Ict HDMC Consolidation HDMC 18

ICT CONSOLIDATION
Cyber Threats
ASSETS
CYBER
VULNERABILITY
THREAT
STRATEGIES
College of Defence Faculty of Decision Sciences

Management –
Basic Definitions
Asset - Anything that has

value to the organisation
Vulnerability –
A weakness of an asset
that can be exploited by
one or more threats
Threat - Any action or event with the potential to cause harm
Risk – A potential event that a threat will exploit vulnerability in an asset

Management –
Vulnerabilities of Assets
0 Technological Implementation
- Comn Protocol Design - Misconfigured Devices
- Software loopholes - Use of Default Setting
- Poor Database Design - Access by Unauth Persons
Asset Vulnerabilities
Operational Management
- Lack of Monitoring - Lack of Security Policy
- Lack of Continuity of Staff - Improper Assessment of Risk
- Lack of Backup - Poor IT Planning & Training

Management –
Strategies
Security
Strategies
Type Approaches
Physical Logical Proactive Reactive

Management –
Strategies for Physical Security
• Issue of Smart Cards • Access to Routers,

switches
Network
Personal
Access
Security
Security
Computer Server
Security Security
• Access to the workstations • Access rights to

the servers

Management –
Strategies for Logical Security
Password Guidelines Limiting Availability
Increasing Audit Increasing Control
Limiting User Least Privilege Policy

installations

Management –
Hardening the System
Perimeter Defence
Limiting use of
removable media
Data and software

backup
Handling classified Repair Review

information/ sensitive Determine
data the Cause Response
Assess the Update
Damage Policies
Contain the
Damage
Risk Management

Management –
Risk
Risk = f (Asset Value, Vulnerability & Threat Probability)

Management –
Steps to Risk Management
Risk
Communication
Risk
Treatment
Risk
Risk Assessment
Identification

Management –
Risk Assessment
• Determining the relative risk
• Assign a Risk Rating
gauging the relative risk
making comparative ratings
• Evaluate assets with regard to :-

 Value to Organisation
 Vulnerabilities
 Threats
• Produces an estimate of a risk

Management –
RISK RATING
ASSET THREAT VULNERABILITY

VALUATION VALUATION VALUATION
CONFIDENTIALITY
SECURED
LOW LOW
INTEGRITY MED
RELIABLE
MED
AVAILABILITY HIGH
ACCESS
HIGH
Asset Valuation-Confidentiality
Asset Value
Class Description
(Quantified)
Non sensitive info restricted to
UNCLASS 1
internal use only
RESTD Varying restriction within the org 2
CONFD Available on need – to – know basis 3

Available strictly on need –to –know
SECRET 4
basis
TOP Very sensitive available to selected
5
SECRET few

Management –
Asset Valuation-Integrity
Asset Value
Class Impact of Loss of integrity (Quantified)
VLI
(Very Low Integrity)
Negligible 1
LI
(Low Integrity)
Minor 2
MI Significant
(Medium Integrity) 3
HI Major
(High Integrity) 4
VHI Could lead to serious or total
(Very High Integrity) failure 5

Management –
Asset Valuation-Availability
Min % Office Hours Availability Asset Value

Class (Quantified)
Required
VLA
At least 25% office hours
(Very Low Availability) 1
LA
At least 50% office hours 2
(Low Availability)
MA
100% office hours 3
(Medium Availability)
HA Required for at least 95% whole

(High Availability) day 4
VHA Availability required throughout
(Very High Availability) the day 5

Management –
Asset Valuation-Example
– Info Storage at Ops Branch
• Asset Value Stand Alone
Computer
 Confidentiality 3 Branch)
(Ops
 Integrity 4
 Availability 3
Sainik Institute Computer

Asset Value
Confidentiality 1
Integrity 2
Availability 3

Management –
Threat Valuation
RISK RATING
Threat Probability Rating

LOW L
MEDIUM M
HIGH H

Management –
Vulnerability Valuation
RISK RATING
Nature/Extent of Vulnerability Rating

Very secure, no vulnerabilities L
Secure but needs to improve M
Security is clearly inadequate at
H
present and many loopholes exist

Management –
Threat and Vulnerability Valuation
– Info Storage at Div GS Branch

• Asset Value – C-3, I-4, A-3
• Threat Value – H
• Vulnerability Value – M
– Sainik Institute Computer

• Asset Value – C-1, I-2, A-3
• Threat Value – L
• Vulnerability Value - M

Management –
Risk Rating Matrix
Threat LOW MED HIGH
Vulnerability L M H L M H L M H
1 1 2 3 2 3 4 3 4 5
2 2 3 4 3 4 5 4 5 6
Asset Value
Rating 3 3 4 5 4 5 6 5 6 7
(C, I, A)
4 4 5 6 5 6 7 6 7 8
5 5 6 7 6 7 8 7 8 9

Management –
Risk Rating Matrix
– Info Storage at Div GS Branch

• Asset Value
 Confidentiality – 3
 Integrity – 4
 Availability – 3
• Threat Value – H
• Vulnerability Value - M

Management –
Risk Rating Matrix
CONFIDENTIALITY INTEGRITY AVAILABILITY
Asset Value
Confidentiality - 3 Threat Threat LOW
Threat LOW MED
LOW MED HIGH
MED HIGH HIGH
Integrity
Availability Vuln Vuln
L M Vuln
L H M LL H MM L HH M LL H MM L HH M L H M H
Threat Value – H
Vulnerability – M
1 1 12 1 3 12 2 1 3 3 2 2 4 3 3 3 2 4 4 3 3 5 4 4 3 5 4 5
Asset Value
Confidentiality 2 2 23 2 4 23 3 2 4 4 3 3 5 4 4 4 3 5 5 4 4 6 5 5 4 6 5 6
Asset Asset Asset
Integrity - 4 Value Value Value
Availability Rating 3Rating
3 34Rating
3 5 34 4 3 5 5 4 4 6 5 5 5 4 6 6 5 5 7 6 6 5 7 6 7
Threat Value – H
(C) (I) (A)
Vulnerability – M 4 4 45 4 6 45 5 4 6 6 5 5 7 6 6 6 5 7 7 6 6 8 7 7 6 8 7 8
Asset Value 5 5 56 5 7 56 6 5 7 7 6 6 8 7 7 7 6 8 8 7 7 9 8 8 7 9 8 9
Confidentiality
Integrity
Availability - 3
Threat Value – H
RISK RISK RISK
Vulnerability – M RATING RATING RATING
6 7 6
Management –
Using Risk Assessment Matrix
• Risk Ratings of Assets
– Info Storage (6,7,6) = 6 x 7 x 6 = 252
– AWWA Cmptr (2,3,4) = 2 x 3 x 4 = 24
– Asset 3……..
• Higher the Risk Rating – Higher the Risk
• Prioritise Risks – Rank order them
• Divide Risk Ratings into
– High Risk
– Medium Risk Criticality, Priority
& Urgency of Action
– Low Risk

Management –
Using Risk Assessment Matrix
• High Risk
• Most critical.
• Addressed on a high priority basis
• Require immediate action
• Medium Risk
• Quick action before it become critical
• Controls implemented within specified time
• Low Risk
• Reasonable steps taken and develop risk
management strategies in time
• Such risks do not require extensive resources;
rather they can be handled with smart thinking
and logical planning

Management –
Steps to Risk Treatment
Risk
Avoidance
Risk
Acceptance
Transference
Tran
Mitigation
Remediation

Management –
Risk Treatment
Ser Asset Risk Rating Risk Rank Mitigation Measures
No
1. Info 6x7x6 1 1. Strict Access Control

Storage =252 2. Backup at regular intervals
3. …
2. Asset 2 3x 5 x 8 = 4 1. …
120 2. ….

Management –
Why Does Info Security Fail
Info Sec fails in several common areas :
Human Unawareness
Policy Inadequacies
Hardware or Software Misconfigurations
Poor Assumptions
Ignorance
Failure to stay up-to-date

Management –
TYPES OF SECURITY ASSESSMENTS
Vulnerability Assessment VA
Focuses on known weaknesses
Penetration Testing PT
Tests for known and unknown weaknesses
IT Security Audit SA
Security policies and procedures

Management –
Database Management System

Management –
What is a Database?
• An ordered collection of related

data elements,
• that represent some data
relevant to the org;
• intended to meet the info needs
of an org,
• & designed to be shared by
multiple users.

Management –
Why Do We Need A Database ?
Consider your Org with Many Computers…..

– With data organised in files and folders
– Large number of files in several folders
• Different file types
• Different locations
– Access to files based on the folder-structure created

Management –
Problems with Handling Data
• Size
• Searchability
• Ease of Updating
• Security
• Redundancy
– Same data in No of files
• Importance

Management –
How is Data Stored?
• Data is stored in a database in objects

called tables.
• A table is a collection of related data entries

and it consists of columns and rows.

Management –
Table
• Row or a record is each individual entry that

exists in a table.
LIST OF OFFRS
Rows/ Records/ Tuples

Management –
Table
• Columns are Fields in a table designed to

maintain specific information about every
record in the table.
LIST OF OFFRS
Columns/Attributes or Fields

Management –
DBMS Tasks
CREATE
RETRIEVE
UPDATE DATA
DELETE
• Organises data to allow better control
• Maintain
– Concurrency of Data
– Consistency of Data
– Data Integrity
– Security
– Backup & Recovery

Management –
Basic DBMS Process
SQL is a standard language for accessing and manipulating databases

Management –
User Interface - DBMS
ct
Sele
Action

Management –
SQL
• SQL is a standard language for accessing and manipulating databases.
–SQL stands for Structured Query Language

–SQL lets you access and manipulate databases
• So what Can SQL do? @Query ?

–Retrieve data
–Insert records
–Update records
–Delete records
–Create new databases
–Create new tables
–Set permissions on tables,
procedures, and views…..

Management –
Types of Databases
https://www.includehelp.com/dbms/types-of-database-management-system.aspx

Management –
Flat File
• Refers to any database which exists in a single

table in the form of rows and columns,
• With no relationships between records, except
the table structure.

Management –
Relational Database
• A relational database is a
collective set of multiple data
sets organized by tables,
records and columns.
• Relational Databases establish

a well-defined relationship
between database tables.
• Tables communicate and share

information, which facilitates :-
– data retrieval
– organization
– reporting

Management –
Relations Between Tables
• Primary Key. A column (Field) with unique values to identify each row
in a table. One Primary Key per table.
• Foreign Key. Also called a referencing key - used to link two tables
together. We can have more than one foreign key per table.

Management –
Relations Between Tables
• Foreign key is a field in one table that uniquely identifies a row of another
table.
• Foreign key is defined in a second table, but it refers to the primary key or a
unique key in the first table.
• Relationship is association linking Primary key of a table with a field of another
table called as Foreign key.
• Types of Relations.
♯ One to One. Service Number of an Offr
♯ One to Many. One Regt to Offrs of that Regt
♯ Many to Many. One author several books

& one book many authors

Management –
Related Tables
URC VISIT TABLE

Management –
NoSQL
• NoSQL stands for “Not Only SQL.”
• Provides more possibilities to data developers
• NoSQL - non-relational databases Vs SQL
(Data - Scaling)
• Application Programming Interfaces (APIs).
• Advantages :
– High scalability
– Distributed Computing
– Lower cost
– Schema flexibility – Flexible Outline/Org
– Un/semi-structured data
– No complex relationships

Management –
Ultimate Purpose of a DBMS
Transform Support
Store &
into Decision
Org Data
Information Making

Management –
What is BIG DATA
Collection of Datasets so Large & Complex that it becomes difficult to

process using Database Systems tools or Traditional Data Processing
Applications
BIG DATA
 Large & Complex
 Difficult to process
 Stored in Distributed storage on cloud
 Size: TBs, PBs, EBs…

Management –
How is Data Generated
• THIS IS INFORMATION
TRANSACTIONS
INTERACTIONS
OBSERVATIONS
• HIGHLY STRUCTURED • HOW PEOPLE INTERACT GATHERED FROM THE IoT
DATA WITH ONE ANOTHER, OR •
• GPS COORDINATES
• RELATED TO EVENTS WITH YOUR BUSINESS
• IT ALWAYS INCLUDES • RFID CHIPS IN ATM
CARDS
TIME • FACEBOOK POSTS AND
• INVOICES, TRAVEL LIKES, SOCIAL FEEDS,
PLANS, ACTIVITY GENERATED CONTENT
RECORDS, PAYMENTS AND EVEN BLOGS

Management –
V’s
2013

Management –
Data Analytics Cycle
S = START WITH STRATEGY

M = MEASURE METRICS & DATA
A = APPLY ANALYTICS
Management R = REPORT RESULTS –
Process
01 02 03
INTEGRATE MANAGE ANALYSE
• Disparate sources and • Big data requires storage. • Visual analysis of your
applications varied data sets
• Storage solution can be in
• ETL tools not sufficient the cloud, on premises, or • Build data models with
both machine learning and
• New strategies and artificial intelligence
technologies to analyze big • Cloud is gradually gaining
data sets at terabyte, or even popularity because it
petabyte supports compute
requirements and enables
• Formatted and available in a you to spin up resources as
form that your business needed
analysts can get started with

Management –
Type of Data Analytics

Management –
Distr Computing Tech & Map Reduce
Map Reduce
Task A Allow parallel

processing of
the data stored
in HDFS
Task B Task D
Task C
Hadoop’s Distributed File System (HDFS) RESUL

T
Software-as-a-service (SAAS) model & (Storage as a Service) StAAS - makes Big Data analytics accessible to
anyone, even those with low budgets and ltd IT sp

Management –
Data Processing
Source Processing Destination

step/steps
Data Lake – Unstructured, Non Basic/ Adv Transformation Data Warehouse – Structured
Schema (Hadoop) Schema
(SAP, Oracle, Teradata)
Business Intelligence
Unfathomable volumes of data that come into Multiple tasks on the incoming
the system at high velocities and wide varieties series of data (the “data
stream”)

Management –
Collaborative Filtering
“360-degree view” of you as an

individual customer”
Mil Context
HR management
Medical mapping
Providing timely and relevant information from various sources
Target-designation and Entanglement
Situational awareness
Lgs & Med (fuel & amn sup, monitoring vital statistics of tps in terms of heart-rate, oxygen saturation,
etc)
Creating a C4ISR system
Cybersecurity, inconsistencies in active networks
Energy consumption patterns of the military

Management –
THE BIG
PICTURE

Management –
What is AI
“The science and engineering of making intelligent

machines, especially intelligent computer programs”
~John McCarthy, The “father” of AI
Goals of AI.
• To Create Expert Systems − The systems which exhibit intelligent
behavior, learn, demonstrate, explain, and advise its users
• To Implement Human Intelligence in Machines − Creating
systems that understand, think, learn, and behave like humans

Management –
Apch to AI
DEFINITIONS
OF
ARTIFICIAL
INTELLIGENCE
Courtesy – Artificial Intelligence : A Modern Approach, 3rd Ed

Management –
APPROACHES
TO AI
• Acting humanly –
Turing Test
Newer Turing Tets includes cmptr vision and robotics to su

Management –
• Also called Cognitive Modelling
Approach
APPROACHES
TO AI • Cognitive Science – Study of human
thought process and mind
Psy Brain
• Thinking Introspection
Experiments Imaging
humanly
• AI – Think like human (Theory of
Mind- Theory of Computer)
• Obstacle - How human brain works
is not completely known
• Focus of Cognitive Science

Management –
• Based on how we should think
APPROACHES
rather than how we actually think
TO AI
• Right thinking – undeniable
• Acting humanly – reasoning process
Turing Test
• Tim is a man, all man are mortal,
• Thinking humanly Tim is mortal - LOGIC
• Thinking
• Obstacles
rationally
 Availability of 100% knowledge
 Easy theoretically but difficult in

practice
To think rationally so as to get a correct solution requires, 100% knowledge which is not
possible practically

Management –
CORRECT INFERENCES
APPROACHES The Rational Agent Apch
TO AI Rational Agent
Behaving Have more attributes than just
rightly and a pgme (Perceiving envt/
• Acting humanly –
capb of Adapting to change/Reach
Turing Test reasoning the Goal)
• Thinking humanly
• Thinking rationally
• Acting rationally • Act to achieve goals, given a set of belief
• Rational behavior is doing the “right thing”
• Thing which expects to maximise goal
achievement

Management –
Achieve the best outcome or,
when there is uncertainty, the
best expected outcome Perceive its environment
through sensors
AN AI SYSTEM :
AGENTS &
ENVIRON-MENTS
Acts upon that environment through effectors

Management –
Natural Language Processing
• Deals with interaction between computers & humans using natural language.
• Ultimate objective of NLP - to read, decipher, understand, and make sense of
human languages in a manner that is valuable.
• Most NLP techniques rely on ML to derive meaning from human languages.

Management –
Types of AI
BASED ON NATURE OF AI BASED ON FUNCTIONALITY

• Artificial Narrow Intelligence or Weak AI • Reactive Machines
• Artificial General Intelligence or Strong AI • Limited Memory
• Artificial Super Intelligence • Theory of Mind AI

• Self-Aware AI

Management –
Types of AI (Based on Nature of AI)
• Artificial Narrow Intelligence or Weak AI

– AI that exists in our world today
– Operates within pre-determined, pre-defined range (may appear to
be much more sophisticated) – Siri, Google Assistant, Alexa etc
– Programmed to perform a single task - checking weather, play
chess etc
• Artificial General Intelligence or Strong AI
– Machines that exhibit human intelligence
– Able to reason, solve problems, make judgements under
uncertainty, plan, learn, integrate prior knowledge in decision-
making, and be innovative, imaginative and creative -
Consciousness?

Management –
Types of AI (Based on Nature of AI)
• Artificial Super Intelligence
–Will surpass human intelligence in all aspects - from

creativity, to general wisdom, to problem-solving
–Intellect that greatly exceeds cognitive performance of

humans in virtually all domains of interest

Management –
Types of AI (Based On Functionality)
• Reactive Machines
–One of the basic forms of AI
–They don’t have past memory or historic data to use & to
make current decisions
–Such machines work on present, to perform task that is
right in front of them
–Example: IBM chess programme that beat Garry
Kasparov
• Limited Memory
–These AI systems can use past experiences to take
future decisions
–They have limited memory or short-lived memory
–Example: self-driving cars

Management –
Types of AI (Based On Functionality)
• Theory of Mind AI
– Simply thinking like a human
– Understands human emotions,
thoughts and can interact socially
• Self-Aware AI
– Machines are self-conscious, and
self-aware like humans
– Can be future of robots

Management –
Machine Learning
Probability To Precision

Management –
What Is Machine Learning
• An application of Artificial Intelligence (AI)
• Provides systems ability to automatically learn and improve from
experience without being explicitly programmed
• Primary aim is to allow computers learn automatically without human
intervention or assistance and adjust actions accordingly

Management –
Types of Machine Learning

Management –
Supervised Learning
• Labelled data used to train algorithms
• Algorithms are trained using marked data, where input and output are known
• Data is fed to learning algorithm as set of inputs, called as Features, along with
corresponding outputs, called as Class
• Raw data divided into two parts. First

part is for training algorithm, and other
part used for testing trained algorithm
• Algorithm learns by comparing its actual
prediction with correct outputs to find
errors
• It then modifies model accordingly

Management –
Types of Supervised Learning

Management –
Unsupervised Learning
• Unlabeled data used to train algorithm (data that has no historical labels)
• Purpose is to explore data and find some structure within
• Input of raw info directly fed to algorithm without pre-processing and

without knowing output of data – no precedence
• Data cannot be divided into train or test data
• Algorithm figures out data and according to data segments, it makes

clusters of data

Management –
Types of Unsupervised Algorithms
• Clustering
• Deals with finding a structure or pattern
in a collection of uncategorised data
• Clustering algorithms will process your
data and find natural clusters(groups) if
they exist in the data

Management –
• Association
• Allows establishment of associations amongst data objects inside
large databases
• Interesting relationships can be discovered between variables in
large databases
• Frequently appeared patterns over large transactional databases
• Examples
• People who buy a new home are most likely to buy new
furniture
• Groups of shoppers based on their browsing and purchasing
histories

Management –
• Dimensionality Reduction (dimensions = how many columns in

dataset)
• Assumes that a lot of data is redundant
• Most info can be represented with only fraction of actual content
• Usually used in the pre-processing of data for ML
• Components
• Feature Selection
• Feature Extraction
• Can significantly lower compute and storage costs
• Can make ML models run much faster

Management –
Semi-Supervised Learning
• Supervised Learning – costly to label datasets with large volumes of data

• Unsupervised Learning – application spectrum limited
• Semi-Supervised Learning
• Overcomes above disadvantages
• Algorithm is trained on combination of labeled and unlabeled data
• Usually labelled data very less
• First step, cluster similar data using unsupervised learning algorithm
• Second step, use existing labeled data to label rest of unlabeled data
• Examples – speech analysis, internet content classification etc

Management –
Reinforcement Learning
• Aims at using observations gathered from

interaction with environment
• Algorithm (called agent) continuously learns

from environment in an iterative fashion
• Enables taking actions to maximise reward

or minimise risk
• Examples - computer played board games

(Chess, Go), robotic hands, and self-driving
cars

Management –
Deep Learning
• First theorised in the 1990s. Useful only recently since:-
• DL requires large amounts of labeled data
• DL requires substantial computing power
• Deep Learning attempts to model

high-level abstractions in data
inspired by structure and function of
brain called artificial neural networks
• ANN having more than one hidden
layer generally called Deep Neural
Network

Management –
ADVANCED EXCEL
Faculty of Decision Sciences –

College of Defence Management Quantify to Qualify
Excel
Interoperability
DATA PREP @ wrangling/Cleaning

Convergence @ Auto
CONNECT Visualisation & Analytics
DBMS
WORKBOOK
POSTER
PAGE

Management –
The Interface
RIBBON
VIEWS
VISUALIZATIONS FIELDS
PANEL PANEL
PAGES TAB

The Interface : VIEWS
REPORT VIEW
DATA VIEW
RELATIONSHIPS VIEW

Optimising Dashboard
• Interactions
– Make visuals talk to each other
• Filters
– Implement Visual, Page & Report/All Page Level filters
Highlig
Filter None
ht
• Slicers
– Remember Pivot Tables ?
– Implement Slicers to limit data to display
– Across Individual Pages
https://www.youtube.com/watch?v=njWTq3CzEBc – Slicer Vs Faculty

College of Defence Management
Filterof Decision Sciences –
Quantify to Qualify
Custom Visuals
• Visuals display in the Visualizations pane come "pre-packaged."
• Custom visuals are created by developers to enable users to see their
data in a way that fits the report best
• Users can then import the custom visuals files into their reports and
use them as any other Power BI visuals
• Custom visuals can be in the form of three deployment channels:
• Organizational Visuals - Specific for commonality in an
Org/Made specifically for an Org i.e. Google, Amazon….
• App source visuals
• Custom visual files - Includes code for rendering the data
( Software Development Kit(SDK) , GitHub)
Combine, Append and Merge
• Requirement to import two or more files
• Can be done by Combine, Append or Merge
Combine
Combine.
•Used to combine two or more files from the same folder
•Columns and attributes should be same
•Result is a file with all rows of combined files
New Discounting file

opened
BY
Three discounting files
combined total rows total
to 295
Append
Append.
• Function similar to Combine
• Columns and attributes should be same
• Additional columns will be created if number of columns
not same
• All rows of second file added at the end of first file
Merge
• Used to combine columns from two tables
• There should be at least one joining criteria to match
rows in the two tables.
• Result will be a table including columns from both
tables, and rows matching with each.
Merge
https://radacad.com/append-vs-merge-in-power-bi-and-power-query
Type of Visuals
• Single Value
• Textual
• Visual FILLED
MAP
• Multiple Values
BING MAP
AZURE
MAP
• Tabular SHAPE
MAP
• Visual
• Geo-Visual Arc GIS
MAP
• Slicers
Management –
ADV EXCEL
Conditional Formatting
=LOWER( A1)
Removing Duplicates
=UPPER(A1)
Multiple Blanks
=PROPER(A1) Text to Coln
=MID/LEFT/RIGHT Data Validation
Macros
=TRIM(TEXT)
=CONCATENATE
PIVOT TABLE
=VLOOKUP
=HLOOKUP
TWO DATASETS
=COUNTIF/IFS
=SUMIF/IFS
=INDEX(MATCH)

How to Answer

Management –
Management –

Ict HDMC Consolidation HDMC 18

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ict HDMC Consolidation HDMC 18

Uploaded by

Copyright:

Available Formats

ICT CONSOLIDATION

College of Defence Faculty of Decision Sciences

Asset - Anything that has

Threat - Any action or event with the potential to cause harm

Risk – A potential event that a threat will exploit vulnerability in an asset

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

Physical Logical Proactive Reactive

College of Defence Faculty of Decision Sciences

• Issue of Smart Cards • Access to Routers,

• Access to the workstations • Access rights to

College of Defence Faculty of Decision Sciences

Password Guidelines Limiting Availability

Increasing Audit Increasing Control

Limiting User Least Privilege Policy

College of Defence Faculty of Decision Sciences

Data and software

Handling classified Repair Review

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

• Evaluate assets with regard to :-

College of Defence Faculty of Decision Sciences

ASSET THREAT VULNERABILITY

RESTD Varying restriction within the org 2

CONFD Available on need – to – know basis 3

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

Min % Office Hours Availability Asset Value

HA Required for at least 95% whole

College of Defence Faculty of Decision Sciences

Sainik Institute Computer

College of Defence Faculty of Decision Sciences

Threat Probability Rating

College of Defence Faculty of Decision Sciences

Nature/Extent of Vulnerability Rating

College of Defence Faculty of Decision Sciences

– Info Storage at Div GS Branch

– Sainik Institute Computer

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

– Info Storage at Div GS Branch

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

1. Info 6x7x6 1 1. Strict Access Control

College of Defence Faculty of Decision Sciences

Hardware or Software Misconfigurations

Failure to stay up-to-date

College of Defence Faculty of Decision Sciences

Focuses on known weaknesses

Tests for known and unknown weaknesses

Security policies and procedures

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

• An ordered collection of related

College of Defence Faculty of Decision Sciences

Consider your Org with Many Computers…..

College of Defence Faculty of Decision Sciences

College of Defence Faculty of Decision Sciences

• Data is stored in a database in objects