Project 2 Comprehensive Risk Rating System (CRRS)

Project-2: Comprehensive Risk Rating System (CRRS)

Aim of the Project:

• Explanation about Risk and detail about Risk formula.

• Find the vulnerability and Impact of each component were place in Online Bank Security Boundary.

• Calculate the Risk of Security components using Risk formula.

• Average total Risk find in security components in Security boundary.

Introduction:

Comprehensive Risk Rating System CRRS:

The Comprehensive Risk Rating System (CRRS) is a framework used to assess and quantify risks associated with various activities, processes, or systems within an organization. It is a structured approach that helps organizations identify, analyze, and prioritize risks based on their potential impact and likelihood of occurrence. CRRS provides a systematic way to evaluate risks across different dimensions and establish a risk rating that can be used to prioritize risk mitigation efforts and allocate resources effectively.

The CRRS typically involves several steps:

• Risk Identification: This step involves identifying all potential risks that may arise from activities, processes, or systems within the organization. Risks can be identified through various methods such as risk assessments, risk workshops, interviews, documentation review, and historical data analysis.

• Risk Assessment: Once risks are identified, they are assessed based on their potential impact and likelihood of occurrence. Impact refers to the severity of the consequences if a risk event occurs, while likelihood refers to the probability of a risk event occurring. Organizations may use qualitative, quantitative, or a combination of both methods to assess risks.

• Risk Rating: Based on the assessment, risks are assigned a risk rating that typically includes a numerical score or a color-coded rating. The risk rating is often determined by multiplying the impact and likelihood scores, or by using a predefined risk matrix that maps impact and likelihood to different risk levels.

• Risk Prioritization: Risks are prioritized based on their risk rating. Risks with higher ratings are considered more critical and require immediate attention and mitigation efforts, while risks with lower ratings may be addressed through regular monitoring or lower priority mitigation actions.

• Risk Mitigation: Once risks are prioritized, organizations develop and implement mitigation strategies and action plans to reduce the identified risks to an acceptable level. Mitigation measures may include implementing controls, developing contingency plans, transferring risk through insurance or contracts, or accepting the risk if it falls within the organization's risk tolerance.

• Monitoring and Review: The CRRS is an iterative process, and risks should be continuously monitored, reviewed, and updated as necessary. Organizations should periodically review and reassess risks to ensure that the risk landscape remains up-to-date and that mitigation measures are effective in reducing risks to an acceptable level.

The CRRS provides organizations with a structured approach to identify, assess, and prioritize risks, which enables them to make informed decisions on resource allocation, risk mitigation strategies, and risk tolerance levels. It helps organizations proactively manage risks and ensure that risk management efforts are aligned with their strategic objectives and risk appetite.

Risk in Security Components:

Risk refers to the potential for harm or loss that can result from the existence of vulnerabilities or weaknesses in security components. Security components are the various elements or components within an organization's IT infrastructure that are designed to protect the confidentiality, integrity, and availability of information and systems. These components may include firewalls, intrusion detection and prevention systems (IDS/IPS), virtual private networks (VPNs), web application servers, databases, data encryption mechanisms, access controls, and other security technologies.

Risks in security components can arise from several factors, including:

• Vulnerabilities: Security components may contain vulnerabilities, which are weaknesses or flaws that can be exploited by attackers to gain unauthorized access, disrupt services, tamper with data, or carry out other malicious activities. Vulnerabilities can exist in the hardware, software, configuration settings, or implementation of security components.

• Misconfiguration: Improper or inadequate configuration of security components can create security gaps and increase the risk of unauthorized access, data leakage, or other security breaches. Misconfiguration may result from human error, lack of proper security configuration guidelines, or failure to implement security best practices.

• Outdated or Unsupported Components: Security components that are not regularly updated with security patches and updates can become vulnerable to known threats and attacks. Similarly, components that are no longer supported by the vendor may not receive necessary security updates, leaving them exposed to potential risks.

• Weak Authentication and Authorization Mechanisms: Weak or ineffective authentication and authorization mechanisms in security components can allow unauthorized users to gain access to sensitive systems or data, resulting in security breaches and data breaches.

• Insufficient Monitoring and Logging: Inadequate monitoring and logging of security components may result in missed detection of security incidents, delayed response to security threats, and lack of visibility into potential security risks and events.

• Inadequate Training and Awareness: Lack of proper training and awareness among personnel responsible for managing and configuring security components can lead to mistakes, misconfiguration, and other security gaps that can be exploited by attackers.

• Third-party Risks: Many security components rely on third-party software, hardware, or services, which can introduce additional risks if those third-party components have vulnerabilities, misconfiguration, or other security weaknesses.

These are some common examples of risks that can exist in security components within an organization's IT infrastructure. It is essential for organizations to conduct regular risk assessments, implement appropriate security controls, keep security components up-to-date with patches and updates, monitor and log security events, and provide adequate training and awareness to personnel to mitigate these risks and ensure a secure and resilient information security posture.

Formula: Risk = Vulnerability * Impact

Risk calculation of Security Components using table format:

Table Figure 1:

1. First Asset:

a). Name of Assets: Bank’s Website (www.mybanking.com)- The website is developed using java technology using secure standard coding and data sanitized.

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are

• CVE-2020-14750: Apache Struts (struts.apache.org)

• CVE-2020-14882: Oracle WebLogic (oracle.com/middleware/weblogic)

• CVE-2020-14889: Spring Framework (spring.io)

• CVE-2020-14900: Eclipse Jetty (eclipse.org/jetty)

• CVE-2020-14910: Oracle Java SE (oracle.com/java)

c). Note/assumption: Not Applicable (NA).

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Marginal rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Marginal and Vulnerability is Unlikely

So, Risk = Marginal * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk = 7

2. Second Asset:

a). Name of Assets: Cisco Gateway

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are

• 2002-2379: Cisco AS5350 - Universal Gateway Port scan Denial of Service

• 2009-3457: Cisco ACE XML Gateway 6.0 - Internal IP Disclosure

c). Note/assumption: Not Applicable (NA).

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Likely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Marginal rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Marginal and Vulnerability is Likely

So, Risk = Marginal * Likely

Risk = High

The High is denoted the value as 8, Risk = 8

3. Third Asset:

a). Name of Assets: Juniper IPS/IDS

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2018-0050: Junos OS Multiple vulnerabilities in Juniper Network Connect/Pulse Secure SSL VPN

• CVE-2018-0045: Junos OS Privilege escalation in Juniper Network Connect/Pulse Secure SSL VPN

• CVE-2018-0043: Junos OS Denial of Service vulnerability in Juniper Network Connect/Pulse Secure SSL VPN

• CVE-2018-0040: Junos OS Improper authentication in Juniper Network Connect/Pulse Secure SSL VPN

• CVE-2018-0039: Junos OS Unauthorized access vulnerability in Juniper Network Connect/Pulse Secure SSL VPN

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Critical and Vulnerability is Rare.

So, Risk = Critical * Rare

Risk = Medium

The Medium is denoted the value as 7, Risk = 7

4. Forth Asset:

a). Name of Assets: Cisco Virtual Protocol Network (VPN)

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2018-0289: Cisco ASA Software TCP State Bypass Vulnerability

• CVE-2018-0285: Cisco ASA Software IKEv1 and IKEv2 Denial of Service Vulnerability

• CVE-2018-0310: Cisco ASA Software IPv6 Fragment Handling Denial of Service Vulnerability

• CVE-2018-0299: Cisco ASA Software AnyConnect Secure Mobility Client Denial of Service Vulnerability

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Minor rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Minor and Vulnerability is Rare.

So, Risk = Minor * Rare

Risk = Low

The Medium is denoted the value as 6, Risk = 6

5. Fifth Asset:

a). Name of Assets: Apache Web-Server Application

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2019-0211: Apache HTTP Server mod_proxy_ftp Denial of Service Vulnerability

• CVE-2018-1312: Apache HTTP Server mod_auth_digest Access Restriction Bypass

• CVE-2017-9789: Apache HTTP Server mod_mime Remote Code Execution Vulnerability

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Catastrophic rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Catastrophic and Vulnerability is Unlikely.

So, Risk = Catastrophic * Unlikely

Risk = High

The Medium is denoted the value as 8, Risk = 8

6. Sixth Asset:

a). Name of Assets: Cisco Firewall – Used block incoming and outgoing threats

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2019-1653: Unauthenticated Remote Code Execution Vulnerability in Cisco Adaptive Security Appliance (ASA).

• CVE-2019-1861: Cisco ASA Software IKEv1 and IKEv2 Denial of Service Vulnerability.

• CVE-2018-0296: Cisco ASA and FTD Software Remote Code Execution Vulnerability.

• CVE-2018-15454: Cisco ASA SSL/TLS Denial of Service Vulnerability.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Critical and Vulnerability is Unlikely.

So, Risk = Critical * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk = 7

7. Seventh Asset:

a). Name of Assets: Oracle Database – Database storage using ASE encryption.

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2016-0020: DBA privileges to bypass authentication when connecting to the database.

• CVE-2016-0021: DBA privileges to bypass authentication when connecting to the database.

• CVE-2016-0022: DBA privileges to execute arbitrary code without authorization.

• CVE-2016-0023: DBA privileges to access arbitrary files without authorization.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Unlikely rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Critical rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Critical and Vulnerability is Unlikely.

So, Risk = Critical * Unlikely

Risk = Medium

The Medium is denoted the value as 7, Risk7 = 7

8. Eight Asset:

a). Name of Assets: IBM Guardian – Monitoring the activities on the database

b). Vulnerability Description: The assets which associated with different version and types of Common Vulnerability and Exposure (CVE) are,

• CVE-2020-4444: Network access to execute arbitrary code via a specially crafted request.

• CVE-2020-4453: Network access to bypass authentication and gain access to a restricted resource.

• CVE-2020-4456: Network access to bypass authorization checks and gain access to privileged resources.

c). Note/assumption: Not Applicable

d). Vulnerability Rating:

The stage of vulnerability Rating are - Certain/Likely/Possible/Unlikely/Rare.

In this asset has Rare rating.

e). Impact Rating:

The stage of impact Rating are - Minor/Marginal/Critical/Catastrophic.

In this asset has Marginal rating.

f). Risk Calculation:

The risk calculation is according to table were given in the project.

Values of Risk: Low (6) - Medium (7) - High (8) - Very High (9)

Formula: (Risk = Vulnerability * Impact)

In this the Impact is Marginal and Vulnerability is Rare.

So, Risk = Marginal * Rare

Risk = Low

The Medium is denoted the value as 7, Risk = 6

Conclusion:

The Average Risk Calculation: Overall Risk Calculation of Security Assets the formula is,

The Assets with Risk Calculation are,

• Website Domain Risk = 7

• Cisco Gateway Risk = 8

• Juniper IPS/IDS Risk = 7

• Cisco VPN Risk = 6

• Apache Web server application Risk = 8

• Cisco Firewall Risk = 7

• Oracle Database Risk = 7

• IBM Guardian Risk = 6

Formula: Overall Risk = (risk 1+ risk 2 + .... + risk n) / (total no of assets posing risk)

= 7 + 8 + 7 + 6 + 8 + 7 + 7 + 6 / 8

= 56 / 8 = 7

The Overall risk calculation in the security components and Assets is 7 (Medium).