Reference source for threats, vulnerabilities, impacts and controls in IT risk assessment and risk management

Utgivare: Europeiska unionens cybersäkerhetsbyrå
Antagen: 2007-04-26
Språk: engelska
Källa: www.enisa.europa.eu

ENISA ad hoc working group on risk assessment and risk management

Reference source for threats, vulnerabilities, impacts and controls in IT risk assessment and risk management

Deliverable 3 Version 1.0 Date: 26/04/2007 Deliverable 3

ENISA ad hoc working group on risk assessment and risk management 2 / 15 Deliverable 3

1 Introduction

Effective IT risk assessment and management, using the process described on the ENISA website (www.enisa.europa.eu/rmra/rm_process.html), requires the input of information about IT security assets, about threats to these and about their vulnerabilities, about potential impacts on assets, and about controls that can be put in place. Such information is essential to all of the tools, good practices or methodologies for risk assessment and risk management that are catalogued in the inventory on the ENISA Website (http://www.enisa.europa.eu/rmra/rm_ra_methods.html). Inventoried here are therefore a number of sources of information concerning: • Assets • Threats • Vulnerabilities • Impacts • Controls. The preliminary inventory has been compiled by members of the ENISA ad-hoc working group on risk assessment and management. ENISA intend to extend and improve this inventory and regularly review entries. Suggestions for additional entries, or changes to existing entries, are welcomed – please contact: riskmngt@enisa.europa.eu. Each entry in the inventory contains a short description of the information source referenced and the following data: Location: Where the referenced information can be found in the source document. Version and Date: Version and date of the referenced source document. Last updated: Date when ENISA last updated the entry. FoC: Although all referenced documents are publicly available, some may incur an access charge or fee. Where no such charge is made, this is indicated by use of the abbreviation FoC (Free of Charge). The inventory can be used to provide input to support the use of individual tools, good practices or methodologies for risk assessment and risk management. Or it can be used to support individual processes selected from a number of such tools, good practices or methodologies, as chosen according to the system described in the ENISA methodology for evaluating usage and comparison of risk assessment and management items. The table below indicates where inputs and outputs into the 15 processes referenced in the benchmark used by that methodology will benefit from the information presented in this inventory. Asset Threat Vulnerability Impact Control I.2.3 I.2.1 I.5.1 I.4.1 I.6.4 I.4.1 I.5.1 I.5.2 I.5.1 Inputs I.4.2 I.5.2 I.5.2 I.6.2 I.5.3 O.2.3 O.5.1 O.5.2 O.5.3 O.6.3 O.4.2 O.5.7 O.5.7 O.6.4 O.9.1 O.5.2 O.6.2 O.6.2 O.6.6 O.5.4 O.6.1 Outputs O.6.2 O.6.3 O.6.4 O.6.5 O.6.6 O.9.1 ENISA ad hoc working group on risk assessment and risk management 3 / 15 Deliverable 3

2 Table of reference sources

Nr Source Assets Threats Vulnerabilities Impacts Controls

title : location : (e.g. chapter, location : (e.g. chapter, location : (e.g. location : (e.g. location : (e.g. chapter, page version & date : page etc.) page etc.) chapter, page etc.) chapter, page etc.) etc.) description : description : description : description : description : description : hyperlink : hyperlink : hyperlink : hyperlink : hyperlink : hyperlink : free of charge (yes or not) : language : last update :

1 title : Austrian IT Security Handbook location : part 2 "Security ("Österreichisches IT-Sicherheitshandbuch") Measures" version & date : Version 2.2, November 2004 description : description : While part 1 of the handbook gives comprehensive summary of guidelines for the establishment of an IT security technical and organizational management process in on organization, part 2 security controls, comprising: "Security Measures" gives a comprehensive physical and infrastructure summary of technical and organizational security security, human resources controls. security, security management, hyperlink : security in system development, http://www.cio.gv.at/securenetworks/sihb/ technical controls, security in free of charge : yes operation, business continuity. language : German hyperlink : last update : 16.04.2007 http://www.cio.gv.at/securenetw orks/sihb

2 title : C.E.R.T. location version & date : continuous description : gives description : web site on vulnerabilities support on hyperlink : remediation on the http://www.cert.org/nav/index_red.html vulnerabilities free of charge : yes hyperlink : language : English http://www.cert.org/ last update : 16.04.2007 nav/index_red.html

3 title : CobiT 4.0 location : refer to the location : refer to the ISACA version & date : Version 4.0, 2005 ISACA brochure "COBIT brochure "COBIT Mapping: description : CobiT is an IT governance Mapping: Mapping of Mapping of ISO/IEC 17799: framework supporting business alignment of IT ISO/IEC 17799: 2005 With 2005 With COBIT 4.0" and IT auditing. It defines 34 IT processes and COBIT 4.0" description : several parts of about 215 detailed control objectives, providing description : several parts the Cobit framework must be generic information on security controls, as well of the Cobit framework considered as efficiency and compliance. must be considered hyperlink : www.isaca.org

ENISA ad hoc working group on risk assessment and risk management 5 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

hyperlink : www.isaca.org hyperlink : www.isaca.org free of charge : yes language : English, French, German, Italian, Japanese, Portuguese, Spanish last update : 29.03.2007

4 title : Common Criteria for Information location location : location : Part 2 Technology Security Evaluation Description : Due Description : Due to Description : Are widely version & date : Version 3.1, revision 1, to its non-RARM its non-RARM covered (grouped in an September 2006 methodology methodology nature, exhaustive number of functional description : Common Criteria for Information nature, CC have CC have very little if classes) Technology Security Evaluation (shortly CC) is very little if none none consideration of hyperlink : not a Risk Analysis and Management consideration of impact. www.commoncriteriaportal.org methodology: it is primarily intended as a guide to vulnerability, hyperlink assist the user in individuating and formally considered only at :www.commoncriteria defining security requirements for a given TOE glossary level portal.org (Target Of Evaluation). It provides the users with hyperlink : a guidance suitable to describe with different www.commoncriter degrees of formality how security requirements iaportal.org are individuated (may be using a RARM method), how they are fulfilled and how related countermeasures are set-up. The deliverables of such a standard are the typical ones able to enter a certification process, which is the ultimate goal of CC usage. Keep in mind that a security certification scheme like the CC one doesn’t certify the capability of a product or a process or an organisation to contrast all possible attacks, but merely certifies that declared countermeasures free of charge : yes language :English, German last update : 16.04.2007

5 title : CSI/FBI survey location : can vary each location : can vary location : can vary version & date : published each year year each year each year description : The Computer Crime and Security description : result on a description : result description : result on Survey is conducted by the Computer Security survey in the United States on a survey in the a survey in the United

ENISA ad hoc working group on risk assessment and risk management 6 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

Institute (CSI) with the participation of the San hyperlink : United States States Francisco Federal Bureau http://www.gocsi.com/ hyperlink : hyperlink : of Investigation’s (FBI) Computer Intrusion http://www.gocsi.co http://www.gocsi.com/ Squad. It is based on the responses of computer m/ security practitioners in U.S. corporations, government agencies, financial institutions, medical institutions and universities. hyperlink : http://www.gocsi.com/ free of charge : yes language : English last update : 29/03/2007

6 title : DTI Information Security Breaches Survey location : Part location : Part “Security – Technical report (PricewaterhouseCoopers) “Security Breaches“ Controls” version & date : April 2006, carried out every description : description : two years hyperlink : hyperlink : description : Survey of UK businesses, provides www.dti.gov.uk/sector www.dti.gov.uk/sectors/infosec/ information on security incidents suffered by s/infosec/index.html index.html businesses, both large and small. hyperlink : www.dti.gov.uk/sectors/infosec/index.html free of charge : yes language : English last update : 29.03.2007

7 title : ISO/IEC 17799:2005 "Information location : chapters 5 to 15 refer technology –Security techniques - Code of also to the ISACA brochure practice for information security management" "COBIT Mapping: Mapping of version & date : 2005 ISO/IEC 17799: 2005 With description : This international standard gives COBIT 4.0" guidelines and general principles for establishing description : Implementing and maintaining information security management ISO/IEC 17799 (27002) will in an organization. It provides a list of 133 generic give the guidance of security controls. implementing controls to be able hyperlink : http://www.iso.org and national to provide certification against standardization bodies the ISO/IEC 27001 (http://www.nia.din.de/sixcms/detail.php?id=5195 hyperlink : http://www.iso.org

ENISA ad hoc working group on risk assessment and risk management 7 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

) and national standardization free of charge : no bodies language : English, French, Russian, German last update : 29.03.2007

8 title : ISO/IEC 27005 "Information technology – location : Annexes B1 and location : Annex C location : Annex D location : Section 7.2 location : Section 9 Information Security techniques - Information security risk B2 description : Annex C description : Annex (Basic criteria) p11. security risk treatment. management (draft)" description : In Annex B1 contains a list of about 40 D gives examples of Annex B3 (Impact description : version & date : draft (Asset identification) sorts typical threats and their vulnerabilities and assessment) p47. This section sorts risk controls description : This international standard provides assets are sorted into: possible origin (accidental, corresponding description : into: guidelines for information security risk 1. Primary assets - environmental or threats and some Section 7.2 p11 "Basic 1. Risk avoidance management in an organization. 1.1Business process & deliberate). For deliberate methods for criteria" proposes a list 2. Risk transfer hyperlink : http://www.iso.org and national activities, threats a description of vulnerability of 6 impact criteria. 3. Risk reduction standardization bodies -1.2. Information possible threat sources assessment Annex B3 (Impact (refers to ISO 27002), (http://www.nia.din.de/sixcms/detail.php?id=5195 2. Supporting assets (hackers, insiders, hyperlink: assessment) p47 4. Risk retention (referring to ) -2.1 Hardware terrorists,...) and threat proposes a ISO27001-4.2.1 free of charge : not yet published (restricted to -2.2 Software actions is given. hyperlink: characterization of an hyperlink ISO experts), -2.3 Network operational impact: published standard will not be free of charge -2.4 Personnel direct (4 items) or language : English -2.5 Site indirect (5 items) last update : 29.03.2007 -2.6 Organization. Annex B2 (Asset valuation) Hyperlink: gives a list of criteria. hyperlink:

9 title : IT-Grundschutz location : Chapter location : Chapter location : IT- location : Chapter "Catalogues version & date : December 2006 "Catalogues of Modules" "Catalogues of threats" Grundschutz of Safeguards" description : The IT-Grundschutz Catalogues description : In IT- description : IT- Methodology, BSI- description : IT-Grundschutz provide lists of typical relevant threats and the Grundschutz the assets Grundschutz provides a list Standard 100-2, Page provides a list of thesafeguards respective standard security measures for standard addressed are handled in of the threats that are 39 that are considered to be asset-types. Technical, organisational, personnel "modules". Each module considered to be relevant description : The IT- relevant for the addressed assets and infrastructural issues are encountered. The describes a standard use of for the addressed assets Grundschutz (modules). The version 2006 of information is publicly available and free of costs. the asset and the relevant (modules). The version Methodology provides the IT-Grundschutz Catalogues hyperlink : threats and security 2006 of the IT-Grundschutz a list of high-level contains more than 1000 http://www.bsi.de/gshb/deutsch/index.htm measures. The modules are Catalogues contains more impacts as a basis for safeguards. Each safeguard is (German), grouped into the layers: than 400 threats. For each the definition of the provided with a detailed http://www.bsi.de/english/gshb/index.htm generic aspects, threat a detailed description protection description, the responsible roles

ENISA ad hoc working group on risk assessment and risk management 8 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

(English) infrastructure, IT systems, is given. requirements of the for initiation and free of charge (yes or not) : yes network, applications. hyperlink : assets. implementation and a set of language : German, English Version 2006 of IT- http://www.bsi.de/gshb/deu hyperlink : check questions. last update : 29.03.2007 Grundschutz Catalogues tsch/g/g01.htm http://www.bsi.de/liter hyperlink : contains 70 modules. at/bsi_standard/index. http://www.bsi.de/gshb/deutsch/ hyperlink : htm m/m01.htm http://www.bsi.de/gshb/deu tsch/baust/b01.htm

10 title : kes/Microsoft-Sicherheitsstudie 2006 - location : Part 1 location : Part 2 Lagebericht zur Informations-Sicherheitsicherheit description : The first description : The second part of version & date : October 2006 part of the survey the survey contains statistical description : The magazine “kes” carries out a contains statistical information on the IT security survey on the IT security status in Germany every information on kind, measures already implemented. 2 years. The last study provides information on IT extend and costs of IT Hyperlink : http://www.kes.info risks, IT security attacks and IT security status in security damages Access requires password Germany. The survey can be purchased from during the last 3 years. SecuMedia Publishing House Hyperlink : hyperlink : http://www.kes.info/ http://www.kes.info free of charge (yes or not) : no Access requires language : German password last update : 16.04.2007

11 Title : Location : Location Location Location : Location : EBIOS EBIOS-Guide Section 4 EBIOS-Guide Section 4 EBIOS-Guide EBIOS-Guide EBIOS-Guide Section 5 Version & Date : "Tools for assessing ISS "Tools for assessing ISS Section 4 "Tools Section 3 "Tools for treating ISS risks" version 2, 2004-02-05 risks" pp 7-23. risks" pp 24-53. for assessing ISS "Techniques" pp 21- pp 1-198. Description : Description: Description : risks" pp 54-188. 22. Description EBIOS-Guide : In EBIOS, an asset is Classification of 42 generic Description : Description 1. Knowledge bases of generic -Section 4 "Tools for assessing ISS risks". composed of an essential attack methods, according Classification of Table of 22 (proposed) security objective, arranged -Section 5 "Tools for treating ISS risks" element (ie. immaterial part to 8 types: generic relevant impacts. according to entity types. These 2 sections contain the following EBIOS that carries the asset value) 1. Compromise of vulnerabilities These impacts on 2. Knowledge base of knowledge bases: and entities (ie. concrete information, according to 42 business processes are functional security requirements, 1. A classification of entities according to types parts that support the asset). 2. Compromise of attack methods that used to assess the integrating: and sub-types, The essential elements are functions, can exploit them, security needs of each -ISO-IEC-15408 (11 types), 2. A classification of 42 generic attack methods, of 2 types: 3. Technical failures, and with cross- asset with respect to -ISO-IEC-17799 (10 types), with a detailed description (corresponding threat 1. Function (ie. business 4. Unauthorised actions, references to type or security criteria and -DCSSI-PSSI (Information-

ENISA ad hoc working group on risk assessment and risk management 9 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

agent profiles and impacts, …), process) 5. Physical damage, sub-type of entities the corresponding System-Security Policy) (16 3. A classification of generic vulnerabilities, 2. Information 6. Natural events, (Entity sub-types scales of security types) cross-referenced to attack methods and entities (inputs/outputs of 7. Loss of essential services inherit of needs. -Other sources (15 types). knowledge bases. functions). 8. Disturbance due to vulnerabilities of These proposed These requirements cover a wide 3. A classification of security objectives and radiation. their entity type). impacts are also spectrum of controls ranging security requirements for risk treatment, with EBIOS provides with a (classification compliant to hyperlink : referred to as from technical to organizational cross-references to attack methods base and classification of entities ISO/IEC27005) http://www.ssi.gouv "consequences" in and training/awareness controls. vulnerabilities base, together with coverage into types and subtypes All attack methods are .fr/en/confidence/do each attack method 3. Coverage table of tables. Theses security objectives and with detailed description described with the cuments/methods/eb description given in vulnerabilities by security requirements are recompiled and rearranged from and examples. following details: iosv2-section4- EBIOS Guide section objectives according to attack major ISO standards, DCSSI-PSSI and EBIOS- The 7 entities types are : 1. Affected security needs outillageappreciatio 4 §3 (pages 26-53). methods. Club-Best-practices. 3. Hardware, criteria, n-2004-02- hyperlink : 4. Coverage table of security All these knowledge bases are implemented and 4. Software, 2. Threat agent profiles 05_en.pdf http://www.ssi.gouv.fr objectives by security intertwined in EBIOS software. Cross-references 5. Network, with type of intentionality /en/confidence/docum requirements according to types are then automatically carried out by the software 6. Personnel, (natural, human, ents/methods/ebiosv2- and subtypes of entities. tool, giving real added value to consultant when 7. Site, environmental), section3-techniques- Coverage tables are useful to filling up an EBIOS study. 8. Organization 3. Resources needed for 2004-02-05_en.pdf ensure security controls are Those knowledge bases result from experience 9. System him to act (time, money, necessary and sufficient. They feedback of DCSSI experts or EBIOS club These classifications are skills,…), are also needed when dealing members, and from various ISO standards. They compliant to (draft) 4. Feared consequences, with defence in depth are constantly maintained for relevance and ISO/IEC27005. 5. Examples. (resilience). exhaustiveness. hyperlink : hyperlink : hyperlink : Consultants may also use a base of 13 best http://www.ssi.gouv.fr/en/c http://www.ssi.gouv.fr/en/c http://www.ssi.gouv.fr/en/confid practices guides, convenient when producing onfidence/documents/meth onfidence/documents/meth ence/documents/methods/ebiosv deliverables in accordance with a specific ods/ebiosv2-section4- ods/ebiosv2-section4- 2-section5-outillagetraitementtemplate: NATO (CSRS, SSRS, SISRS, outillageappreciation-2004- outillageappreciation-2004- 2004-02-05_en.pdf SECOPS…), ISO- 15408 (Protection Profile, 02-05_en.pdf 02-05_en.pdf Security Target), ISO-17799 (Security Policy) ISO-27001 (Risk Treatment Plan, Statement of Applicability).

nyperlink :

http://www.ssi.gouv.fr/en/confidence/ebiospresent ation.html

Free of charge: yes

Language : French, English, German, Spanish. Last update : 29.03.2007

ENISA ad hoc working group on risk assessment and risk management 10 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

12 title : Mac Afee location : version & date : continuous description : description : hyperlink : hyperlink : http://us.mcafee.com/virusInfo/d http://us.mcafee.com/virusInfo/default.asp?WW efault.asp?WWW_URL=www. W_URL=www.mcafee.com/anti-virus/default.asp mcafee.com/antifree of charge: virus/default.asp language : English, French last update : 29.03.2007

13 title : MAGERIT – versión 2. Metodología de location : Magerit methods, location : Magerit methods, location : Magerit location : Magerit location : Magerit methods, Análisis y Gestión de Riesgos de los Sistemas de chapter 2 chapter 2 (page 20) and methods, chapter 2 methods, chapter 2, chapter 2, page 23. Chapter 6 of Información description : Relevant chapter 5 of the “Elements description : In page 21 the “Elements catalogue” gives a version & date :version 2, 2005 assets are identified and catalogue” that gives a list comparasing with description : Direct list of suitable safeguards for description : The first version of MAGERIT is defined in respect to of typical threats. Magerit v1.0, the derivation of impact is each type of asset. dated in 1997. In 2005 Electronic Government relation and operations they description : The valuation “vulnerability” explained, as well as description : Procedures or Council (Consejo Superior de Administración perform on data. Chapter 2 of threats is described with concept is now accumulated and technological mechanisms that Electrónica, CSAE) has prepared version 2 of the of the “Elements two aspects: degradation incorporated using deflected impact. reduce the risk are called Risk Analysis and Management Methodology for catalogue” gives a list of and frequency. the degradation These determine the safeguards or counter-measures the information systems of Public types of assets.The threats hyperlink : measurements of impact of a threat on in Magerit 2, although term Administrations, MAGERIT (the Spanish and safeguards are different http://www.csae.map.es/csi the asset and the an asset in a certain security controls is also used for acronym) and recently this version has been according to the type of /pg5m20.htm frequency with dimension. This measuring effectiveness of these translated to English. assets. The concept of which the threat chapter also explaines safeguards. These are described hyperlink : “dependencies between occurs. how single impacts and classified in different terms http://www.csae.map.es/csi/pg5m20.htm assets” is introduced and Hyperlink : none may be aggregated (preventive, degradation free of charge : yes explained.Value and under certain limitation, according to their language : Spanish, English dimensions of assets are conditions. effectiveness...). In Appendix 1 last update : 29.03.2007 also discussed. Furthemore, hyperlink : (Glossary), page 99, several quantitative and qualitative http://www.csae.map.e definitions for terms safeguard, valuations are explained s/csi/pg5m20.htm countermeasures and controls with the pointers to are given. chapters 8.1 and 8.2 that hyperlink : give analysis model based http://www.csae.map.es/csi/pg5 on these valuations.Finally, m20.htm one exception (the valuation of the

ENISA ad hoc working group on risk assessment and risk management 11 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

interruption of the availability) is described with a use of a more complex structure.

hyperlink :

http://www.csae.map.es/csi /pg5m20.htm

14 title : NIST SP 800-30 : Risk Management guide location : chapter 3.2 location : chapter location : chapter 4.4 for Information technology systems description : It contains a 3.3 description : a list of security version & date : July 2002 list of typical human threats description : gives control categories description : The document provides a (threat source, motivation some examples for hyperlink : foundation for the development of a risk and threat actions) vulnerability/threat http://csrc.nist.gov/publications/ management and gives definitions and practical hyperlink : pairs nistpubs/ guidance. http://csrc.nist.gov/publicati hyperlink : hyperlink : ons/nistpubs/ http://csrc.nist.gov/p http://csrc.nist.gov/publications/nistpubs/ ublications/nistpubs free of charge : yes / language : English last update : 29.03.2007

15 title : OCTAVE ("Operationally Critical Threat, location : OCTAVE SM location : White Paper location : OCTAVE location : OCTAVE Catalog of Asset, and Vulnerability Evaluation") Method Implementation “OCTAVE Threat Profiles” SM Method Practices, Version 2.0 version & date : Version 2.0, Guide Version 2.0, Volume description : A list of Implementation Guide description :This document description : OCTAVE is a comprehensive RA 7: Process 5 – Identify Key generic security controls is Version 2.0 Volume 9: outlines the set of practices method and is supported by a number of papers Components given to build asset-based Process 7 – Conduct against which organizations can outlining different aspects of RA, eg the White description : Within Threat Profiles Risk Analysis §10.1 compare their own practices paper on "OCTAVE threat profiles" and the Process 5 the key hyperlink : Risk Impact during OCTAVE. "Catalogue of practices", which can be regarded components of the http://www.cert.org/octave/ Descriptions and hyperlink : as list of generic security controls. infrastructure for each pubs.html Values for Critical http://www.cert.org/archive/pdf/ hyperlink : critical asset are identified Assets 01tr020.pdf http://www.cert.org/octave/methods.html . description : Contains free of charge: a table with language : English descriptions of last update : 29.03.2007 impacts to the organization. hyperlink :

ENISA ad hoc working group on risk assessment and risk management 12 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

http://www.cert.org/oc tave/pubs.html

16 title : OWASP web site location : specific web location : specific version & date : continuous page web page description : The Open Web Application Security description : give general description : give Project (OWASP) is dedicated to finding and information on threat general information fighting the causes of insecure software. hyperlink : on vulnerability Everything here is free and open source. The http://www.owasp.org/inde hyperlink : OWASP Foundation is a 501c3 not-for-profit x.php/Category:Threat_Ag http://www.owasp.o charitable organization that ensures the ongoing ent rg/index.php/Catego availability and support for our work. ry:Vulnerability hyperlink : http://www.owasp.org/index.php/Main_Page free of charge: yes language : English last update : 16.04.2007

17 title : Secunia web site location : website location n : website version & date continuous description : advisories on description : description : this website is a portal that gives viruses advisories on information on virusses and also news related to hyperlink : system information security.It is not related to a specific http://secunia.com/ imperfections supplier hyperlink : hyperlink : http://secunia.com/ http://secunia.com/ free of charge (yes or not) : yes language : English last update : 16.04.2007

18 title : Securityfocus portal location : website version & date : continuous description : allow description : portal related to information search on several security criteria for hyperlink : http://www.securityfocus.com vulnerabilities free of charge: yes hyperlink : language : English http://www.security last update : 16.04.2007 focus.com/vulnerabi

ENISA ad hoc working group on risk assessment and risk management 13 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

lities

19 title : Sophos location :specific web pages version & date : continuous description : give description : Vendor website with relevant informationon control to put in information places hyperlink : http://www.sophos.com/security/ hyperlink : free of charge: yes http://www.sophos.com/security language : English / last update : 16.04.2007

20 title : Symantec Internet Security Threat Report location : website location : website (ISTR) description : descriptions description : version & date : continuous of threats description and description : Vendor website with relevant hyperlink : resolution of information http://www.symantec.com/ vulnerabilities hyperlink : enterprise/threatreport/inde hyperlink : http://www.symantec.com/enterprise/threatreport/ x.jsp http://www.symante index.jsp c.com/enterprise/thr free of charge : yes eatreport/index.jsp language : English last update : 16.04.2007

21 title : Systems Security Engineering — Capability location : several Maturity Model (SSE-CMM) / ISO/IEC description : descriptions 21827:2002 of threats version & date : 2002 hyperlink : description : The SSE-CMM describes the http://www.symantec.com/ essential characteristics of an organization's enterprise/threatreport/inde security engineering process that must exist to x.jsp ensure good security engineering. hyperlink : www.sse-cmm.org/index.html free of charge: yes language : English last update : 16.04.2007

22 title : The IT-Security Situation in Germany in location : Chapter 4, location : Chapter 3 IT-

ENISA ad hoc working group on risk assessment and risk management 14 / 15 Deliverable 3

Nr Source Assets Threats Vulnerabilities Impacts Controls

2005 Vulnerabilities of and Security Awareness and ITversion & date : 2005 Threats to IT Systems, security Competence in description : This report presents the current IT- Page 14 Society, Page 9 security situation in Germany, provides lists of description : The report description : List o threats threats priorised according to their importance and contains statistics on and statistics on their their damage as well as statistics on IT security vulnerabilities and on the importance today and in the attacks. The report makes also a categorisation respective exploits. future and evaluation of trends in IT security. The hyperlink : hyperlink : information is publicly available and free of costs. http://www.bsi.de/english/p http://www.bsi.de/english/p hyperlink : ublications/securitysituatio ublications/securitysituatio http://www.bsi.de/english/publications/securitysit n/lagebericht2005_englisch n/lagebericht2005_englisch uation/lagebericht2005_englisch.pdf .pdf .pdf free of charge: yes language : German, English last update : 16.04.2007

Reference source for threats, vulnerabilities, impacts and controls in IT risk assessment and risk management

ENISA ad hoc working group on risk assessment and risk management