Project 2 - Comprehensive Risk Rating System (CRRS)
Comprehensive Risk Rating System (CRRS): Vulnerability vs Impact
Certain - 5
Likely - 4
Possible - 3
Unlikely - 2
Rare - 1
| Assets and Potential Risk Factors | Vulnerability | Minor | Marginal | Critical | Catastrophic |
| Hubs and Switches | Likely | Medium - 7 | High - 8 | High - 8 | Very High - 9 |
| Application Server or Softwares | Possible | Low - 6 | Medium - 7 | High - 8 | Very High - 9 |
| Firewall | Possible | Low - 6 | Medium - 7 | High - 8 | Very High - 9 |
| Mail Server | Certain | High - 8 | High - 8 | Very High - 9 | Very High - 9 |
| File/Print Server | Unlikely | Low - 6 | Medium - 7 | Medium - 7 | High - 8 |
| Web Server | Rare | Low - 6 | Low - 6 | Medium - 7 | Medium - 7 |
| Branch Office Systems and Assets | Certain | High - 8 | High - 8 | Very High - 9 | Very High - 9 |
| Router / Hardware | Possible | Low - 6 | Medium - 7 | High - 8 | Very High - 9 |
| Wireless Access points/ WiFi | Certain | High - 8 | High - 8 | Very High - 9 | Very High - 9 |
| LDAP as Authentication Service Protocol | Likely | Medium - 7 | High - 8 | High - 8 | Very High - 9 |
| CRL Distribution Point | Rare | Low - 6 | Low - 6 | Medium - 7 | Medium - 7 |
Risk = Vulnerability x Impact
Impact = Sum(Minor+Marginal+Critical+Catastrophic)
R1 = 4 x 32 = 128
R2 = 3 x 30 = 90
R3 = 3 x 30 = 90
R4 = 5 x 34 = 170
R5 = 2 x 28 = 56
R6 = 1 x 26 = 26
R7 = 5 x 34 = 170
R8 = 3 x 30 = 90
R9 = 5 x 34 = 170
R10 = 4 x 32 = 128
R11 = 1 x 26 = 26
Overall Risk Score = (R1+R2+R3+R4+R5+R6+R7+R8+R9+R10+R11) / (total no of assets posing risk)
Overall Risk Score = 1144 / 11
Overall Risk Score = 104
Suggestions to improve the security features are:
- Conduct weekly security awareness program for the bank IT employees.
- Security Engineers need to verify the antivirus softwares for any malwares detected. Should install authorised and licensed antivirus module in the employee assets(Laptop, PCs etc.)
- Must have constant monitoring at the application level servers for any external attacks and also need to have a sanity check of software threats from any patches or upgrades.
- Security Network team should ensure proper authentication factors such as two factor authentication, biometric, facial recognition methods etc. are enabled in the employee assets to overcome from loss of data or system hacks.
- Always need to keep an eye on firewall status before any incoming traffics penetrate the internet access of the organization. They should keep it encrypted and protect from heavy network traffic congestion.