Also: Tonardo Strike Also: Unacceptable Repair Costs Also: Equipment Susceptable to Tonardo Damage These attributes are related to the user's experience of interacting with the business system. Information to which the user is entitled to gain access should be easily found and accessed by that user. The information provided to users should be accurate within a range that has been preagreed upon as being applicable to the service being delivered. For certain specialized types of service, the anonymity of the user should be protected. The way in which log-in, navigation, and target services are presented to the user should be consistent across different times, locations, and channels of access. Information provided to users should be current and kept up to date, within a range that has been preagreed upon as being applicable for the service being delivered. For certain sensitive tasks, the detuies should be segregated so that no user has access to both aspects of the task. The user community should be educated and trained so that they can embrace the security culture. There should be sufficient user awareness of security issues so that behavior of users is compliant with security policies. The user should be kept fully informed about services, operating procedures, operational schedules, planned outages, and so on. The interaction with the system should add positive motivation to the user to complete the business tasks at hand. The user's information and access privileges should be protected against abuse by other users or by intruders. The services provided to the user should be delivered at a reliable level of quality. The users obtain a response within a satisfactory period of time that meets their expectations. Providing full visibility to the user of the logical process but hiding the physical structure of the system (as a URL hides the actual physical locations of Web servers). When a user has problems or difficulties in using the system or its services, there should be a means by which the user can receive advice and support so that the problems can be resolved to the satisfaction of the user. Information is delivered or made accessible to the user at the appropriate time or within the appropriate time period The system should provide easy-to-use interfaces that can be navigated intuitively by a user of average intelligence and training level (for the given system). The user's experience of these interactions should be as best interesting and at worst neutral. This group of attributes is related to the ease and effectiveness with which the business system and its services can be managed. Wherever possible (and depending upon cost/benefit factors) the management and operation of the system should be automated. Changes to the system should be properly managed so that the impact of every change is evaluated and the changes are approved in advance of being implemented. The system should at all times remain in the control of its managers. This means that the management will observe the operation and behavior of the system, will make decisions about how to control it based on these observations, and will implement actions to exert that control. The design, acquisition, implementation, and operation of the system should be achieved at a cost that the business finds acceptable when judged against the benefits derived. The system should deliver the target services with optimum efficiency, avoiding wastage of resources. The system should capable of being maintained in a state of bood repair and effective, efficient operation. The actions required to achieve this should feasible within the normal operational conditions of the system. The performance of the system should be measured against a variety of desirable performance targets so as to provide feedback information to support the management and control process. The system should be capable of being supported in terms of both the users and the operations staff, so that all types of problems and operational difficulties can be resolved. Thee attributes describe the ease and effectiveness with which the business system and its services can be operated. The information and services provided by the system should be available according to the requirements specified in the service-level agreement (SLA) Important events must be detected and reported The system should operate without producing errors. The system should interoperate with other similar systems, both immediately and in the future, as intersystem communication becomes increasingly a requirement. The system and its services should operate so as to sustain and enhance productivity of the users, with regard to the business processes in which they are engaged. The system should be able to be recovered to full operational status after a breakdown or disaster, in accordance with the SLA. The operational performance of the system should be continuously monitored to ensure that other attribute specifications are being mets. Any deviations from acceptable limits should be notified to the systems management function. The system should offer "continuous service." The exact definition of this phrase will always be subject to a SLA. These attributes describe the business requirements for mitigating operational risk. This group most closely related to the "security requirements" for protecting the business. Access to information and functions within the system should be controlled in accordance with the authorized privileges of the party requesting the access. Unauthorized access should be prevented. All parties having authorized access to the system should be held accountable for their actions. There should be a means to provide assurance that the system is operating as expected and that all of the various controls are correctly implemented and operated. Protecting employees against false accusations of dishonesty or malpractice. The actions of all parties having authorized access to the system, and the complete chain of events and outcomes resulting from these actions, should be recorded so that this history can be reviewed. The audit records should provide an appropriate level of detail, in accordance with business needs. The actual configuration of the system should also be capable of being sudited so as to compare it with a target configuration that represents the implementation of the security policy that governs the system. Every party claiming a unique identity (i.e., a claimant) should be subject to a procedure that verifies that the party is indeed the authentic owner of the claimed identity. The system should allow only those actions that have been explicitly authorized. New risks emerge over time. The system management and operational environment should provide a means to identify and access new risks (new threats, new impacts, or new vulnerabilities). The confidentiality of (corporate) information should be protected in accordance with security policy. Unauthorized disclosure should be prevented. Cyber-crime of all types should be prevented. Security cna be provided at various levels, according to business need. The system should provide the means to secure information according to these needs, and may need to offer different levels of security for different types of information (according to security classification). Each entity that will be granted access to system resources and each object that is itself a system resource should be uniquely identified (named) such that there can never be confusion as to which entity or object is being referenced. The security of the system should not rely upon the security of any other system that is not within the direct span of control of this system. Information that has value to the business should be in the possession of the business, stored and protected by the system against loss (as in no longer being available) or theft (as in being disclosed to an unauthorised party). This will include information that is regarded as "intellectual property". The integrity of information should be protected to provide assurance that is has not suffered unauthorized modification, duplication, or deletion. When on party uses the system to send a message to another party, it should not be possible for the first party to falsely deny having sent the message, or to falsely deny it's contents. There should be an entity designated as "owner" of every system. This owner is the policy maker for all aspects of risk management with respect to the system, and exerts the ultimate authority for controlling the system. The privacy of (personal) information should be protected in accordance with relevant privacy or "data protection" legislation, so as to meet the reasonable expectation of citizens for privacy. Unauthorized disclosure should be prevented. The system should be able to be trusted to behave in the ways specified in its functional specification and should protect against a wide range of potential abuses. The system should provide forensic records (audit trails and so on) that will be deemed to be "admissible" in a court of law, should that evidence ever need to be presented in support of a criminal prosecution or a civil litigation. The system should comply with all applicable regulations, laws, contracts, policies, and mandatory standards, both internal and external. The system should be designed, implemented and operated such that all applicable contracts, policies, regulations, and laws can be enforced by the system. The system should be risk-managed to enable an insurer to offer reasonable commercial terms for insurance against a standard range of insurable risks. The system should be designed, implemented, and operated in accordance with the requirements of any applicable legislation. Examples include data protection laws, laws controlling the use of cryptographic technology, laws controlling insider dealing on the stock market, and laws governing information that is considered racist, seditious, or pornographic. The system services should be designed, implemented and operated so as to manage the liability of the organization with regard to errors, fraud, malfunction, and so on. In particular, the responsibilities and liabilities of each party should be clearly defined. The system should be designed, implemented, and operated in accordance with the requirements of any applicable regulations. These may be general (such as safety regulations) or industry-specific (such as banking regulations). The system should be designed, implemented and operated in such a way that disputes can be resolved with reasonable ease and without undue impact on time, cost, or other valuable resources. Meeting requirements for maximum or minimum periods of time, for example, a minimum period for records retention or a maximum period within which something must be completed. The system architecture should, wherever possible, not be locked into specific vendor interface standards and should allow flexibility in the choice of vendors and products, both initially and in the future. Wherever possible, the system shoiuld utilize commercial off-the-shelf or government off-the-shelf components, as appropriate. The system should be capable of being extended to incorporate new functional modules as required by the business. The system should be flexible and adaptable to meet new business requirements as they emerge. The system architecture should be designed as much as possible to accommodate future changes in both business requirements and technical solutions. A new system should be able to work with any legacy systems or databases with which it needs to interoperate or integrate. There should be a feasible, manageable migration path, acceptable to the business users, that moves from an old system to a new one, or from one released version to the next. Critical system components should be obtainable from more than one source, to protect against the risk of the single source of supply and support being withdrawn. The system should be scalable to the size of user community, data storage requirements, processing throughput, and so on that might emerge over the lifetime of the system. The system should be as simple as possible, since complexity only adds further risk. The system should be designed, implemented and operated to comply with appropriate technical and operational standards. The development and implementation of system components should be documented so as to provide complete two-way traceability. That is, every implemented component should be justifiable by tracing back to the business requirements that led to its inclusion in the system, and it should be possible to review every business requirement and demonstrate which of the implemented system components are there to meet this requirement. The system should be capable of being upgraded with ease to incorporate new releases of hardware and software. The system should help to establish, build, and support the brand of the products or services based upone this system. Enabling the business and fulfilling business objectives should be the primary driver for the system design. The system should protect the reputation of the organization as being competent in its industry sector. The system should behave in such a way as to safeguard confidence placed in the organization by customers, suppliers, shareholders, regulators, financiers, the marketplace, and the general public. The system should behave in such a way as to safeguard the credibility of the organization. The system should be designed, built, and operated with due care and attention to cultural issues relating to those who will experience the system in any way. These issues include such matters as religion, gender, race, nationality, language, dress code, social customs, ethics, politics, and the environment. The objective should be to avoid or minimize offence or distress caused to others. The system architecture and design should allow new business initiatives to be delivered to the market with minimum delay. The system should enable the owners and executive managers of the organization to control the business and to discharge their responsibilities for governance. Protecting other parties with whom we do business from abuse, loss of business, or personal information of value to those parties through inadequate stewardship on our part. As much as possible, the system should be designed to reuse previous investments and to ensure that new investments are reusable in the future. The system should provide a return of value to the business to justify the investment made in creating and operating the system. The system should behave in such a way as to safeguard the business reputation of the organization. https://github.com/yasenstar/ArchiMate_SABSA/blob/main/Docs/Information%20Security%20Governance%20-%202008%20-%20Brotby%20-%20Appendix%20A%20%20SABSA%20Business%20Attributes%20and%20Metrics.pdf