Project 2 - Comprehensive Risk Rating System (CRRS)

Project-2: Comprehensive Risk Rating System (CRRS):

Agenda of the Project:

• Explanation about Risk and detail about Risk formula.
• Find the vulnerability and Impact of each component were place in Online Bank Security Boundary.
• Calculate the Risk of Security components using Risk formula.
• Average total Risk find in security components in Security boundary.

Introduction:

Comprehensive Risk Rating System CRRS:

A Comprehensive Risk Rating System (CRRS) is a system used to assess and quantify the risk associated with a particular activity or asset. It evaluates risk on multiple levels, such as economic, legal, political, environmental, social, and technological, in order to provide an accurate assessment of the potential risk related to a particular venture.

The CRRS typically uses a combination of methods, including quantitative and qualitative analysis, to generate an overall risk score. This score can then be used to identify and prioritize areas where risk management measures are needed. The CRRS can also be used to inform decision-making and provide insight into how certain risks may affect the overall portfolio.

Risk in Security Components:

The risk that a vulnerability or set of vulnerabilities poses to an organization or system. It involves identifying the potential impact of the vulnerability and the likelihood of it being exploited and using this information to calculate a risk score. This score can then be used to prioritize the vulnerabilities and determine the necessary steps to mitigate them. Risk calculation includes factors such as the cost of exploiting the vulnerability, the probability of the exploit, and the potential impact on the organization or system.

Formula: Risk = Vulnerability * Impact

Risk calculation of Security Components using table format:

Table:

1. First Component or Asset:

a). Name of Assets: Bank’s Website (www.mybanking.com)- The website is developed using java technology using secure standard coding and data sanitized.

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are

• CVE-2020-14750: Apache Struts (struts.apache.org)
• CVE-2020-14882: Oracle WebLogic (oracle.com/middleware/weblogic)
• CVE-2020-14889: Spring Framework (spring.io)
• CVE-2020-14900: Eclipse Jetty (eclipse.org/jetty)
• CVE-2020-14910: Oracle Java SE (oracle.com/java)

c). Note/assumption: Not Applicable (NA).

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Marginal rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Marginal and Vulnerability is Unlikely

So, Risk = Marginal * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk1 = 7

2. Second Component or Asset:

a). Name of Assets: Cisco ISE (Identity Service Engine) ASA Series – Used as Authentication and Authorization of user side.

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2019-1939: Cisco Identity Services Engine Denial of Service Vulnerability
• CVE-2020-3229: Cisco Identity Services Engine Remote Code Execution Vulnerability
• CVE-2020-3228: Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerability
• CVE-2018-0421: Cisco Identity Services Engine Remote Command Execution Vulnerability
• CVE-2018-0420: Cisco Identity Services Engine Information Disclosure Vulnerability

c). Note/assumption: This Cisco ISE is used as entry level security for authentication and authorization.

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Possible rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Critical and Vulnerability is Possible.

So, Risk = Critical*Possible

Risk = High

The Medium is denoted the value as 8, Risk2 = 8

3. Third Component or Asset:

a). Name of Assets: Cisco Firewall ASA Series – Used block incoming and outgoing threats

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2019-1653: Unauthenticated Remote Code Execution Vulnerability in Cisco Adaptive Security Appliance (ASA).
• CVE-2019-1861: Cisco ASA Software IKEv1 and IKEv2 Denial of Service Vulnerability.
• CVE-2018-0296: Cisco ASA and FTD Software Remote Code Execution Vulnerability.
• CVE-2018-15454: Cisco ASA SSL/TLS Denial of Service Vulnerability.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Critical and Vulnerability is Unlikely.

So, Risk = Critical * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk3 = 7

4. Forth Component or Asset:

a). Name of Assets: Juniper IPS/IDS – Junos OS Released 17.3R1

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2018-0050: Junos OS Multiple vulnerabilities in Juniper Network Connect/Pulse Secure SSL VPN
• CVE-2018-0045: Junos OS Privilege escalation in Juniper Network Connect/Pulse Secure SSL VPN
• CVE-2018-0043: Junos OS Denial of Service vulnerability in Juniper Network Connect/Pulse Secure SSL VPN
• CVE-2018-0040: Junos OS Improper authentication in Juniper Network Connect/Pulse Secure SSL VPN
• CVE-2018-0039: Junos OS Unauthorized access vulnerability in Juniper Network Connect/Pulse Secure SSL VPN

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Critical and Vulnerability is Rare.

So, Risk = Critical * Rare

Risk = Medium

The Medium is denoted the value as 7, Risk4 = 7

5. Fifth Component or Asset:

a). Name of Assets: Cisco Virtual Protocol Network (VPN) ASA series – Encrypt Network

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2018-0289: Cisco ASA Software TCP State Bypass Vulnerability
• CVE-2018-0285: Cisco ASA Software IKEv1 and IKEv2 Denial of Service Vulnerability
• CVE-2018-0310: Cisco ASA Software IPv6 Fragment Handling Denial of Service Vulnerability
• CVE-2018-0299: Cisco ASA Software AnyConnect Secure Mobility Client Denial of Service Vulnerability

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Minor rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Minor and Vulnerability is Rare.

So, Risk = Minor * Rare

Risk = Low

The Medium is denoted the value as 6, Risk5 = 6

6. Sixth Component or Asset:

a). Name of Assets: Web-Server Application (Apache2.0) – Proxy request and manage load on server

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2019-0211: Apache HTTP Server mod_proxy_ftp Denial of Service Vulnerability
• CVE-2018-1312: Apache HTTP Server mod_auth_digest Access Restriction Bypass
• CVE-2017-9789: Apache HTTP Server mod_mime Remote Code Execution Vulnerability

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Catastrophic rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Catastrophic and Vulnerability is Unlikely.

So, Risk = Catastrophic * Unlikely

Risk = High

The Medium is denoted the value as 8, Risk6 = 8

7. Seventh Component or Asset:

a). Name of Assets: Oracle Database (Version 11.2.0) – Database storage using ASE encryption.

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2016-0020: DBA privileges to bypass authentication when connecting to the database.
• CVE-2016-0021: DBA privileges to bypass authentication when connecting to the database.
• CVE-2016-0022: DBA privileges to execute arbitrary code without authorization.
• CVE-2016-0023: DBA privileges to access arbitrary files without authorization.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Critical and Vulnerability is Unlikely.

So, Risk = Critical * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk7 = 7

8. Eight Component or Asset:

a). Name of Assets: IBM Guardian (Protection 11.5) – Monitoring the activities on the database

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2020-4444: Network access to execute arbitrary code via a specially crafted request.
• CVE-2020-4453: Network access to bypass authentication and gain access to a restricted resource.
• CVE-2020-4456: Network access to bypass authorization checks and gain access to privileged resources.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Marginal rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Impact * Vulnerability)

In this the Impact is Marginal and Vulnerability is Rare.

So, Risk = Marginal * Rare

Risk = Low

The Medium is denoted the value as 7, Risk8 = 6

Conclusion:

The Average Risk Calculation: Overall Risk Calculation of Security Assets the formula is,

The Assets with Risk Calculation are,

• Website Domain Risk1 = 7
• Cisco ISE Risk2 = 8
• Cisco Firewall Risk3 = 7
• Juniper IPS/IDS Risk4 = 7
• Cisco VPN Risk5 = 6
• Apache2.0 Webserver application Risk6 = 8
• Oracle Database Risk7 = 7
• IBM Guardian Risk8 = 6

Formula: Overall Risk = (risk1+ risk2 + .... + riskn) / (total no of assets posing risk)

7+8+7+7+6+8+7+6 / 8

56/8 = 7

The Overall risk calculation in the security components and Assests is 7 (Medium).