Scenario: Devonshire Deluxe $($DD$)$ is the company that a colleague of yours just joined. DD$$s senior management has had a few unsettling weeks after a cyber$-$

incident brought them down. Your colleague has asked you to help them perform a Risk Assessment. Three weeks ago on a Thursday afternoon DD$$s network was brought down by a cyber$-$attack. The attack flooded DD$$s networks with thousands of requests. When the event started there was confusion over who was handling the response and who had information on it$.$ Consequently, the response efforts took longer because different team members were trying to answer questions as they were investigating the event. DD was unable to identify when the event started because they had no logs to analyze. There was confusion because they did not know if the issue was caused by code a developer put into production or a missing patch. DD was unsure of when patches were applied or even if they were applied. Finally, to make matters worse DD realized that they did not have an accurate or complete listing of their hardware and software.

Purpose of the assessment:

DD has been made aware of multiple risks from both internal and external sources and is performing an internal risk assessment to give senior staff the information and resources they need to make informed decisions on what security controls to implement to mitigate risks to an acceptable level.

Scope of the assessment:

The scope of the risk assessment is defined as all infrastructure that supports the technical operations of data centers.

Asessment assumptions and restraints:

$$ The risk assessment restraints are identified as keeping the focus on identified risks from previously performed external risk assessments.

$$ The analytic approach must be qualtative

a$)$ What is the scope of the assessment

b$)$ What are the assumptions & constraints?

c$)$ What are the risks in this assessment?