Where on the chart we saw earlier in the slide should you put the threat to the side.
You can use the model called dread this model helps you to assess risk using five factors that affect
it.
The first factor is damage potential.
The second is reproducibility how easy it is to reproduce the attack.
If we assess the vulnerability of a computer system we often mention that third factor First this is
exploit ability we often assume that old non updated systems are the most vulnerable or most exploitable.
They are indeed vulnerable.
But this is only one of the factors you have to take into consideration.
The next is affected users.
Defines the scale of impact of the attack whom it will affect.
And the last factor is discoverability it informs us how hard it will be to discover or detect the attack
each factor of dread is assigned a value.
To divide the total value easily the individual numbers assigned could be 1 5 and 10
each threat is assessed against every factor of risk the individual values are summed up and the total
is divided by the number of factors.
That is by 5.
The result you get is the measurement of risk such assessments can help us prioritize actions in order
to limit the risk or to completely eliminate it numerical values will help us judge which threat we
should tackle first because it will clearly indicate the level of risk
let's consider individual factors in more detail.
The first one is damage potential to assess damage potential.
You have to estimate the costs that could arise from the potential resource loss.
Let's stick to the basic classification that assigns threats the values of 0 5 and 10.
Let's assume that a resource loss makes a certain function of a certain application unavailable.
For example it may be a function that allows the user to make yearly settlements.
If this function became unavailable in December when it's not needed anyway we estimate his value at
0.
If the resource loss concerned the whole department for example if it resulted in the lack of connection
with a certain operating server we would estimate its value at 5.
On the other hand if the result was that the company e-mail server was blocked and none of the employees
could send or receive e-mails we would give it a 10.
The second factor is reproducibility to assess reproducibility.
You have to answer the question How easy is it to reproduce the attack.
If we were victims of a sophisticated attack which required expert knowledge or quite simply luck we
would estimate the reproducibility value at zero.
This is easy to visualize on the axis of time and security updates.
There are operating systems or applications whose vulnerabilities have not yet been discovered.
Let's imagine that there are yet no exploits that could take advantage of a certain glitch in application
security in such cases.
The attack is only possible if the attacker writes a completely new hostile code all by himself.
The odds of repeating the exact same tag are zero.
After a couple of days or weeks the information about the glitches spread on the Internet there is still
no ready made exploits which would make the attack automatic what is already available though.
It's a security update which makes it easier to conduct the attack in such cases we would estimate the
risk at 5 after the next couple of weeks.
Exploits that is viruses that can automatically use the security glitch become available.
Now we would estimate the reproducibility risk at 10.