Subject: [mile] Impact to the business (Issue #36)

From: "Roman D. Danyliw" <[email-masked]>
Date: Wed, 22 Jan 2014 03:41:20 +0000

Good evening!

Issue #36, http://tools.ietf.org/wg/mile/trac/ticket/36, is tracking the need to represent a summary of the impact an incident had on the organization in 5070bis.

To address this need, I would propose adding a new class, BusinessImpact, to Assessment.

<proposal>
+-------------------------+
| Assessment              |
+-------------------------+
| ENUM occurrence         |<>--{0..*}--[ Impact         ]
| ENUM restriction        |<>--{0..*}--[ BusinessImpact ]
| STRING indicator-uid    |<>--{0..*}--[ TimeImpact     ]
| STRING indicator-set-id |<>--{0..*}--[ MonetaryImpact ]
|                         |<>--{0..*}--[ Counter        ]
|                         |<>--{0..1}--[ Confidence     ]
|                         |<>--{0..*}--[ AdditionalData ]
+-------------------------+

The BusinessImpact class describes and characterizes the degree to which the function of the organization was impacted by the Incident.

The element body describes the impact to the organization as a free-form text string.  The two attributes characterize the impact.

+-------------------------+
| BusinessImpact          |
+-------------------------+
| ML_STRING               |
|                         |
| ENUM severity           |
| ENUM type               |
+-------------------------+

@severity (characterizes the severity of the incident on business functions, from NIST SP800-61 Table 3-2)
None = No effect to the organization's ability to provide all services to all users
Low = Minimal effect as the organization can still provide all critical services to all users but has lost efficiency
Medium = The organization has lost the ability to provide a critical service to a subset of system users
High = The organization is no longer able to provide some critical services to any users
unknown = The impact is unknown
ext-severity = Extension mechanism

@type (characterizes the effect this incident had on the business)
breach-propriety = Sensitive or proprietary information was accessed or exfiltrated
breach-privacy = Personally identifiable information was accessed or exfiltrated
loss-of-integrity = Sensitive or proprietary information was changed or deleted
loss-of-service = Service delivery was disrupted
loss-financial = Money or services were stolen
degraded-reputation = The reputation of the organization's brand was diminished
asset-destruction = A cyber-physical system was damaged
legal = Incident resulted in legal or regulatory action
ext-type  Extension mechanism
</proposal>

Any thoughts?  @type might be missing a few values.

Roman

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Wed, 22 Jan 2014 18:37:39 -0500

+1 for adding in BusinessImpact with your proposal.

Can you make sure @type can have other values in the schema with an ext- ?

Thanks,
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, January 21, 2014 10:41 PM
To: [email-masked]
Subject: [mile] Impact to the business (Issue #36)

Good evening!

<proposal>

@severity (characterizes the severity of the incident on business functions, from NIST SP800-61 Table 3-2) None = No effect to the organization's ability to provide all services to all users Low = Minimal effect as the organization can still provide all critical services to all users but has lost efficiency Medium = The organization has lost the ability to provide a critical service to a subset of system users High = The organization is no longer able to provide some critical services to any users unknown = The impact is unknown ext-severity = Extension mechanism

@type (characterizes the effect this incident had on the business) breach-propriety = Sensitive or proprietary information was accessed or exfiltrated breach-privacy = Personally identifiable information was accessed or exfiltrated loss-of-integrity = Sensitive or proprietary information was changed or deleted loss-of-service = Service delivery was disrupted loss-financial = Money or services were stolen degraded-reputation = The reputation of the organization's brand was diminished asset-destruction = A cyber-physical system was damaged legal = Incident resulted in legal or regulatory action ext-type  Extension mechanism </proposal>

Roman
_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile

---

From: "Roman D. Danyliw" <[email-masked]>
Date: Thu, 23 Jan 2014 13:08:31 +0000

Definitely! BusinessImpact@{ext-severity, ext-type} are in the write-up below but I forgot to added them into the diagram.

Roman

-----Original Message-----
From: Moriarty, Kathleen [mailto:[email-masked]] 
Sent: Wednesday, January 22, 2014 6:38 PM
To: Roman D. Danyliw; [email-masked]
Subject: RE: Impact to the business (Issue #36)

Thanks,
Kathleen

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, January 21, 2014 10:41 PM
To: [email-masked]
Subject: [mile] Impact to the business (Issue #36)

Good evening!

<proposal>

Roman

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Thu, 23 Jan 2014 14:31:00 +0000

No objections with BusinessImpact either. 
Panos

-----Original Message-----
From: mile [mailto:[email-masked]] On Behalf Of Roman D. Danyliw
Sent: Tuesday, January 21, 2014 10:41 PM
To: [email-masked]
Subject: [mile] Impact to the business (Issue #36)

Good evening!

<proposal>

Roman

---

From: Eric Burger <[email-masked]>
Date: Thu, 23 Jan 2014 11:57:45 -0500

Do we have any indication that anyone would fill in this field?