PP-5%
Application Controls	10.11	3.37	1
Security Policy	5.30	1.77	1
Data Encryption	5.09	1.02	1
Personnel Clearances	0.17	0.17	0
Risk Analysis	0.20	0.07	0
Physical Access Control	0.03	0.01	0
Detection System	0.03	0.01	0
Quality Assurance	0.02	0.00	0
Classification Markings	0.01	0.00	0
Life Cycle Management	0.00	0.00	0
Personnel Control	0.00	0.00	0
Passwords/Authenticaion	0.00	0.00	0
Contract Specifications	0.00	0.00	0

Safeguards	B/C-10%	ROI-10%	PP-10%
Application Controls	10.11	3.37	1
Security Policy	5.25	1.75	1
Data Encryption	5.09	1.02	1
Personnel Clearances	0.17	0.17	0
Risk Analysis	0.19	0.06	0
Physical Access Control	0.03	0.01	0
Detection System	0.03	0.01	0
Quality Assurance	0.02	0.00	0
Classification Markings	0.01	0.00	0
Life Cycle Management	0.00	0.00	0
Personnel Control	0.00	0.00	0
Passwords/Authenticaion	0.00	0.00	0
Contract Specifications	0.00	0.00	0

Safeguards	B/C-15%	ROI-15%	PP-15%
Application Controls	10.11	3.37	1
Security Policy	5.20	1.73	1
Data Encryption	5.09	1.02	1
Personnel Clearances	0.17	0.17	0
Risk Analysis	0.19	0.06	0
Physical Access Control	0.03	0.01	0
Detection System	0.03	0.01	0
Quality Assurance	0.02	0.00	0
Classification Markings	0.01	0.00	0
Life Cycle Management	0.00	0.00	0
Personnel Control	0.00	0.00	0
Passwords/Authenticaion	0.00	0.00	0
Contract Specifications	0.00	0.00	0

The following table shows the safeguards with the 10 greatest Return on Investment (ROI-10%). Also shown are the Initial and Maintenance Costs of those safeguards. Following the table are barcharts and piecharts of the costs.

Safeguards	ROI-10%	Initial Cost	Maint. Cost
Application Controls	3.37	$50,000.	$50,000.
Security Policy	1.75	$70,000.	$40,000.
Data Encryption	1.02	$500,000.	$500,000.
Personnel Clearances	0.17	$50,000.	$100,000.
Risk Analysis	0.06	$100,000.	$30,000.
Physical Access Control	0.01	$2,000,000.	$500,000.
Detection System	0.01	$1,000,000.	$200,000.
Quality Assurance	0.00	$400,000.	$300,000.
Classification Markings	0.00	$500,000.	$50,000.
Life Cycle Management	0.00	$200,000.	$0.

Initial costs

Physical Access Control Detection Syst em Data Encryption

Classification Markings Quality Assurance

Life Cycle Management

Risk Analysis

25 50 75 100 125 150 175 200 (x 10 ,000 )

Dollars

Security Policy Application Cont rols Personnel Clearances

5 10 15 20 25 30 35 40 45 50 55 60 65 70 (x1,000)

Dollars

Physical Access Control (41.1%)

Personnel Clearances (1.0%) Application Cont rols (1.0%) Security Policy (1.4%)

Risk Analysis (2.1%)

Life Cycle Management (4.1%) Quality Assurance (8.2%)

Classification Markings (10.3%)

Data Encryption (10.3%)

Detection System (20.5%)

MAINTENANCE COSTS

Physical Access Control

Data Encryption Quality Assurance Detection Syst em Personnel Clearances Application Cont rols Classification Markings

Security Policy Risk Analysis

5 10 15 20 25 30 35 40 45 50 (x10,000)

Dollars

Physical Access Control (28.2%)

Data Encryption (28.2%)

Risk Analysis (1.7%)

Security Policy (2.3%)

Classification Markings (2.8%) Application Cont rols (2.8%) Personnel Clearances (5.6%)

Detection System (11.3%)

Quality Assurance (16.9%)

SAFEGUARD DEFINITIONS

ACCESS CONTROL - The Access Control safeguard refers to the existence of a verifiable and coordinated access control system. The system can range from simple (key lock systems) to complex (cypher/key card identification systems).

APPLICATION CONTROL STANDARDS - Application control refers to a specific system of controls designed by a team of internal auditors to ensure that universal programming standards, data element dictionaries and record association conventions are maintained.

AUDIT TRAILS - The safeguard of Audit Trails refers to the organization having a fully implemented audit trail capability so that it is simple to track which user was accessing any system at any point in time.

CLASSIFICATION MARKING - The safeguard of Classification Marking refers to having all media and reports containing information which is classified as Classified, Sensitive, or Privacy Act data marked on the top and bottom of each page.

CONTINGENCY PLAN - The Contingency Plan is also known as a Continuity of Operations Plans (COOP), or as a Disaster Recovery Plan; and it contains a detailed blueprint of backup procedures to be followed in case of emergency disruption to the ADP facility, as well as a guide to getting the programs operational as quickly as possible.

CONTRACT SPECIFICATIONS - The Contract Specification safeguard refers to the practice of requiring each contractor to include as a formal contract deliverable, a plan for including appropriate security controls, addressing of pertinent threats, and possible loss quantification.

DATA ENCRYPTION - This safeguard involves the application of encipherment techniques to one or more datasets or to data traveling over communications systems.

DETECTION SYSTEM - The Detection System safeguard refers to having a coordinated fire detection/access control violation system which will alert the proper authorities to smoke, heat, water, humidity fluctuations, grounding problems, as well as monitoring any attempt at unauthorized access.

DOCUMENTATION - The Documentation safeguard refers to the need for the organization to provide backup documentation for every file, program, and process; including providing hard copies retained in a safe location.

ELECTRICAL POWER CONDITIONING - The Electrical Power Conditioning safeguard refers to the establishment of a stable sources of electrical power, including a consideration of a source of uninterruptable power, backup generators, as well as consideration of phase-balancing to prevent power fluctuations.

EMERGENCY RESPONSE - The emergency response safeguard deals with a having a detailed guide of how the organization can continue to operate in the event of large scale emergencies, such as chemical spills, civil disobedience, or nuclear mishaps.

FILE/PROGRAM CONTROL - The safeguard of File/Program Control refers to the practice of establishing a system of access controls and authorizations for programs and files based on "need to know".

FIRE SUPPRESSION SYSTEM - The Fire Suppression safeguard refers to the appropriate combination of water and CO2 which should be installed in any ADP facility.

GROUNDING SYSTEM - The Grounding System safeguard refers to provision for proper electrical grounding for all equipment, including lightning arrestors; a separate grounding system for all signal cables. For sites processing classified information, a local low resistance ground is required.

INSURANCE - Insurance policies should be considered as a safeguard for situations where other types of safeguards may not be currently available or cost-effective. Financial institutions should consider bonding insurance for key personnel.

LIFE CYCLE MANAGEMENT - The safeguard of Life Cycle Management refers to the adoption of a formal, written plan for all systems, including security and audit controls, This plan should address general management, personnel, organizational, system design, data center management, and computer applications controls.

MATERIAL SEGREGATION - The Material Segregation safeguard refers to the procedure of separating Classified, Sensitive and Privacy Act data from all other material in order to guard against inadvertent disclosure.

MONITOR SYSTEM - The Monitoring System safeguard refers to having an effective system in place which covers checking of remote sites, critical components, operational status of various programs and applications as well as sensitive operational areas.

NEW CONSTRUCTION - The New Construction safeguard covers a variety of considerations which should be reviewed for any new facility. These include, but are not limited to, use of fire retardant and low combustion building materials, use of floor-to-ceiling walls, automatic vent closures, inside hinges on doors and windows, and proper drainage.

OFFICE OF PRIMARY RESPONSIBILITY (OPR) - An Office of

Primary Responsibility (OPR) should be designated for each data base, data file, and removable media containing data or programs, The OPR designation is necessary to ensure integrity of data files and accuracy of their contents.

OPERATING PROCEDURES - The safeguard of operating procedures refers to having a monitoring program in place in order to determine the effectiveness and efficiency of the system's operating procedures, as well as a method of monitoring that these procedures are continuously upgraded.

ORGANIZATIONAL STRUCTURE - Organizational structure refers to the safeguard of having the organization not only staffed, but also responsive to the need for redundancy of critical job functions and that the necessary guidelines are in place to ensure functional separation of duties.

PASSWORDS - The safeguard of Passwords refers to the organization having an effective policy of user passwords which should be fully implemented for every system.

PERSONNEL CLEARANCE - The Personnel Clearance safeguard refers to having an organizational policy governing personnel clearance in which each individual must have a security clearance of equal or greater classification than the highest level of data processed in the system they are accessing. This safeguard also includes background investigation of all employees.

PERSONNEL CONTROL - The safeguard of Personnel Control refers to the organization having proper procedures for automatic background checks, authority based on "need to know" criteria, as well as timely method for updating personnel records when individuals are reassigned, transferred or discharged.

PREVENTIVE MAINTENANCE - The Preventive Maintenance safeguard refers to having an effective maintenance program in place which should include all computer hardware, generators, air conditioning equipment, grounding systems, lightning arrestors, fire systems and structured components such as vent closures, floor plates, doors, etc.

PROPERTY MANAGEMENT - The Property Management safeguard refers to the organization having a comprehensive and effective program for property inventory control, allocation and accountability.

QUALITY ASSURANCE - The safeguard of Quality Assurance refers to the formal establishment of a program which will regularly monitor (and find ways to improve) programming quality, user error, communication ability, etc.

REDUNDANT POWER - The safeguard of Redundant Power refers to having a secondary independent source of electrical power to backup the primary power source.

REVIEW OF SENSITIVE APPLICATIONS - The safeguard of Review of Sensitive Applications refers to the need of the organization to conduct a formal risk assessment of each

Sensitive Application program on a regular basis.

RISK ANALYSIS - The safeguard of Risk Analysis refers to the organization having recently conducted a formal risk assessment of each major system and application program.

SECURITY CLASSIFICATION - The Security Classification safeguard requires that each activity have policies in place addressing the proper classification of sensitive materials, including a receipt program, and general handling procedures for all sensitive and classified materials.

SECURITY PLAN - The Security Plan refers to the existence of a document which defines the tasks and charges of the security organization; as well as planning the security procedures necessary for the protection of the organization.

SECURITY POLICY - Security policy refers to the existence of written, defined guidelines which dictate how the organization manages its resources and protects them from both internal and external threats.

SECURITY STAFF - The Security Staff refers to the individuals in the organization who maintain or manage security tasks, as well as addressing full-time security staff, include managers who have part-time security responsibilities for the resources they manage.

SYSTEM SECURITY TEST AND EVALUATION (SST&E) - The safeguard

of SST&E (System Security Test and Evaluation) refers to the organization having a formal procedure to test each individual safeguard for effectiveness and accuracy.

SYSTEM VALIDATION - The System Validation safeguard refers to the practice of ensuring that the operating system contains only approved code; and that changes to the operating system are accounted for, are verified, and are transmitted in a secure and acknowledged mode.

TECHNICAL SURVEILLANCE - This safeguard is applicable to Classified environments and refers to a (possibly external) organization that can conduct a survey to identify potential security problems.

TEMPEST SURVEY - This safeguard is applicable to Classified environments and refers to the gathering of information, by inspection or survey, about all instrumentation and sites that store or process classified information.

TRAINING - The training safeguard refers to the organization having a written implemented program for security training of new employees, and security awareness programs for current employees.

VISITOR CONTROL - The visitor control safeguard refers to ensuring that visitors to a facility are monitored twenty- four hours a day, that an audit trail of visitors exists and that this official record is maintained for at least two years.

WATER DRAINAGE - The Water Drainage safeguard refers to ensuring that the facility is equipped with a drainage system so that water from broken pipes, water from activated sprinkler systems or water used in fire fighting can be easily and effectively drained from the facility.

VULNERABILITY DISTRIBUTION REP0RT

Those individual questions that indicate the largest degree of perceived vulnerability, as tallied from the responses, are shown below.

Following each question is its associated area of vulnerability.

1. Sensitive information is not transmitted electronically over public communication media unless it has been appropriately encrypted or proper authentication of user is achieved?

Vulnerability Area: Disclosure

2. The requirements for the security organization are reflected in an applicable position description?

Vulnerability Area: Policy

3. The organization has a viable, verifiable system of accountability and control for all equipment and material entrusted to the organization?

Vulnerability Area: Accountability

4. The organization provides protection of staff from hostile clients?

Vulnerability Area: Policy

5. The organization has established confidentiality policy and has issued directives, guidelines and operating procedures?

Vulnerability Area: Privacy Act

6. Water detectors are located under raised floors?

Vulnerability Area: Reliability

7. Error checking software is used when performing file transfers using networks?

Vulnerability Area: Data Integrity

8. There is continuous accountability and control for all equipment and materials maintained by the organization?

Vulnerability Area: Accountability

9. The organization has a written computer security policy?

Vulnerability Area: Policy

10. Visitor Logs are always used, maintained and retained for a minimum period of two (2) years?

Vulnerability Area: Access Control

11. The facility has a source of quality electrical power so that it does not experience excessive down time as a result of power fluctuations, power reductions, brownouts, power outages and blackouts?

Vulnerability Area: Reliability

12. The placement of the system security officer within the organization has been reviewed and evaluated to ensure effective and unfiltered reporting structure?

Vulnerability Area: Policy

13. All data files are accounted for on servers or systems?

Vulnerability Area: Accountability

14. Written consent is required and identifies other networks before enabling connection or interconnection?

Vulnerability Area: Administration

15. The organization has a space formulation standard that provides adequate environment and elevates space concerns to management for review and requested modifications?

Vulnerability Area: Policy

16. Employees have sufficient and appropriate furniture, equipment and supplies to perform their job functions efficiently?

Vulnerability Area: Administration

17. When an employee notifies of quitting, or is about to be terminated, the supervisor notifies Security when the action becomes known?

Vulnerability Area: Access Control

18. There are at least two independent sources of power available to the computer system and the facility?

Vulnerability Area: Reliability

19. 3rd party security software is not used in conjunction with the network?

Vulnerability Area: Data Integrity

20. All communication lines are uniquely identified?

Vulnerability Area: Accountability

21. The organization has implemented policy and guidelines for background checks, investigations and surety programs for new applicants, system users, sensitive operations staff and for verification of contractor personnel clearances?

Vulnerability Area: Policy

22. Communication support equipment such as controllers and modems are located in secure areas?

Vulnerability Area: Access Control

23. The computer room walls, doors, windows, etc., are designed, constructed and/or installed to specifications that would minimize the possibility of access from adjacent areas or from the outside of the facility?

Vulnerability Area: Access Control

24. The organization has attempted to increase performance, and reduce costs by selectively purchasing advanced hardware and software?

Vulnerability Area: Policy

25. The agency security staff is responsible for ensuring that all personnel who install, operate, maintain, or use the computer systems have access authorization?

Vulnerability Area: Access Control

26. Emergency power-off switches for the computers and other equipment are adequately protected to prevent accidental shutdown?

Vulnerability Area: Reliability

27. The network (NOS) system files are kept in a protected directory or are encrypted by the system (i.e. password files, configuration files, etc.)?

Vulnerability Area: Disclosure

28. There is adequate interior and exterior lighting for the facility during non-daylight hours, and doors and windows have adequate locking devices?

Vulnerability Area: Access Control

29. The organization has a current and effective Life Cycle Management Plan (LCMP) to ensure that the systems meet specified requirements with appropriate internal controls?

Vulnerability Area: Policy

30. Password modification is required by the Network Operating System?

Vulnerability Area: Access Control

31. The facility has adequate electrical power that meets or exceeds local needs and codes?

Vulnerability Area: Reliability

32. All supervisors immediately notify the Security Representative of all transfer and employment termination?

Vulnerability Area: Access Control

33. Log-on, system commands, and on-line transaction documentation manuals placed in a secure area when not in use?

Vulnerability Area: Documentation

34. Supporting utilities such as electrical power, air conditioning, natural gas, fuel, water and communication systems are provided with appropriate security?

Vulnerability Area: Reliability

35. Users, networks and computer systems accessing any network take all precautions necessary to protect the networks?

Vulnerability Area: Access Control

36. Sufficient water proof sheets are available for covering computer equipment in an emergency situation?

Vulnerability Area: Reliability

37. The water cooling system is protected from sabotage attempts?

Vulnerability Area: Reliability

38. All network connections via dial-up facilities are managed, controlled and secure?

Vulnerability Area: Access Control

39. Door hinges are installed on the inside of the door or are pinned/welded when installed on the outside to prevent door removal?

Vulnerability Area: Access Control

40. Written policy exists which defines adequate backup frequency and retention periods for backup data?

Vulnerability Area: Policy

41. All external user, network or system access to mission-critical AIS resources are performed through a C2-designated resource?

Vulnerability Area: Access Control

42. All work areas (local and remote) are equipped with security systems?

Vulnerability Area: Access Control

43. The program security staff is responsible for investigating and resolving all computer security incidents?

Vulnerability Area: Policy

44. New communication links are approved by the Security Officer?

Vulnerability Area: Evaluation

45. Reproduction facilities and copy machines are secured or locked to prevent abuse?

Vulnerability Area: Accountability

46. A quantitative risk analysis required by current directives has been performed within the past three years?

Vulnerability Area: Evaluation

47. There is documentation that demonstrates that all network systems are approved by management?

Vulnerability Area: Policy

48. The Program Security Officer has prescribed the security measures to be used at each workstation and work area?

Vulnerability Area: Policy

49. The facility has been audited for security within the last twelve months?

Vulnerability Area: Evaluation

50. Management strives to reduce employee turnover by retaining qualified personnel through fair promotion policies?

Vulnerability Area: Policy

The areas of vulnerability associated with the questions above are shown below, ranked according to the number of questions in each.

Following the table is a chart indicating the relative importance of each area of vulnerability, as determined from the question set.

Vulnerability Areas Number of Questions

1. Access Control 13

2. Policy 13

3. Reliability 8

4. Accountability 5

5. Evaluation 3

6. Administration 2

7. Data Integrity 2

8. Disclosure 2

9. Privacy Act 1

10. Documentation 1

Access Control (26.0%)

5 Others (16.0%)

Evaluation (6.0%)

Accountability (10.0%)

^{Policy (26.0%)} Reliability (16.0%)