University Of Arizona

• MIS 516

• FAIR Basic Risk Assessment Form See Appendix A: Basic Risk Assessment Guide in An Introduction to Factor Analysis of Information Risk (FAIR) by Jack Jones for instruction on filling out this form. *If not directly estimating vulnerability, we will derive vulnerability from Tcap and RS Stage 1 – Identify Scenario Components Step 1 – Identify the Asset(s) at risk Asset(s) at risk: Customer information such as Name, Address, Date of Birth and SSN in the customer database of about 500,000 people Step 2 – Identify the Threat Community Threat community: Employees who have inappropriate access privileges Characterization: This threat community could be characterized as humans who have internal access to things they should not have privilege to access. They can be termed as “ Privileged Insiders” Derived from Appendix A: Basic Risk Assessment Guide in An Introduction to Factor Analysis of Information Risk (FAIR) by Jack Jones Page 1 of 4 Risk (LEF) Loss Event Frequency (TEF) Threat Event Frequency (Vuln) Vulnerability (TCap) Threat Capability* (RS) Resistance Strength* (LM) Loss Magnitude Primary Loss This study source was downloaded by 100000861003072 from CourseHero.com on 03-26-2023 22:17:47 GMT -05:00 https://www.coursehero.com/file/34504732/FAIR-Basic-Risk-Assessment-Form-1docx/ Stage 2 – Evaluate Loss Event Frequency Step 3 – Threat Event Frequency (TEF) Rating  Description Very High (VH) ☐ > 100 times per year High (H) ☐ Between 10 and 100 times per year Moderate (M) ☒ Between 1 and 10 times per year Low (L) ☐ Between .1 and 1 times per year Very Low (VL) ☐ < .1 times per year (less than once every ten years) Rationale: I have chosen Moderate (M) because: Firs: It is human tendency to want to know more about others, spying on other employees, etc. Hence, just out of curiosity I believe an employee who has access privilege to such information might just open the database whenever he/she is bored. Step 4 – Threat Capability (Tcap) (If not directly estimating Vulnerability) Rating 