Risk assessment on 3 information assets
Scenario
SwiftLend needs a formal ISO 27001-aligned risk assessment. To keep the first pass tight, focus on 3 crown-jewel assets: 1. **Customer loan-application database** (contains PAN, Aadhaar hash, salary slips, bank statements) — PostgreSQL, 800GB, AWS RDS Mumbai 2. **Underwriting decision-engine** (custom ML model + Python service) — determines loan approvals 3. **Customer mobile app authentication** (OTP + biometric) — 1M installs For each asset, identify threats, existing controls, residual risk, and treatment.
Your role
You are running the risk-assessment workshop.
Your task
For EACH of the 3 assets, produce: 1. Asset value (Confidentiality / Integrity / Availability rated High/Med/Low with reasoning) 2. Top 3 threat scenarios (not generic — asset-specific) 3. Existing controls (assume standard AWS + typical SaaS baseline) 4. Residual risk rating 5. Recommended additional controls
Deliverable format: 3 asset cards, each ~200 words
Toolkit
- Threat inspiration: ENISA threat taxonomy, MITRE ATT&CK, OWASP Top 10
- For an ML model: model theft, model poisoning, prediction manipulation are ALL valid threats
- For OTP auth: SIM swap, OTP interception, session hijack
- Don't over-mitigate — accept low-residual risks
Success criteria (what the AI grades against)
- CIA rating justified per asset (they should NOT all be High-High-High)
- Threats are asset-specific (not 'unauthorised access' for all three)
- ML model asset includes model-specific threats (poisoning / theft)
- OTP asset includes SIM-swap risk (India context — very common)
- Residual risk shown honestly — some residual is acceptable, document why
- At least one 'accept' treatment (shows judgment)
Log in to submit your deliverable for AI review.
Log in / Register