ES1 - Vulnerability exploitation

An attacker exploits a security vulnerability to cause the undesirable disclosure of information, fraud or denial of service ....

Assets

The assets that need to be protected in order to prevent the impact caused by this event are:

• sensitive information, etc.

The principal threat agents are:

• employees, etc.

Vulnerabilities

The vulnerabilities that might be exploited are:

• ignorance, misunderstanding and human fallibility , etc.

Impacts

The primary impacts of such an event are:

• Undesirable disclosure of information (UDI), etc

Consequential impacts are:

• Adverse press coverage, etc.

Risk treatment plan

ES1.1a Security policy

We have an up to date set of rules. They cover all our legal, regulatory and contractual obligations, and are proportional to our risks. Elaborate as appropriate, particularly concerning sensitivity of information and how it is to be handled and communicated<<>> We oblige our employees, contractors, customers etc, to follow them and we carefully select our employees and contractors before engaging and deploying them. There are penalties for not following the rules. If someone breaks the rules, they therefore cannot reasonably claim that they did not know that such rules existed. However, they might break them because they do not fully understand them.

Risk assessment