Question

For each of the following assets, assign a low, moderate, or high impact level for the loss of confidentiality, availability, and integrity, respectively. Justify your answers.

a. An organization managing public information on its Web server.
b. A law enforcement organization managing extremely sensitive investigation information.
c. A financial organization managing routine administrative information (not privacy-related information).
d. An information system used for large acquisitions in a contracting organization contains both sensitive, pre-solicitation phase contract information and routine administration information. Assess the impact for the two data sets separately and the information as a whole.
e. A power plant contains a SCADA (supervisory control and data acquisition) system controlling the distribution of electric power for a large military installation.The SCADA system contains both real-time sensor data and routine administrative information. Assess the impact for the two data sets separately and the information system as a whole.

Answer 1

a.

Organization managing public information on its web server:

Confidentiality:

Web server contains the public information. So everyone can access that information.

So there is no confidentiality is provided.

So impact of confidentiality level is low

Integrity:

Server maintains public information. So there may be anyone can modify that is either authorized user or intruder.

So impact of integrity level is moderate.

Availability:

Loss of information is not a biggest issue in this server.

So impact of availability level is moderate.

b.

Confidentiality:

Web server contains the sensitive information. If any of data loss is occurred then it gives high loss.

So impact of the confidentiality level is high.

Integrity:

Server maintains private information. If any modifications occurred it gives huge loss

So impact of integrity level is high.

Availability:

Information is only available to organization that is stored at a single location.

So impact of availability level is high.

c.

Organization managing public information on its web server:

Confidentiality:

Web server contains only routine information not privacy related information. So everyone can access that information.

So there is no confidentiality is provided.

So impact of confidentiality level is low

Integrity:

Server maintains routine information. If data loss is occured , it is not a big issue.

So impact of integrity level is low.

Availability:

Loss of information is not a biggest issue in this server.

So impact of availability level is low.

d.

Security contact information:

Confidentiality:

Web server contains private information that is pre solicitation phase contract information only.

So impact of confidentiality level is low

Integrity:

Loss data is not a huge problem.

Therefore impact of integrity level is moderate.

Availability:

Loss of availability is not a huge.

Therefore impact of availability level is low

Routine administrative information:

Confidentiality:

Web server does not contain private information.

So impact of confidentiality level is low

Integrity:

Loss data is not a huge problem.

Therefore impact of integrity level is low.

Availability:

Loss of availability is not a huge.

Therefore impact of availability level is low.

e.

Real time sensor information:

Confidentiality:

Web server maintains real time information. So loss of confidentiality is not a big problem.

So impact of confidentiality level is low

Integrity:

Web server provides exact data is necessary. So there is no modification allowed

Therefore impact of integrity level is high.

Availability:

Data availability is required at any time.

Therefore impact of availability level is high.

Routine administrative information:

Confidentiality:

Web server does not contain private information.

So impact of confidentiality level is low

Integrity:

Loss data is not a huge problem.

Therefore impact of integrity level is low

Availability:

Loss of availability is not a huge.

Therefore impact of availability level is low.