Expendability is the third vector to assess exploit ability.
You have to answer the question How easy is it to conduct the attack.
As it was the case with reproducibility if the attack requires expert knowledge or lots of money we
estimate the risk is zero.
If it can be conducted by an average trained attacker the risk failure would be five.
If the attack was fully automatic We would estimate its risk at 10.
The fourth factor concerns affected users this issue is very often ignored.
I.T. specialists usually work in small teams where everyone is well acquainted with new technologies
working in such an environment makes it hard to imagine the consequences of a situation in which a small
malfunction affects 500 or 1000 users at the same time.
Let's imagine that the attacker tried to defeat passwords of a thousand users through an algorithm that
automatically tries out well known phrases multiple unsuccessful attempts will block the user's accounts
such a simple large scale attack creates a huge problem for the whole department or for the whole company.
As before we should assign the fourth factor a certain value zero.
If the attack affected a small group of users 5 if it affected one department 10 if a considerable group
of users of in-system were affected
discoverability factor allows us to assess how hard it is to say with certainty that the system has
been compromised.
Some viruses and noisy port scanning methods are easily discovered.
Every administrator could detect them while reviewing event logs or when users point out a specific
problem such as a system slowdown
discoverability of such an attack would be assigned a value of zero.
It should be given a 5 if the attacker requires additional operations to be discovered.
Such operations may include reviewing the cycle of operations of a user or the attacker.
If the attack doesn't get discovered at all or it requires specialist tools to do so the risk would
be assigned the value of 10.
In practice assessing a threat using the dreaded model allows us to create a table similar to the one
you can see in the slide.
We add the values we assign to the individual risk factors for every kind of threat from the list we
prepared in previous modules.
The list was created on the basis of analysis of system resource system access points and the possibility
of resource loss.
We divide the sums by 5.
And in our case the results we get are 8 5 and 7 on the basis of these numbers we assign each threat
a different priority level.
One of the threats to our computer system comes from the fuel injection which could give the attacker
access to confidential information in the database.
It's a frequent attack and many applications are susceptible to it.
In our simulation using the drug model I assigned this threat the highest level of risk and priority
such an attack would be characterized by high exploit ability.
Reproducibility is also considerable because in order to prevent the attack in the future you would
have to modify the application which administrators can't do.
A firewall doesn't provide much protection against the attack.
The number of the affected users is considerable.
Because this is an application layer attack far above the level our security solutions pertain to.
It's discoverability is low resigned to the threat the highest level of risk and give it a corresponding
priority.
The threat from an attack that consists of hijacking the HTP session between the browser and the web
server was assessed as low.
This is a hypothetical situation that should be easily discovered
you can detect it by checking the validity of the certificate of the web server.
The only high risk factor for this threat is reproducibility.
If somebody has found a vulnerability that makes the attack possible it won't be difficult to repeat
it.
The dread model helps us to assess threat risk it entails susceptibility to attacks.
The point is not to avoid risk but to manage it.