Project 2 - Comprehensive Risk Rating System (CRRS)
assets/components in the organisation are
Bank's Website
Cisco router
Cisco firewalls
Cisco gateway
Juniper IDS/IPS
Cisco VPN
Web Application Server (Apache 2.0)
Oracle Database server
IBM Guardium Data Protection
While HTTPS provides a higher level of security compared to HTTP but it does not make a website immune to all security risks. Some of the potential exploits and vulnerabilities are
|
Potential exploits/vulnerabilities |
Impact |
Likelihood |
Risk |
|
Phishing Attacks - Attackers may create fake banking websites with similar domain names and trick users |
High |
Moderate to High (based on the awareness to customers and employees) |
Very High |
|
Man-in-the-Middle (MitM) Attacks - Attackers can intercept communication between the user and the website by exploiting vulnerabilities in the user's device/network |
High |
Moderate |
Moderate to High |
|
Cross-Site Scripting (XSS) - Attackers may inject malicious scripts into web pages, which can steal user data or perform actions on behalf of the user. |
High |
Moderate |
Moderate to High |
|
Cross-Site Request Forgery (CSRF) - trick users into performing unwanted actions on a banking website, potentially leading to unauthorized transactions or data manipulation. |
High |
Low to Moderate |
Moderate |
|
Certificate-Related Issues - HTTPS relies on SSL/TLS certificates. Expired, revoked, or incorrectly configured certificates can lead to security risks. Regularly update and monitor certificates to prevent issues. |
High |
Moderate |
Moderate to High |
Routers
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Outdated Firmware and Security Patches - Running outdated router firmware can expose vulnerabilities that have been patched in newer versions. Failure to regularly update and patch router software can lead to security risks. |
High |
Moderate to High (Depending on how frequently updates are applied) |
Moderate to High |
|
Denial of Service (DoS) Attacks - Routers are susceptible to DoS attacks causing it to become unresponsive. This can disrupt banking services and create opportunities for attackers. |
High |
Moderate |
Moderate to High |
|
Configuration Errors - Misconfigured routers can lead to data leaks, network instability, or unauthorized access. |
High |
Moderate |
Moderate to High |
|
Physical security - Physical access to routers can lead to significant security breaches, potentially leading to data theft or tampering. |
High |
Low to Moderate |
Low |
Firewalls
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Incomplete Rule Sets - This can leave unintended openings in the firewall's security policy. Attackers can exploit these gaps to gain unauthorized access to the network. |
High |
Moderate (Depending on the complexity of the firewall rules and the management process) |
Moderate to High |
|
Firmware and Software Vulnerabilities - If not regularly updated and patched, these vulnerabilities can be exploited by attackers to compromise the firewall's security. |
High |
Moderate to High (Depends on the frequency of updates and the diligence of patch management) |
Moderate to High |
|
Insufficient Intrusion Detection and Prevention - Inadequate or misconfigured IDPS can result in missed attacks or false positives/negatives. |
High |
Moderate |
Moderate to High |
|
DDoS Attacks - This can disrupt banking services and create opportunities for other attacks. |
High |
Moderate to High |
Moderate to High |
|
Zero-Day Exploits - Attackers can leverage these exploits security flaws that are not yet known before patches or protections are available, potentially bypassing firewall defences. |
High |
Low to Moderate |
Moderate |
Cisco gateway
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Unpatched Software and Firmware - Failure to regularly update and patch the gateway's software and firmware can leave it vulnerable to gain unauthorized access or disrupt services. |
High |
Moderate to High (Depends on the frequency of updates and the diligence of patch management) |
Moderate to High |
|
DDoS Attacks - Gateways can be targeted by DDoS attacks, which can disrupt banking services. |
High |
Moderate to High |
High |
|
Weak Authentication and Access Controls - Inadequate authentication mechanisms and access controls can allow unauthorized users or attackers to gain access to the gateway |
High |
Moderate (Depends on the strength of existing authentication measures) |
Moderate to High |
|
Inadequate Logging and Monitoring - Insufficient visibility to detect and respond to security incidents lead to increased risk. |
High |
Moderate to High |
Moderate to High |
|
Insufficient Encryption and Data Protection - Inadequate encryption of data in transit and at rest can expose sensitive financial information to eavesdropping or theft. |
High |
Moderate to High |
Moderate to High |
IDS/IPS
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Signature-based Detection Limitations - It may fail to detect zero-day exploits or sophisticated attacks that don't match known signatures. |
High |
Moderate |
Moderate to High |
|
False Positives and Negatives - Incorrectly identifying legitimate traffic as malicious (false positives) or failing to detect actual threats (false negatives) can be a challenge. |
High |
Moderate |
Moderate to High |
|
Lack of Patching and Updates - Outdated systems are vulnerable to known exploits. |
High |
Moderate (Depends on the organization's patch management practices) |
Moderate to High |
|
Evasion Techniques - These fragmentation, encoding, or obfuscation of malicious payloads. |
High |
Moderate |
Moderate to High |
|
Resource Exhaustion Attacks - Attackers may attempt to overload the IDS/IPS system by sending a high volume of traffic leading to miss legitimate threats. |
High |
Moderate (Depends on the effectiveness of network defences and IDS/IPS configuration) |
Moderate to High |
Cisco VPN
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Weak Authentication and Access Controls - Unauthorized access to the VPN can lead to data breaches and network compromise |
High |
Moderate to High |
Moderate to High |
|
VPN Protocol Vulnerabilities - Exploitable protocol vulnerabilities can compromise the confidentiality and integrity of VPN traffic |
High |
Moderate |
Moderate to High |
|
Failure to Patch and Update - Outdated software and firmware can be exploited by attackers. |
High |
Moderate to High |
Low to moderate |
|
Client-Side Risks - Unpatched or compromised client devices can introduce vulnerabilities. |
Moderate to High |
Moderate |
Moderate to High |
Apache web server
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Web Application Vulnerabilities - Exploitable vulnerabilities lead to data breaches and financial losses. Apache servers can be susceptible to common vulnerabilities such as SQL injection, Cross-Site Scripting (XSS), and CSRF |
High |
Moderate to High (Depends on the complexity and security of the web applications. |
Moderate to High |
|
Unpatched Software and Vulnerabilities - Failure to regularly update and patch the Apache server software can expose it to known security vulnerabilities. |
High |
Moderate |
Moderate to High |
|
Misconfigurations - Apache server settings, such as improper access controls or directory listings |
High |
Moderate |
Moderate to High |
|
DoS Attack - Apache servers can be targeted by DoS attacks with excessive traffic |
High |
Moderate |
Moderate to High |
|
Inadequate Security Monitoring - Delayed detection can result in extended exposure to threats. |
High |
Moderate |
Moderate |
Oracle database
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
SQL Injection Attacks - vulnerabilities in database-driven web applications can enable attackers to execute malicious SQL queries directly against the Oracle database leading to unauthorized data access or manipulation. |
High |
Moderate |
Moderate to High |
|
Weak Authentication and Access Controls - Weak passwords or misconfigured access permissions can allow attackers to steal sensitive financial data from the database |
High |
Moderate to High (Depends on the effectiveness of access controls and password policies) |
Moderate to High |
|
Insufficient Logging and Monitoring - Delayed detection can result in extended exposure to threats. |
High |
Moderate |
Moderate to High |
|
Inadequate Data Encryption - Failing to encrypt sensitive data within the database can expose it to theft or unauthorized access |
High |
Moderate |
Moderate to High |
IBM Guardium Data Protection
IBM Guardium Data Protection is a critical tool for securing sensitive data in a banking network. Few major vulnerabilities or security risks associated are
|
Potential exploits |
Impact |
Likelihood |
Risk |
|
Misconfigurations - Improperly configured Guardium policies or rules can lead to false positives, false negatives, or ineffective data protection. |
Moderate to High |
Moderate |
Moderate to High |
|
Unauthorized Access - to the Guardium management console or underlying systems can compromise data integrity and confidentiality |
High |
Moderate |
Moderate to High |
|
Data Exfiltration - If an attacker gains access to the Guardium system or its logs, they may attempt to exfiltrate sensitive data or manipulate logs to cover their tracks |
High |
Low to Moderate |
Moderate to High |
|
Failure to Monitor Critical Data Paths - result in missed security incidents or data breaches |
High |
Moderate |
Moderate to High |
|
Lack of Regular Updates and Patch Management - Outdated software can be exploited by attackers |
High |
Moderate |
Moderate to High |
Based on the above potential vulnerabilities or security risks assessed for various components we can now calculate the risk possesed by each of the asset of the banking architecture by using the formula
Risk = Impact * vulnerability
|
Asset |
Risk they posses |
Weighted score |
|
Https protocol to access Bank's Website |
Risk1 = High |
8 |
|
Cisco router |
Risk2 = Moderate |
7 |
|
Cisco firewalls |
Risk3 = Moderate |
7 |
|
Cisco gateway |
Risk4 = Moderate |
7 |
|
Juniper IDS/IPS |
Risk5 = Moderate |
7 |
|
Cisco VPN |
Risk6 = Moderate |
7 |
|
Web Application Server (Apache 2.0) |
Risk7 = High |
8 |
|
Oracle Database server |
Risk8 = High |
8 |
|
IBM Guardium Data Protection |
Risk9 = Moderate |
7 |
Overall risk possessed by the organisation = (8+7+7+7+7+7+8+8+7)/9 = 7.3333
The organisation posses a medium level of risk. Some of the suggestions to improve the security are
- Regular firmware updates and security patch management.
- Strong password policies and multi-factor authentication for router access.
- Implement strong access controls and authentication mechanisms to protect the assets and infrastructure.
- Conducting regular security audits and penetration testing to identify and rectify configuration errors.
- Implement comprehensive logging and monitoring solutions to detect and respond to security incidents in real-time.
- Deploy DoS mitigation strategies and monitoring to detect and respond to DoS attacks promptly.
- Implementing intrusion detection and prevention systems to detect and respond to DoS attacks.