For the Mentcare system, suggest an example of an asset, an exposure, a vulnerability, an attack, a threat and a control, in addition to those discussed in this chapter.

Question

What will be an ideal response?

Answer 1

Asset
Local database stored on nurses laptop or clinic PC

Exposure
Moderate. Loss of consultation records. Clinical
consequences possible if

Vulnerability
Nurse or doctor leave consultation with patient but leave
themselves logged into system

Attack
Patient accesses unattended system

Threat
Patient deletes or corrupts patient records held in local database.

Control
Log all actions and support ‘undo’ of log actions. Require
password to open individual patient records.
There are obviously many possible other examples here. Note that the attack, etc.
need not be an attack on the identified asset (the question is a more general one)