part1
This commit is contained in:
parent
ed759145c7
commit
6eb6ce766b
2 changed files with 49 additions and 37 deletions
|
|
@ -6,28 +6,28 @@
|
|||
\centering
|
||||
\begin{adjustbox}{width=1\textwidth}
|
||||
\small
|
||||
\begin{tabular}{r|l|l|l|l|l|r|l|l|l|l|l}
|
||||
\begin{tabular}{r|l|l|l|l|l|r|l|l|l|r|l}
|
||||
\textbf{No} & \textbf{Name} & \textbf{Description} & \textbf{Owner} & \textbf{Maintainer} & \textbf{Location} & \textbf{CIA} & \textbf{PI} & \textbf{Access privs} & \textbf{Category} & \textbf{Asset value} & \textbf{Criticality} \\
|
||||
\hline
|
||||
1 & Dashboard & Car dashboard & Driver & A. Name & Car & IA & & & & & \\
|
||||
1 & Dashboard & Speedometer & Driver & A. Name & Car & IA & No & Driver & Software & 1.000€ & critical \\
|
||||
\hline
|
||||
2 & Entertainment & Car entertainment system & Driver & A. Nother & Car & A & & & & & \\
|
||||
2 & Entertainment & Entertainment system & Driver & A. Nother & Car & CA & Yes & Driver & Software & 250€ & low \\
|
||||
\hline
|
||||
3 & OTA Server & Server for OTA Updates & IT-Dep & S. Ome & E2, room 44& IA & & & & & \\
|
||||
3 & OTA Server & OTA Updates & IT-Dep & S. Ome & E2, room 44& IA & No & IT-Dep & Car Owner & 5.000€ & medium \\
|
||||
\hline
|
||||
4 & Charging Station & System to handle charging & IT-Dep & B. Ody & Fuel Stations & IA & & & & & \\
|
||||
4 & Charging Station & System to handle charging & Owner of Station & B. Ody & Fuel Stations & IA & Yes & Station user & Hardware & 2.000€ & medium \\
|
||||
\hline
|
||||
5 & Collaboration & Collaboration code & IT-Dep & T. Is & E2, room 45 & CI & & & & & \\
|
||||
5 & Database Server & Host for DB & IT-Dep & T. Is & E2, room 45 & CIA & Yes & IT-Dep & Hardware & 10.000€ & critical \\
|
||||
\hline
|
||||
6 & Meetings & Online meetings code & Sales/Marketing & I. Sweird & E2, room 46 & CI & & & & & \\
|
||||
6 & Employee DB & Database of employees& HR-Department & I. Sweird & Database Server & CI & Yes & HR-Department & Software & 200.000 & critical \\
|
||||
\hline
|
||||
7 & Online Shop & Buy the car online & Sales/Marketing & A. Ndun & E2, room 47 & IA & & & & & \\
|
||||
7 & Online Shop & Buy the car online & Sales/Marketing & A. Ndun & Webserver & CIA & No & IT-Dep & Software & 10.000€ & medium \\
|
||||
\hline
|
||||
8 & Client DB & Databas of clients & Sales/Marketing & I. Nspired & E2, room 48 & CIA & & & & & \\
|
||||
8 & Client DB & Database of clients & Sales/Marketing & I. Nspired & Database Server & CI & Yes & Sales/Marketing & Software & 200.000 & critical \\
|
||||
\hline
|
||||
9 & Service API & Car service API & Service Center & A. Lmost & E2, Car & I & & & & & \\
|
||||
9 & Webserver & Website hosting & IT-Dep & A. Lmost & Strato & IA & No & IT-Dep & Hardware & 1.000€ & critical \\
|
||||
\hline
|
||||
10 & Website & Company Website & Sales/Marketing & D. One & E2, room 49 & IA & & & & & \\
|
||||
10 & Website & Company Website & Sales/Marketing & D. One & Webserver & IA & No & Everybody & Software & 2.000€ & low \\
|
||||
\end{tabular}
|
||||
\end{adjustbox}
|
||||
\caption{Asset Liste}
|
||||
|
|
@ -36,32 +36,43 @@
|
|||
|
||||
\subsection{Gefahren für Assets}
|
||||
|
||||
8. Client DB:
|
||||
\subsubsection{Database Server: Diebstahl der Daten aus der Datenbank}
|
||||
|
||||
\begin{enumerate}
|
||||
\item Diebstahl der Daten aus der Datenbank
|
||||
\item Denial of Service
|
||||
\item Löschen der Datenbank
|
||||
\item Verschlüsselung der Datenbank
|
||||
\item Änderung der Kundendaten
|
||||
\item SQL Injection
|
||||
\item Zugang sperren
|
||||
\item Falsche Daten liefern
|
||||
\item Falsche Daten hinzufügen
|
||||
\item Löschen der Backups
|
||||
\end{enumerate}
|
||||
Daten der Kunden oder der Mitarbeiter können gestohlen werden.
|
||||
|
||||
10. Website:
|
||||
\subsubsection{Database Server: Löschen der Datenbank}
|
||||
|
||||
Die Datenbanken können gelöscht werden.
|
||||
|
||||
\subsubsection{Database Server: Diebstal des Servers}
|
||||
|
||||
Der Server könnte aus dem Rechenzentrum/Serverraum geklaut werden.
|
||||
|
||||
\subsubsection{Client DB: Verschlüsselung der Datenbank}
|
||||
|
||||
Eine der Datenbanken könnte verschlüsselt werden.
|
||||
|
||||
\subsubsection{Website: Darstellung falscher Daten}
|
||||
|
||||
Auf der Firmenwebseite könnten falsche Informationen dargestellt werden.
|
||||
|
||||
\subsubsection{Website: Kontakt Formular}
|
||||
|
||||
Durch das Kontakt Formular werden ununtergrochen Spam-Nachrichten geschickt. Dadurch gehen die echten Nachrichten unter.
|
||||
|
||||
\subsubsection{Online Shop: Denial of Service}
|
||||
|
||||
Wenn der Online shop nicht zu erreichen ist, können keine Bestellungen aufgegeben werden.
|
||||
|
||||
\subsubsection{Online Shop: Man in the middle}
|
||||
|
||||
Die Verschlüsselung der Kommunikation beim Bezahlen durch einen Man in the Middle attack aushebeln.
|
||||
|
||||
\subsubsection{Entertainment: Technischer Defekt}
|
||||
|
||||
Das Entertainmen system kann durch einen technischen Defekt nicht mehr bedient werden.
|
||||
|
||||
\subsubsection{Entertainment: Navigation Defekt}
|
||||
|
||||
Das Navigationssystem zeigt falsche Routen an und stürzt mitten in der Fahrt ab.
|
||||
|
||||
\begin{enumerate}
|
||||
\item Darstellung falscher Daten
|
||||
\item Injection, z.B. Kontaktformular
|
||||
\item Cross-Site Scripting
|
||||
\item SSRF
|
||||
\item Diebstal der Logs
|
||||
\item Zugriff auf das Hostsystem
|
||||
\item Denial of Service
|
||||
\item DNS flooding
|
||||
\item DNS hijacking
|
||||
\item Domain stehlen
|
||||
\end{enumerate}
|
||||
|
|
|
|||
|
|
@ -1 +1,2 @@
|
|||
\section{Part 2: Attack Tree}
|
||||
|
||||
|
|
|
|||
Reference in a new issue