COP_2023_V7_pages

THREAT/ATTACK VECTOR RISK MANAGEMENT MATRIX
Owners and operators of MASS should produce a Risk Management Matrix to cover all threat and attack vectors.
An example matrix is shown is at Table 5-1 following.
Table 5-1 Personnel
Domain Sub Domain Threat/Attack Vector Mitigation procedure
Lack of understanding of cyber threats
Unsuitable security history
Malware
Ongoing training and education
Vetting during hiring process/Security
Clearance?
Ongoing training and education
Keyloggers
Ongoing training and education
Social Engineering - Phishing
Ongoing training and education
Social Engineering - Spam
Ongoing training and education
Employees
Access level
Password control
Software access control procedure
IT procedures - robust passwords,
not written down
Change regularly, protect, do not reveal
Regular penetration test to check staff
awareness
Training, Access control, Key Cards
Personnel
Physical security
Security zones relevant to function
IT procedures - robust passwords,
not written down
Screen locks, signing out of machine
if left
Working from home with company
equipment
Mobile devices
Third Party
Could include
maintenance,
cleaners,
visitors,
clients
Disgruntled Staff
Access Control
Security history
Training, Access control, Key Cards
Vetting of contracting company staff
Accompany at all times while
on premises
Record of On/Off premises
Interview to resolve, monitor
and observe
Vetting during hiring
Equal, fair, open, and
non-discriminatory policies
Limit access to sensitive areas and
software
MASS UK Industry Conduct Principles and Code of Practice Version 7
43