---
# System prepended metadata

title: Tabel vulnerability-Threat part 1/2

---

You are absolutely right! My apologies for the misunderstanding. I was still stuck in the one-threat-per-asset mindset.

Let's redo Step 2.2 correctly. Each asset will have **three** threats, one each corresponding to **Confidentiality (C), Integrity (I), and Availability (A)**. Each threat will also have a threat value (1-3) based on its frequency, as defined on page 7 of the assignment document.

Here is the revised Step 2.2 table with three threats per asset mapped to C, I, and A:

**Threat Identification and Mapping Table:**

| Asset No. | Asset                                                                                   | Vulnerability                                                                                                                                                                                                                                                            | V. Value | V. Reason                                                                                                                                                                                                                                                                                                                                                                | C. Threat                                                                        | C. Threat Value | C. Threat Reason                                                                                                                                  | I. Threat                                                                              | I. Threat Value | I. Threat Reason                                                                                                                                      | A. Threat                                                                     | A. Threat Value | A. Threat Reason                                                                                                                               |
| :-------- | :-------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------- | :-------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------------------ | :---------------------------------------------------------------------------- | :-------------- | :--------------------------------------------------------------------------------------------------------------------------------------------- |
| 1         | Official GDP Figures and Growth Rate Statistics                                        | **Inadequate Access Control and Data Handling Practices**                                                                                                                                                                                                               | 2        | While the *impact* of compromised economic data is severe, exploitation requires a threat with the means to bypass access controls and data handling. This is less likely to occur once a generic threat shows up. So, once the threat *frequently* targets such systems, this becomes vulnerable.                                                             | **Data Breach by External Attackers**                                               | 2               | While significant, these attackers may not *constantly* target GDP data.                                                                     | **Data Manipulation by Malicious Insider**                                              | 2               | Requires a trusted insider with access, making it less frequent than a constant threat.                                                              | **DoS Attack Targeting Economic Data Repositories**                          | 1               | Unlikely to be a frequent target; availability of this specific data is not as critical as other assets.                                           |
| 2         | Trade Agreements and Related Documentation                                             | **Insufficient Protection Against Unauthorized Access and Disclosure**                                                                                                                                                                                                 | 2        | While highly sensitive, exploiting the lack of strong access controls and encryption *frequently* during an intrusion attempt is more probable than immediately with a single generic threat.                                                                                                                                                             | **Espionage by Foreign Governments**                                                | 2               | A realistic threat, as foreign entities may have an interest in sensitive trade information, but likely targeted, not constant.                   | **Data Falsification by Disgruntled Employees**                                        | 1               | Less likely and less frequent; requires specific motivation and access.                                                                                   | **System Outage Due to Hardware Failure**                                    | 1               | Availability of trade agreement data is less critical than operational data; hardware failures are less frequent.                                      |
| 3         | Financial Forecasts and Projections                                                     | **Inadequate Data Integrity Controls and Insider Threat**                                                                                                                                                                                                                | 2        | While the impact is high, exploiting a lack of data integrity controls requires an insider threat or a frequent threat who targets such systems. A general threat will not immediately access such system with ease, so, a value of 2.                                                                                                                               | **Leak of Sensitive Information by Insider**                                       | 2               | Possible but requires an insider with access and intent, making it less frequent than a constant threat.                                             | **Data Corruption by Software Glitch**                                                   | 2               | Software glitches that affect data integrity can happen, but are not a constant threat.                                                                    | **DDoS Attack Targeting Financial Data Systems**                              | 1               | While possible, unlikely to be a frequent occurrence; less critical than availability of operational systems.                                      |
| 4         | Tax Revenue Data                                                                        | **Compromised Data Security Due to Weak Access Controls and Encryption**                                                                                                                                                                                               | 2        | While sensitive, exploiting weak controls and encryption requires more than just a generic threat and *frequent* attempts. An occasional threat would not expose this.                                                                                                                                                                                          | **Unauthorized Access by Cybercriminals**                                          | 2               | Cybercriminals may target this data for financial gain, but it might not be a constant threat.                                                      | **Data Modification by Malicious Insider**                                               | 1               | Requires specific motive and access; less frequent.                                                                                                       | **System Downtime Due to Power Outage**                                       | 1               | While power outages can occur, they are infrequent and less likely to specifically target tax data systems.                                               |
| 5         | Geological Survey Reports and Maps (Mineral Reserves)                                  | **Vulnerabilities in GIS and Data Management Systems**                                                                                                                                                                                                                | 2        | While GIS vulnerabilities are significant, they require *frequent* targeting of the specific GIS and data management systems.                                                                                                                                                                                                  | **Theft of Data by Competitors**                                                     | 2               | Industrial espionage is a possibility, but likely to be targeted, not a constant threat.                                                              | **Data Tampering by Disgruntled Employee**                                                 | 1               | Requires specific motive and access, making it less frequent.                                                                                              | **System Failure Due to Natural Disaster**                                   | 1               | While possible, natural disasters affecting these specific systems are infrequent.                                                                      |
| 6         | Resource Estimation Reports (Mineral Reserves)                                         | **Insufficient Data Integrity and Validation Controls**                                                                                                                                                                                                                 | 2        | While the *impact* is severe, exploitation of the lack of data integrity is not possible once the threat occurs, instead it is possible when the threat *frequently* appears.                                                                                                                                                             | **Leak of Confidential Information by Employees**                                   | 1               | Possible but less likely and less frequent than a targeted attack.                                                                                      | **Data Corruption by Faulty Software Update**                                             | 2               | While possible, faulty software updates are not a constant threat.                                                                                          | **Denial of Service Attack on Data Repositories**                              | 1               | Availability of these reports is less critical than operational systems, making DoS attacks less likely.                                                   |
| 7         | Contracts and Agreements with Mining Companies                                         | **Inadequate Physical and Digital Document Security**                                                                                                                                                                                                                | 2        | While the potential impact is significant, unauthorized disclosure requires *frequent* attempts to bypass physical security or digital controls.                                                                                                                                                                                          | **Theft of Physical Documents by Unauthorized Personnel**                               | 2               | Possible but requires physical access, making it less frequent than a constant threat.                                                                    | **Unauthorized Modification of Contracts by Insider**                                      | 1               | Requires specific motive and access; less frequent.                                                                                                       | **Loss of Documents Due to Fire or Flood**                                     | 1               | While possible, these events are infrequent.                                                                                                              |
| 8         | Agricultural Crop Yield Statistics                                                      | **Data Integrity Issues Due to Inadequate Input Validation and Monitoring**                                                                                                                                                                                          | 2        | Exploiting data validation issues to misrepresent crop yields requires *frequent* opportunities to manipulate data over time.                                                                                                                                                                                          | **Leak of Data by Employees**                                                           | 1               | Less likely and less frequent; not highly sensitive data.                                                                                                   | **Data Manipulation by External Actors (e.g., for market manipulation)**                    | 2               | Possible, but requires motive and capability, making it less frequent than a constant threat.                                                              | **System Downtime Due to Server Maintenance**                                 | 1               | Planned maintenance is infrequent and usually announced in advance.                                                                                       |
| 9         | Agricultural Export Volumes                                                             | **Data Manipulation and Reporting Errors**                                                                                                                                                                                                                            | 2        | Exploiting data manipulation and reporting errors requires a threat who is *frequently* attempting to change data over time.                                                                                                                                                                                                  | **Unauthorized Disclosure of Data**                                                     | 1               | Less likely and less frequent; not highly sensitive data.                                                                                                   | **Data Falsification by Employees**                                                           | 2               | Possible, but requires motive and opportunity, making it less frequent than a constant threat.                                                              | **Disruption of Data Reporting Systems**                                       | 1               | Less likely and less critical than disruption of operational systems.                                                                                       |
| 10        | Geological Survey Reports (Offshore Oil and Gas)                                       | **Compromised Data Security and Unauthorized Access**                                                                                                                                                                                                                | 2        | While data is highly sensitive, a threat would need *frequent* attempts to compromise access controls and encryption.                                                                                                                                                                                            | **Espionage by Foreign Governments or Competitors**                                    | 2               | A realistic threat due to the strategic importance of oil and gas, but likely to be targeted, not constant.                                              | **Data Tampering by Malicious Insider**                                                    | 1               | Requires specific motive and access; less frequent.                                                                                                       | **System Failure Due to Software Glitch**                                     | 1               | While possible, software glitches causing system failures are less frequent.                                                                                 |
| 11        | Seismic Data (Offshore Oil and Gas)                                                    | **High Sensitivity Data with Inadequate Protection**                                                                                                                                                                                                                 | 2        | While very sensitive, exploiting this requires the threat to be *frequently* targeting these systems.                                                                                                                                                                                              | **Theft of Data by Foreign Intelligence Agencies**                                       | 2               | A realistic threat due to the strategic importance of oil and gas, but likely to be targeted, not constant.                                              | **Data Corruption Due to Hardware Malfunction**                                           | 1               | Less frequent than a targeted attack.                                                                                                                     | **Denial of Access Due to Natural Disaster**                                  | 1               | While possible, natural disasters affecting these specific systems are infrequent.                                                                      |
| 12        | Drilling Reports (Offshore Oil and Gas)                                                | **Vulnerabilities in Data Collection and Reporting Systems**                                                                                                                                                                                                        | 2        | While it impacts business decisions, exploiting the vulnerabilities requires the threat to be *frequently* targeting data collection and reporting system.                                                                                                                                                                                          | **Leak of Confidential Information by Employees or Contractors**                        | 2               | Possible, but likely to be targeted, not a constant threat.                                                                                             | **Data Falsification by Employees to Inflate Production Figures**                            | 2               | Requires motive and opportunity; less frequent, but possible.                                                                                              | **Disruption of Data Reporting Due to Network Issues**                          | 1               | Less frequent and less critical than disruption of operational systems.                                                                                       |
| 13        | Environmental Impact Assessments (Oil & Gas)                                           | **Insufficient Document Security and Access Controls**                                                                                                                                                                                                            | 2        | This is sensitive but does not represent a high exploitable attack vector to require a 3. This will require *frequent* attempts.                                                                                                                                                                                            | **Unauthorized Disclosure by Hacktivists**                                                | 2               | Possible, driven by environmental concerns, but might not be a constant threat.                                                                             | **Data Modification by Disgruntled Employees**                                             | 1               | Requires specific motive and access; less frequent.                                                                                                       | **Loss of Data Due to Accidental Deletion**                                  | 1               | While possible, less frequent than a targeted attack.                                                                                                         |
| 14        | Production Forecasts (Oil & Gas)                                                        | **Data Integrity and Unauthorized Access Risks**                                                                                                                                                                                                                  | 2        | While the impact can be severe, a threat must *frequently* attempt to modify data. So, the vulnerability is only exploitable when the threat frequently attempts access to it.                                                                                                                                                                         | **Espionage by Competitors**                                                                | 2               | Industrial espionage is a possibility, but likely to be targeted, not constant.                                                                             | **Data Manipulation by Malicious Insider to Impact Market Prices**                           | 2               | Requires motive, access, and opportunity; less frequent but possible.                                                                                     | **System Downtime Due to Server Failure**                                     | 1               | While possible, server failures are less frequent and less critical than disruption of operational systems.                                                     |
| 15        | Pipeline Infrastructure Schematics (Oil & Gas)                                          | **Security Vulnerabilities in Systems Storing and Displaying Schematics**                                                                                                                                                                                          | 2        | Requires an attacker to specifically target pipeline schematic systems, a task that is not likely with one attempt. This is possible when a threat is *frequently* accessing the system.                                                                                                                                                            | **Theft of Data by Terrorist Organizations**                                               | 2               | A serious threat, but likely to be targeted, not constant.                                                                                                 | **Data Tampering by Malicious Insider to Cause Disruption**                                 | 2               | Requires high-level access and specific motive; less frequent but possible.                                                                                  | **Denial of Access Due to System Sabotage**                                   | 2               | Possible but requires physical access or sophisticated cyberattack; less frequent than other threats.                                                              |
| 16        | Employment Statistics by Sector                                                         | **Data Integrity and Collection Errors**                                                                                                                                                                                                                          | 1        | Errors in data collection are only possible when the collection process is *very frequently* being used. These are human errors or errors introduced with data collection software used at this time.                                                                                                                                                 | **Unauthorized Disclosure of Data by Employees**                                           | 1               | Less likely and less frequent; not highly sensitive data.                                                                                                   | **Data Manipulation by Employees**                                                            | 1               | Less likely and less frequent; limited impact.                                                                                                               | **System Downtime Due to Software Update**                                    | 1               | Planned updates are infrequent and announced in advance.                                                                                                     |
| 17        | Skill Gap Analyses                                                                     | **Data Security and Potential for Misuse**                                                                                                                                                                                                                        | 2        | While there are risks, it is unlikely this can be exploited immediately when the threat appears once. It needs *frequent* attempts.                                                                                                                                                                                          | **Leak of Information by Disgruntled Employees**                                          | 1               | Less likely and less frequent; limited impact.                                                                                                               | **Data Falsification by Employees**                                                            | 1               | Less likely and less frequent; limited impact.                                                                                                               | **System Downtime Due to Server Maintenance**                                 | 1               | Planned maintenance is infrequent and usually announced.                                                                                                     |
| 18        | Educational Attainment Levels of Workforce                                              | **Data Accuracy and Reporting Vulnerabilities**                                                                                                                                                                                                                  | 1        | Errors are most likely introduced with *very frequent* reporting and manipulation of the data entry and reporting itself. Otherwise, a single attack will not make this data exploitable immediately.                                                                                                                                           | **Unauthorized Access to Data by External Parties**                                       | 1               | Less likely and less frequent; limited impact.                                                                                                               | **Data Manipulation by Employees**                                                            | 1               | Less likely and less frequent; limited impact.                                                                                                               | **System Downtime Due to Hardware Failure**                                   | 1               | Less likely and less frequent; limited impact.                                                                                                               |
| 19        | Specific Infrastructure Project Proposals and Blueprints (Roads, Rail, etc.)            | **Vulnerabilities in Document Management and Access Control Systems**                                                                                                                                                                                                 | 2        | While access controls might be weak, a single generic threat will not be able to expose this system with one attempt. Requires *frequent* attempts.                                                                                                                                                                                             | **Theft of Intellectual Property by Competitors**                                          | 2               | Industrial espionage is a possibility, but likely to be targeted, not constant.                                                                             | **Data Modification by Disgruntled Employees**                                             | 1               | Requires specific motive and access; less frequent.                                                                                                       | **Loss of Data Due to Accidental Deletion**                                  | 1               | While possible, less frequent than a targeted attack.                                                                                                         |
| 20        | Financial Agreements with Infrastructure Investors                                      | **Insufficient Document Security and Contract Management Practices**                                                                                                                                                                                               | 2        | Though sensitive, exploiting the inadequate document security requires frequent attempts to get access to these systems and documents. A general threat would not do this with a single attempt.                                                                                                                                                     | **Leak of Confidential Information by Employees or Contractors**                        | 2               | Possible, but likely to be targeted, not a constant threat.                                                                                             | **Unauthorized Alteration of Agreements by Malicious Insider**                             | 1               | Requires high-level access and specific motive; less frequent.                                                                                              | **System Downtime Due to Power Outage**                                       | 1               | Less frequent and less critical than disruption of operational systems.                                                                                       |
| 21        | Progress Reports on Infrastructure Development                                         | **Data Integrity and Reporting Accuracy Vulnerabilities**                                                                                                                                                                                                            | 2        | Errors in data collection and reporting requires *frequent* manipulation or access to systems where these reports are generated and stored. A single attack will not have an immediate impact.                                                                                                                                                               | **Unauthorized Disclosure of Information by Employees**                                    | 2               | Possible, but may not be a constant threat.                                                                                                               | **Data Falsification by Contractors to Hide Delays or Overruns**                             | 2               | Requires motive and opportunity; less frequent but possible.                                                                                              | **Disruption of Reporting Systems Due to Network Issues**                       | 1               | Less frequent and less critical than disruption of operational systems.                                                                                       |
| 22        | Diplomatic Communications and Strategy Documents (G20)                                | **High-Value Target with Inadequate Protection Against Unauthorized Disclosure**                                                                                                                                                                                       | 2        | Though sensitive, unauthorized disclosure requires a threat who is *frequently* making attempts to get access to communication channels and documents.                                                                                                                                                                                                | **Espionage by Foreign Intelligence Agencies**                                              | 2               | A serious threat due to the political sensitivity, but likely to be targeted, not constant.                                                                   | **Data Tampering by Malicious Insider to Sabotage Negotiations**                             | 1               | Requires high-level access and specific motive; less frequent.                                                                                              | **Loss of Data Due to System Failure**                                        | 1               | Less frequent and less critical than a targeted attack.                                                                                                         |
| 23        | Economic Reform Plans Related to G20 Criteria                                          | **Sensitive Information with Inadequate Access Control and Data Security**                                                                                                                                                                                          | 2        | Though sensitive, unauthorized disclosure requires a threat who is *frequently* making attempts to get access to planning documents and systems.                                                                                                                                                                                                 | **Leak of Information by Government Officials**                                             | 2               | Possible, but likely to be targeted, not a constant threat.                                                                                             | **Data Modification by Employees to Undermine Reforms**                                      | 1               | Requires specific motive and access; less frequent.                                                                                                       | **System Downtime Due to Cyberattack**                                         | 1               | Less frequent and less critical than disruption of core operational systems.                                                                                |
| 24        | National Cybersecurity Strategy Documents                                               | **Compromised Document Security and Unauthorized Access**                                                                                                                                                                                                            | 2        | Although a primary target, access requires a threat who is *frequently* targeting document systems and access controls.                                                                                                                                                                                           | **Theft of Data by Foreign Governments**                                                    | 2               | A serious threat due to the strategic importance, but likely to be targeted, not constant.                                                                 | **Data Alteration by Malicious Insider to Weaken Security Posture**                        | 1               | Requires high-level access and specific motive; less frequent.                                                                                              | **Loss of Documents Due to Natural Disaster**                                 | 1               | While possible, these events are infrequent.                                                                                                              |
| 25        | NCA Cybersecurity Incident Response Plans                                              | **Inadequate Protection Against Unauthorized Access and Disclosure**                                                                                                                                                                                                 | 2        | Though a key system, getting access requires a threat who is *frequently* targeting document systems and access controls.                                                                                                                                                                                                 | **Espionage by Foreign Intelligence Agencies**                                              | 2               | A serious threat, but likely to be targeted, not constant.                                                                                                 | **Data Modification by Malicious Insider to Disrupt Response Efforts**                       | 1               | Requires high-level access and specific motive; less frequent.                                                                                              | **System Downtime Due to Hardware Failure**                                   | 1               | While possible, hardware failures affecting these specific systems are infrequent.                                                                            |
| 26        | NCA Vulnerability Management Procedures                                                 | **Vulnerabilities in Systems and Processes for Vulnerability Management**                                                                                                                                                                                           | 2        | Exploiting vulnerabilities in management process requires *frequent* targeting of that specific system.                                                                                                                                                                                          | **Theft of Data by Competitors or Hacktivists**                                             | 2               | Possible, but likely to be targeted, not a constant threat.                                                                                             | **Data Corruption by Software Glitch**                                                   | 1               | Less frequent than a targeted attack.                                                                                                                     | **Denial of Access Due to System Overload**                                   | 1               | Less frequent and less critical than disruption of core operational systems.                                                                                |
| 27        | NCA Cyber Threat Intelligence Reports                                                  | **Compromised Security of Threat Intelligence Data**                                                                                                                                                                                                              | 2        | While very sensitive, this requires *frequent* targeting of threat systems and their security controls.                                                                                                                                                                                              | **Espionage by Foreign Governments**                                                        | 2               | A serious threat due to the strategic importance, but likely to be targeted, not constant.                                                                 | **Data Falsification by Malicious Insider to Mislead Analysis**                             | 1               | Requires high-level access and specific motive; less frequent.                                                                                              | **System Downtime Due to Power Outage**                                       | 1               | While possible, power outages affecting these specific systems are infrequent.                                                                            |
| 28        | Contact Information and Communication Protocols between NCA and Critical Infrastructure | **Vulnerabilities in Communication Channels and Contact Databases**                                                                                                                                                                                                   | 2        | Exploiting vulnerabilities to disrupt communications needs a threat to *frequently* probe and attempt access to communication channels.                                                                                                                                                                                 | **Phishing Attacks Targeting NCA Personnel**                                               | 2               | Possible, but might not be a constant threat.                                                                                                               | **Data Manipulation by Disgruntled Employees**                                             | 1               | Requires specific motive and access; less frequent.                                                                                                       | **DDoS Attack on NCA Communication Systems**                                  | 2               | Possible and could be disruptive, but may not be a constant threat.                                                                                         |
| 29        | Records of Cybersecurity Incidents Reported to the NCA                                 | **Inadequate Protection of Incident Records and Reporting Systems**                                                                                                                                                                                                | 2        | Exploiting inadequate protection of records requires a threat who is *frequently* trying to access records and systems.                                                                                                                                                                                    | **Unauthorized Access by Hacktivists or Cybercriminals**                                  | 2               | Possible, but might not be a constant threat.                                                                                                               | **Data Tampering by Malicious Insider to Conceal Incidents**                               | 1               | Requires specific motive and access; less frequent.                                                                                                       | **System Downtime Due to Software Glitch**                                     | 1               | While possible, software glitches causing system failures are less frequent.                                                                                 |
| 30        | Office Building PC User Data and Settings                                               | **User-Level Security Vulnerabilities due to Lack of Awareness and Unpatched Systems**                                                                                                                                                                              | 3        | User susceptibility to phishing and social engineering *immediately* makes this exploitable, as there is no way to mitigate with one attempt. Any threat immediately compromises users due to lack of awareness and outdates systems.                                                                                                  | **Phishing Attacks**                                                                        | 3               | A very common and frequent threat.                                                                                                                            | **Malware Infection via Removable Media**                                                  | 2               | Less frequent than phishing, but still a significant threat.                                                                                                 | **System Downtime Due to User Error**                                         | 1               | While possible, user errors causing system downtime are less frequent than other threats.                                                                     |
| 31        | Installed Software and Applications on Office Building PCs                             | **Presence of Unauthorized, Unvetted, or Outdated Software**                                                                                                                                                                                                        | 3        | This is immediately exploitable upon any threat appearing as there are always new pieces of unvetted software, outdated software, or unauthorized software running on the PCs.                                                                                                                                                              | **Exploit of Software Vulnerabilities**                                                    | 3               | A very common and frequent threat, especially with outdated software.                                                                                           | **Software Misconfiguration Leading to Errors**                                             | 2               | Less frequent than exploits, but can still occur.                                                                                                           | **Software Crash Due to Bugs**                                                | 1               | While possible, less frequent than other threats.                                                                                                              |
| 32        | Files Stored on Office LAN File Servers                                                 | **Insufficient Access Controls and Lack of File Integrity Monitoring**                                                                                                                                                                                          | 2        | Weak access controls and lack of integrity monitoring requires the threat to be *frequently* probing the file systems to be effective.                                                                                                                                                                                    | **Unauthorized Access by Employees**                                                        | 2               | Possible, but may not be a constant threat; depends on internal controls.                                                                                    | **Data Corruption Due to Hardware Failure**                                               | 1               | Less frequent than unauthorized access.                                                                                                                     | **Denial of Access Due to Server Overload**                                   | 1               | Less frequent and less critical than disruption of core operational systems.                                                                                |
| 33        | Access Logs for Office LAN File Servers                                                 | **Inadequate Log Management and Analysis Practices**                                                                                                                                                                                                                | 2        | Access logs that are not regularly monitored and analyzed require *frequent* manipulation of log systems. So this vulnerability is not exploitable with a single threat attempt.                                                                                                                                                                       | **Unauthorized Access to Logs by Employees**                                                | 1               | Less likely and less frequent; not a primary target.                                                                                                         | **Log Tampering by Malicious Insider**                                                      | 1               | Requires specific motive and access; less frequent.                                                                                                       | **Log File Corruption Due to Software Glitch**                                 | 1               | While possible, less frequent than other threats.                                                                                                              |
| 34        | Print Queues and Scan History on Multifunction Printers                                | **Network Segmentation and Device Security Weaknesses**                                                                                                                                                                                                            | 2        | Exploiting the lack of segmentation requires a threat to be probing *frequently*. Also, weak device security is not immediately exposed without repeated probes by an attacker.                                                                                                                                                                  | **Sniffing of Network Traffic to Capture Print Jobs**                                       | 2               | Possible, but requires specific technical skills and may not be a constant threat.                                                                         | **Unauthorized Modification of Printer Settings**                                            | 1               | Less likely and less frequent; limited impact.                                                                                                               | **Printer Denial of Service Due to Network Issues**                             | 1               | Less frequent and less critical than disruption of core operational systems.                                                                                |
| 35        | Call Logs and Configurations of Telephones (Office LAN)                                | **Vulnerabilities in VoIP Systems and Weak Authentication**                                                                                                                                                                                                           | 2        | The weaknesses in VoIP systems require *frequent* attempts to target those vulnerabilities to get access or eavesdrop. One attempt will not do it.                                                                                                                                                                                               | **Eavesdropping on VoIP Calls**                                                             | 2               | Possible, but may not be a constant threat; depends on the implementation of security controls.                                                                | **Call Data Manipulation by Malicious Insider**                                               | 1               | Requires specific motive and access; less frequent.                                                                                                       | **Disruption of VoIP Service Due to Network Congestion**                         | 1               | Less frequent and less critical than disruption of core operational systems.                                                                                |
| 36        | Configuration Files for Office LAN Networking Equipment (Routers, Switches)            | **Unsecured Management Interfaces and Weak Configuration Management**                                                                                                                                                                                                | 3        | If management interfaces for network devices are not properly secured, they can be easily exploited by any threat that appear to target the device. It does not require frequent activity.                                                                                                                                                                      | **Unauthorized Access to Management Interface**                                              | 3               | A significant and frequent threat if devices are not properly secured.                                                                                          | **Configuration Errors Leading to Network Instability**                                    | 2               | Less frequent than unauthorized access, but can still occur.                                                                                                 | **Denial of Service Attack Targeting Network Devices**                          | 2               | Possible and can be disruptive, but may not be a constant threat.                                                                                         |
| 37        | Operating Systems of Computer Center Servers                                            | **Outdated and Unpatched Operating Systems**                                                                                                                                                                                                                      | 3        | This is very easy to exploit once a generic threat occurs. A server with outdated OS is immediately vulnerable to any threat.                                                                                                                                                                                               | **Exploit of OS Vulnerabilities**                                                           | 3               | A very common and frequent threat, especially with outdated operating systems.                                                                                  | **OS Configuration Errors Leading to Security Weaknesses**                                 | 2               | Less frequent than exploits, but can still occur.                                                                                                           | **System Crash Due to Hardware Failure**                                       | 1               | While possible, less frequent than other threats.                                                                                                              |
| 38        | Application Software Running on Computer Center Servers                                | **Vulnerable and Unpatched Application Software**                                                                                                                                                                                                                 | 3        | Similar to the OS, unpatched software is easily exploitable upon the appearance of any threat. It does not require the threat to act frequently.                                                                                                                                                                                         | **Exploit of Application Vulnerabilities**                                                 | 3               | A very common and frequent threat, especially with unpatched applications.                                                                                     | **Application Misconfiguration Leading to Security Issues**                               | 2               | Less frequent than exploits, but can still occur.                                                                                                           | **Application Crash Due to Bugs**                                                | 1               | While possible, less frequent than other threats.                                                                                                              |
| 39        | Databases Hosted on Computer Center Servers                                            | **Critical Data with Inadequate Database Security**                                                                                                                                                                                                               | 3        | Weak database security makes it immediately exploitable once a general threat is targeting such systems. It does not require multiple attempts.                                                                                                                                                                                         | **SQL Injection Attacks**                                                                  | 3               | A very common and frequent threat to databases.                                                                                                                 | **Database Corruption Due to Software Errors**                                             | 1               | Less frequent than SQL injection attacks.                                                                                                                 | **Denial of Service Attack Targeting Databases**                               | 2               | Possible and can be disruptive, but may not be a constant threat.                                                                                         |
| 40        | Real-time Operational Data from Infrastructure Systems (ICS)                           | **Vulnerabilities in ICS Protocols and Data Transmission**                                                                                                                                                                                                           | 3        | Because ICS protocols are by design vulnerable, *any* threat that attempts to exploit them will likely be successful once.                                                                                                                                                                                              | **Man-in-the-Middle Attacks on ICS Communications**                                         | 3               | A significant threat to the integrity of ICS data.                                                                                                           | **Data Manipulation by Malicious Actors**                                                   | 3               | A very serious threat that can directly impact physical processes.                                                                                           | **Disruption of ICS Operations Due to Network Attacks**                        | 3               | A significant threat that can cause immediate disruption.                                                                                                     |
| 41        | Configuration Settings for Industrial Equipment (ICS)                                  | **Insecure Configuration and Management of ICS Devices**                                                                                                                                                                                                           | 3        | Because ICS configuration is typically done with weak passwords and weak interfaces, they are immediately vulnerable with any appearance of a threat attempting to get into those systems.                                                                                                                                                               | **Unauthorized Access and Modification by Malicious Actors**                               | 3               | A very serious threat that can directly impact physical processes.                                                                                           | **Configuration Errors Leading to Equipment Malfunction**                                   | 2               | Less frequent than unauthorized access, but can still occur.                                                                                                 | **Denial of Service Attack on ICS Devices**                                    | 3               | A significant threat that can cause immediate disruption.                                                                                                     |
| 42        | Historical Data Logs from Industrial Equipment (ICS)                                   | **Lack of Log Integrity and Secure Storage**                                                                                                                                                                                                                       | 2        | Requires *frequent* attempts to manipulate or delete logs from these systems. One attempt will not expose the vulnerability.                                                                                                                                                                               | **Unauthorized Access to Logs by Malicious Actors**                                         | 2               | Possible, but may not be a constant threat.                                                                                                               | **Log Tampering to Conceal Malicious Activity**                                             | 2               | Requires specific motive and access; less frequent but possible.                                                                                              | **Loss of Logs Due to System Failure**                                          | 1               | While possible, less frequent than other threats.                                                                                                              |
| 43        | Configuration Files for Computer Center Networking Equipment                           | **Critical Network Devices with Inadequate Security Hardening and Configuration Management**                                                                                                                                                                        | 3        | If the network devices are not properly configured and hardened, *any* threat can exploit the configuration problems immediately. It does not require multiple attempts or any specific targeting.                                                                                                                                        | **Unauthorized Access and Modification of Device Configurations**                           | 3               | A very serious threat that can compromise the entire network.                                                                                                | **Configuration Errors Leading to Network Outages**                                          | 2               | Less frequent than unauthorized access, but can still occur.                                                                                                 | **Denial of Service Attack Targeting Network Devices**                          | 3               | A significant threat that can disrupt the entire infrastructure.                                                                                             |
| 44        | Data Stored on Blade Servers (Computer Center)                                         | **Compromised Physical and Digital Security of Blade Servers**                                                                                                                                                                                                      | 3        | The deactivated retina scan coupled with inadequate data protection immediately makes this system vulnerable to a physical intrusion or digital compromise.                                                                                                                                                              | **Theft of Data by Unauthorized Personnel (Physical or Remote)**                             | 3               | A significant threat due to the combination of physical and digital security weaknesses.                                                                      | **Data Corruption Due to Hardware Failure**                                               | 1               | Less frequent than unauthorized access.                                                                                                                     | **Denial of Access Due to Power Loss**                                         | 1               | While possible, less frequent than other threats.                                                                                                              |
| 45        | Content of the Telecom Grid Public Website                                              | **Web Application Vulnerabilities (e.g., XSS, SQL Injection)**                                                                                                                                                                                                    | 2        | Web application vulnerabilities are only exploitable if the threat is *frequently* scanning the system for vulnerabilities. A single general threat appearing once will not have any impact.                                                                                                                                                   | **Website Defacement by Hacktivists**                                                       | 2               | A common threat, but may not be constant.                                                                                                                   | **Data Corruption Due to Software Bugs**                                                    | 1               | Less frequent than website defacement.                                                                                                                       | **Denial of Service Attack on the Website**                                     | 2               | Possible and can be disruptive, but may not be a constant threat.                                                                                         |

Tabel Vulnerability-threat part 2/2 ada di sini: https://hackmd.io/@naufalfaza/tabel-vulnerability-uas-2/edit