Question

Identify two threat sources, one adversarial and one non-adversarial, that could exploit a vulnerability to your workplace or your school that would result in a disruption of service. An adversarial event is the intentional exploitation of a vulnerability by criminal groups, terrorist, bot-net operators, or disgruntled employees. A non-adversarial event is the accidental exploit of a vulnerability, such as an undocumented process, or accidental behavior. For each (using your best judgment), answer the following question:

What is the threat?

What is the threat source?

Is the source adversarial or non-adversarial? Provide a description

What vulnerability could be exploited?

How likely is the threat source to be successful and why?

If the threat source is successful, what is the extent of the damage caused?

Answer 1

Answer -

• Consider threat of obtaining protected customer data by unauthorized ways.
• The two threat sources are -

i) Adversarial event - Cyberattacks

ii) Non-adversarial event - A database connection unintentionally left open.

• The above source is adversarial. The cyber attackers are fond of accessing the confidential data with the intent to cause harm. If the cyber attackers do this then it would result into reputational damage, regulatory penalties and loss of future revenue.
• The information system that stores the data is facing the Internet which is the vulnerability.
• If there are no security measures in place, then there would be no restrictions on accessing data.
• If the threat source is successful there would be successful penetration into the security measures and could be a disastrous harm.