Layers Attacks Vulnerability Security Privacy

Phishing attack Invalidated Redirects and

Forwards

Hacking Improper Input Validation User can control device may

Lack of Rate Limiting change reading/
Lack of Data Encryption
Researchers at a
User Interface/ cybersecurity firm say they
have identified
Application vulnerabilities in software
widely used by millions of
Layer
connected devices — flaws
that could be exploited by
hackers to penetrate
business and home
computer networks and
disrupt them.

Data theft Unpatched servers, Patient Identity may be

Ineffective passwords: theft can be used on other
social platform for shopping
purpose/privacy may be
damaged

Logic Layer Malware Design and It inject code and may

implementation flaws in damage firmware
software applications.

Database Layer Hacking Bad Code of Websites &

Web Apps

Web-hosting Ransomware Poorly written web It can blackmail patient for

application its reports

Spoofing Windows CryptoAPI

Spoofing Vulnerability'.

For making risk assessment model we have to first apply methodology then Methods, nestled inside of
frameworks, provide an approach to achieve a specific goal. Frameworks, the next inner layer in our
 process architecture matryoshka doll, provide the structure needed to implement a model (or some part
of the a model). Models, the outside layer of our doll, are an abstraction that provides a rough definition
of practices and inter-relationships needed by an organization to deliver a product or service. Models
are valuable if they are theoretically consistent, fit the real world and have predictive power

Risk Assessment using octave

Step 1: System Charaterization

1. Smart Diagnosis Environment is comprises of:

Hardware (Desktop Pc,Mobile,Medical Devices)

Software

Whereas Diagnosis Software is comprises of 4 layers

Application Layer

Logical Layer

Database Layer

Hosting Layer

Step 2: Threat Identification

Insider Threat: Motivation

Physician Monetary Gain Fraud and data theft
Unintentional Error Input of falsified data
Family Member
Sale of personal data
Unauthorized system access
Outsider Threat:
Attackers Unauthorized Data Modification Information theft
Illegal information disclosure Intrusion of privacy
Destruction of information System attacks e.g. denial of
service
System intrusion
System tampering
Unauthorized system access

Step 3: Identification of vulnerability

S.no Vulnerability Threat source Threat action

1 Invalidated redirects and forwards Outside/insider Phishing
 attack
2 Improper Input Validation Outsider Hacking
3 Lack of Rate Limiting Outside Hacking
4 Lack of Data Encryption Outsider Hacking
5 Unpatched Server Insider Data theft
6 Ineffective password Insider/outsider Data theft
7 design and implementation flaws in software applications Insider/outsider Malware

8 Bad Code of Websites & Web Apps Insider Hacking

9 Poorly written web application Outsider/insider Ransomware
10 Windows CryptoAPI Spoofing Vulnerability Outsider Spoofing
Step 4: determining Likelihood Level

High: Threat-source is highly motivated and sufficiently capable

Medium: Threat-source is motivated and capable.

Low: Threat-source lack motivation or capability.

Step 5: Impact Analysis

High: Vulnerability may harm both the Patient Data and system

Medium: Vulnerability may only harm to either Patient Data or System

Low: Vulnerability harm may not effect to system or patient data

Step 6: Risk Determination

For the likelihood levels, each are given a level of 1.0 for high, 0.5 for medium and 0.1 for low.

For the impact levels, each are given a level of 10 for high, 5 for medium and 1 for low.

For resulting matrix, 0.1 - 1 being low, 1 - 5 being medium and 6 - 10 being high

Impact
Threat Likelihood Low Medium High
High 1.0*1 1.0*5 1.0*10
Medium 0.5*1 0.5*5 0.5*10
Low 0.1*1 0.1*5 0.1*10

Risk Matrix

Impact
Likelihoo Risk level
d
1 (low) 5(medium) 10(High)
Vul#1,3,5,10 Vul#2,4,6,7 Vul#8,9

0.5(low) 2.5(medium) 5(medium

0.1(low) 0.5(medium) 1(low)

Risk assessment using Cobit

Step1: Data Collection

Activities performed notes

User Data Yes Data
interface representation represatation
layer and data must be
communication accurate
Logical Data sent to Yes Data must be
destination or sent to
data received destination
from destination securely
(Data process)
Database Data store in Yes Data must be
databases saved in
database
securly
Hosting Data is stored yes Data storeed
layer over server over server
securely

Identification of Risk

Activities Potential performe notes Causes

Risk d
User Data Phishing Yes Data Invalidated
interface representation hacking and representatio Redirects
layer and data data theft n must be and
communicatio accurate Forwards
n Improper Input
Validation
Lack of Rate
Limiting
Lack of Data
Encryption
Unpatched
servers,
Ineffective
passwords:

Logical Data sent to Malware Yes Data must be Design and

implementatio
destination or sent to n flaws in
data received destination software
from securely applications.
destination
(Data process)
Databas Data store in Hacking Yes Data must be Bad Code of
e databases saved in Websites &
database Web Apps
securly
Hosting Data is stored Ransomwar yes Data storeed Poorly written
web
layer over server e over server application
securely

Step 2: Data Analysis Phase

Potential Risk Type Risk Risk Factor
Risk Categorie
s
T1 T2 T3 Internal External
Phishing S s P Software
hacking and layer
data theft
Malware Software
Hacking Software
Ransomware Software

Risk Analysis phase

Potential Risk Risk Scenario

negative scenario Positive scenario

Phishing hacking and Blind trust on online Protect your

data theft communication computer by using
security software
Protect your accounts
by using multi-factor
authentication.
Update everything
Malware Scan your device for
malware,
Recover your
operating system
Don’t click on pop-ups
or ads about your
computer’s
performance.

Ransomware Limit the financial

return for attackers,
Reduce on-premises
exposure.

Identify Risk Frequency

Risk Risk frequency Risk magnitude Risk level

Phishing 3
Hacking 4
Data theft 3
Malware 4
Ransomware 2

Identify Risk Magnitude

Risk Risk
magnitude
Productivity Cost of Competitive legal
Response Advantage
Phishing
Hacking
Data theft
Malware
Ransomware

RISK ASSESSMENT USING NIST SP-800-30 R1

STEP 1: PREPARE FOR THE ASSESSMEN

Identify purpose

Identify scope

Identify assumption and constraints

Identify information source

STEP 2: CONDUCT THE ASSESSMENT

Identify threat source

scammer

Attackers

insider
Identify threat events
Threat events Threat event inputs
Ransomware Spam mail,masquerading,social engineering
Data theft Human error,compromised downloads Insider:
Hacking Malicious email, weblink,virus,popup
messages
phishing Email
Malware Email text, compromised website,torjan
horse

Identify vulnerability & predisposing condition

Vulnerability source of Vulnerability Predisposing Pervasive of

information severity Condition predisposing
condition
Ransomwar Poorly written web High Technical High
e application
Data theft Unpatched servers, Moderate Technical High
Ineffective passwords Low Information
related
Hacking Improper Input High Technical High
Validation Moderate Technical
Lack of Rate Limiting High Technical
Lack of Data Encryption
phishing Invalidated Redirects Low Technical High
and Forwards
Malware design and Moderate Technical and High
implementation flaws in information
software applications. related

Determine Likelihood

Likelihood of Likelihood of Over all

event initiation event likelihood
occurrence
Ransomware High Very High Very high
Data theft Moderate Moderate Moderate
Hacking High High High
phishing Moderate Low Low
Malware High Moderate Moderate
 Determine impact
Type of impact Impact affected assets maximum
Ransomware Harm to individual, Harm Direct financial cost High
to Organization, Harm to Damage to or loss of information
operation, Harm to Asset technology or equipment
Inability to perform current
functions.
- In a sufficiently timely manner.
- With sufficient confidence and/or
correctness.
- Within planned resource
constraints.
Data theft Harm to Individual, Harm Identity theft. Moderate
to Organization - Loss of Personally Identifiable
Information.
Relational harms.
- Damage to trust relationships.
- Damage to reputation

Hacking Harm to organization , Damage to reputation (and hence High

Harm to Individual future or potential trust
relationships)
Loss of Personally Identifiable
Information. Damage to image or
reputation

phishing Harm to individual Loss of Personally Identifiable Low

Information. Damage to image or
reputation
Malware Harm to asset Damage to or loss of information Low
technology or equipment

Determine Risk

Likelihood event Impact of event Risk

occurrence
Ransomware Very high High High
Data theft Moderate Moderate Moderate
Hacking High High High
phishing Low Low Low
Malware Moderate Low Low
Risk Assessment Using ISO 27005
3.2.4
risk identification
process of finding, recognizing and describing risks (3.1.3)
Note 1 to entry:
Risk identification involves the identification of
risk sources (3.1.6),
events (3.1.11), their causes and their potential
consequences (3.1.14).
Note 2 to entry:
Risk identification can involve historical data, theoretical analysis, informed and
expert opinions, and interested parties’ needs.
[SOURCE:ISO Guide 73:2009, 3.5.1, modified — "interested party" has replaced
"stakeholder" in Note 2 to entry.]
3.2.5
risk analysis
process to comprehend the nature of risk (3.1.3) and to determine the level of
risk (3.1.15)
Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.2.6) and
decisions about risk treatment (3.2.7).
Note 2 to entry: Risk analysis includes risk estimation.
[SOURCE:ISO Guide 73:2009, 3.6.1]
3.2.6
risk evaluation
process of comparing the results of risk analysis (3.2.5) with risk
criteria (3.1.7) to determine whether the risk (3.1.3) and/or its significance is
acceptable or tolerable
Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.2.7).
[SOURCE:ISO Guide 73:2009, 3.7.1, modified — “significance” has replaced
“magnitude”.]

Stage 1: Context establishment

Step 1: scope establishment
Step2: Selection of critical process
Step 3: description of evaluation criteria

Stage 2: Risk Identification

Step1: identification of assets

A01 Source code of system

A02 Database Backup
A03 Personal records
A04 Developed software
A05 Data center

Step 2: Appraisal of Critical Assets

Asset Confidentialit Integrity Availabilty
y
A0 Source code of Some 3 Plenty 4 Plenty 4
1 system
A0 Database Backup A lot 5 A lot 5 A lot 5
2
A0 Personal records A lot 5 A lot 5 A lot 5
3
A Data Center Plenty 4 Plenty 4 Plenty 4
05
A0 Data center
5

Step 3: Identification of threats

Assets Threats
A01 Source code of system Outsider and insider
threat
A02 Database Backup Insider threat Attacks
A03 Personal records Outsider threats Attacks
A04 Data center Insider/outsider Attacks

Step 4: Identification of Controls

Assets Threats Identificati
on of
Control
A0 Source code of Outsider & insider Antivirus
1 system threat
A0 Database Backup Insider threat Attacks
2
A0 Personal records Outsider threats Attacks Firewall
3
A0 Data center Insider/outsider Attacks VPN
4

Step 5: Identification vulnerability

 Assets Threats Identifica Identification of
tion of vulnerability
Control
Source Outsider & Antivirus Flaw in your code
code of insider
system threat
A0 Databas Insider Attac Poor database
2 e threat ks encryption,data base
Backup injection attack
A0 Persona Outsider Attac Firewall Phishing,ransomware
3 l threats ks ,data
records theft,hacking,malwar
e
Data Insider/ Attac VPN Vulnerable
center outsider ks application,VPN

Stage 3: Risk Estimation

Step 1: Valuation of threats probability
Asset Threats Identific Identification of Valuatio
s ation of vulnerability n of
Control threats
probabil
ity
Sourc Outsider & Antiviru Flaw in your code Imprope
e code insider s rble 2
of threat
syste
m
A0 Datab Insider Atta Poor database Eventua
2 ase threat cks encryption,data l3
Backu base injection
p attack
A0 Perso Outsider Atta Firewall Phishing,ransomw High
3 nal threats cks are,data Probabl
record theft,hacking,mal e5
s ware
Data Insider/ Atta VPN Vulnerable Probale
center outsider cks application,VPN 4

Step 2: Valuation of threats impact

 Asset Threats Identifi Identification Valuati Valuati
s cation of vulnerability on of on of
of threat threats
Control s impact
probab
ility
Sour Outsider Antivir Flaw in your Improp Serious
ce & insider us code erble 2 3
code threat
of
syste
m
A Data Insider Atta Poor database Eventu Disastr
0 base threat cks encryption,data al 3 ous 4
2 Back base injection
up attack
A Perso Outsider Atta Firewal Phishing,ranso High Catastr
0 nal threats cks l mware,data Probab ophic 5
3 recor theft,hacking,m le 5
ds alware
Data Insider/ Atta VPN Vulnerable Probal Disastr
cente outsider cks application,VP e4 ous4
r N

Stage 4: Risk Evaluation

Step 1: Risk valuation
Asse Threats Identif Identification Valua Valuat Risk
ts icatio of tion ion of calc
n of vulnerability of threat ulat
Contro threat s e
l s impac
proba t
bility
Sour Outside Antivir Flaw in your Impro Seriou 6
ce r& us code perble s3 low
code insider 2
of threat
syst
em
A Data Insider Att Poor Event Disast 12
0 base threat ack database ual 3 rous 4 med
2 Back s encryption,da ium
up ta base
injection
attack
A Pers Outside Att Firew Phishing,rans High Catast 25
0 onal r ack all omware,data Proba rophic very
3 reco threats s theft,hacking, ble 5 5 high
rds malware
Data Insider/ Att VPN Vulnerable Proba Disast 16
cent outside ack application,V le 4 rous4 med
er r s PN ium

Step 2: Identification of critical risks

Step 3: Selection of control measures