# 0_Credits

Acknowledgement:
The risk management portions of this database are based on and adapted from the Factor Analysis of Information Risk by Jack Jones, under the Creative Commons
Attribution-Noncommercial-Share
Alike 2.5 license.


Acknowledgement:
The Security Controls portions of this document are derived from the NIST 800-53 revision 4 standard.


Acknowledgement:
All other areas were developed by Ohio University and are shared under the Creative Commons
Attribution-Noncommercial-Share
Alike 2.5 license


# 800-53 Control Catalog

Control Name:
Permitted Actions without Identification or Authentication


Control Name:
Privacy Requirements for Contractors and Service Providers


Control Name:
Privacy-Enhanced System Design and Development


Control Name:
Security Awareness and Training Policy and Procedures


Control Name:
Contacts with Security Groups and Associations


Control Name:
Audit and Accountability Policy and Procedures


Control Name:
Security Assessment and Authorization Policies and Procedures


Control Name:
Configuration Management Policy and Procedures


Control Name:
Contingency Planning Policy and Procedures


Control Name:
Information System Recovery and Reconstitution


Control Name:
Minimization of Personally Identifiable Information


Control Name:
Minimization of PII Used in Testing, Training, and Research


Control Name:
Identification and Authentication Policy and Procedures


Control Name:
Identification and Authentication (Organizational Users)


Control Name:
Identification and Authentication (NonOrganizational Users)


Control Name:
System Maintenance Policy and Procedures


Control Name:
Physical and Environmental Protection Policy and Procedures


Control Name:
Location of Information System Components


Control Name:
Information Security Measures of Performance


Control Name:
Personnel Security Policy and Procedures


Control Name:
System and Services Acquisition Policy and Procedures


Control Name:
Development Process, Standards, and Tools


Control Name:
Developer Security Architecture and Design


Control Name:
System and Communications Protection Policy and Procedures


Control Name:
Cryptographic Key Establishment and Management


Control Name:
Secure Name /Address Resolution Service (Authoritative Source)


Control Name:
Secure Name /Address Resolution Service (Recursive or Caching Resolver)


Control Name:
Architecture and Provisioning for Name/Address Resolution Service


Control Name:
Inventory of Personally Identifiable Information


Control Name:
System and Information Integrity Policy and Procedures


Control Name:
Security Alerts, Advisories, and Directives


Control Name:
Software, Firmware, and Information Integrity


Control Name:
Information Output Handling and Retention


Control Name:
System of Records Notices and Privacy Act Statements


Control Name:
Dissemination of Privacy Program Information


# 800-53 Control Family

Family:
Accountability, Audit, and Risk Management


# 800-53 Prioritization Codes

Action:
Security control not selected for baseline.


Action:
Implement P2 security controls after implementation of P1 controls.


Action:
Implement P3 security controls after implementation of P1 and P2 controls.


# Assets

AssetDescription:
People that are involved in Academic Training


# Data Classification Definitions

Definition:
The authoritative location for a particular set of data.  I.e. The Student Academic information source is StudentWare Inc.


Definition:
Data in an unprocessed format.  I.e. no statistical aggregation or de-identification has been performed on it.


Definition:
Data that has been statistically summarized in a fashion which obscures any individually identifying characteristics.


Definition:
Data that, while not aggregated, is not able to be associated with an individual.  I.e. research data where the subject’s name/identifying information has been replaced with a number unique to the research project.


# Losses

Description:
Corrupt entire AD infrastructure, locking people out of systems, and requiring rebuild of everything


Description:
Corrupt entire AD infrastructure, locking people out of systems, and requiring restore from backup


Description:
Use AD privileges to gain access to sensitive information on other systems


Description:
Use GAL to send spam email to all users to air grievances


Description:
Misconfiguration causing denial of service


Description:
Sending Spam to a large portion of the University


Description:
Using Active Directory to harvest all user data for phishing attempt


Description:
Harvest Directory for spear phishing attempt


Description:
Bad system component may corrupt entire AD infrastructure, locking people out of systems, and requiring rebuild of everything


Description:
Someone harassed - 2-3 weeks of poor productivity


# Threats

ThreatName:
Malicious Internal Users with Privileges


