SABSA Risk Model for Acme Retail Corporation

Acme Retail Corporation is a retail corporation that has both “brick and mortar” stores across the United States as well as a
large e-Commerce presence. In recent years, Acme Retail Corp. has increased its online sales and revenue that has quickly outpaced
its revenue from their physical presence sales. In order to provide a “qualitative measurement method that classifies risks into a
series of bands”, the below SABSA Risk Assessment is provided (Sherwood et al., 2005). The table provides the first steps within the
Contextual Security model within SABSA and set the foundation for the next layer, the Conceptual Security model.

1 2 3 4 5 6 7 8 9 10
Business Driver Business Business High-Level Business Impact Pot. High- Green Green
Attributes Requirements Threat Impact Value Level Vuln Field Field Risk
Vuln Cat
Value
BD-1 Point of Sale
(POS) system
BD-1.1 Security Usability Security Rushed POS Increased H POS system H A (red)
Confidential features must implementation risk of networks
not create exposure of publicly facing
excess latency customer
at check-out financial
data
BD-2 Customer
Privacy
BD-2.1 Privacy Privacy Proper storage Customer Fines by H Customer H A (red)
protections and protections information consumer databases
of customer disclosed to agencies. publicly
data unauthorized Loss of facing.
parties customer Inadequate
confidence protection of
private
information.
Business Driver Business Business High-Level Business Impact Pot. High- Green Green
Attributes Requirements Threat Impact Value Level Vuln Field Field Risk
 Vuln Cat
Value
BD-3 Regulatory
Compliance
BD-3.1 Data protection Compliance Requirement to Failure to Prosecution H Failure to H B
regulations/laws Privacy comply with comply with by understand (yellow)
Confidentiality data protection regulatory laws legislators. regulations
regulations/laws Fines by and
consumer implement
agencies. risk controls.
BD-4 Online
Presence/e-
commerce
BD-4.1 Security Confidential Security Customer is Loss of H Multiple H B
Usability features must unable to business to authentication (yellow)
not inhibit complete competitors. requests.
availability online Loss of Unsecure
transactions customer browsing
privacy sessions.

BD-5 Third-Party
Vendor
Relationships
BD-5.1 Vendor security Integrity Vendor service Vendor Vendor H Vendor H A (red)
trust Availability networks must networks services network
be able to become become vulnerabilities
function to untrusted non- become
enable functional vulnerabilities
production on business
environment. network
environment
 References

Sherwood, J., Clark, A., & Lynas, D. (2005). Enterprise security architecture: A business-driven approach. CRC Press.