Risk Assessment
Document ID: ISMS-POL-004
Version: 1.0
Assessment Date: December 29, 2025
Next Review: June 29, 2026
Classification: Internal
1. Purpose#
This Risk Assessment identifies, analyzes, and evaluates information security risks to anonym.legal. It provides the basis for risk treatment decisions and security control implementation.
2. Scope#
This assessment covers:
- Information assets (customer data, system configurations, code)
- Technical infrastructure (servers, databases, networks)
- Application security (frontend, backend services)
- Operational processes (deployment, monitoring, support)
3. Risk Assessment Methodology#
3.1 Risk Calculation#
Risk = Likelihood × Impact
3.2 Likelihood Scale#
| Rating | Description | Probability |
|---|---|---|
| 1 | Rare | < 1% per year |
| 2 | Unlikely | 1-10% per year |
| 3 | Possible | 10-50% per year |
| 4 | Likely | 50-90% per year |
| 5 | Almost Certain | > 90% per year |
3.3 Impact Scale#
| Rating | Description | Business Impact |
|---|---|---|
| 1 | Negligible | Minimal disruption, no data loss |
| 2 | Minor | Limited disruption, minor data exposure |
| 3 | Moderate | Significant disruption, moderate data exposure |
| 4 | Major | Severe disruption, significant data breach |
| 5 | Critical | Business threatening, massive data breach |
3.4 Risk Matrix#
| Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 | |
|---|---|---|---|---|---|
| Likelihood 5 | Medium | Medium | High | Critical | Critical |
| Likelihood 4 | Low | Medium | Medium | High | Critical |
| Likelihood 3 | Low | Low | Medium | Medium | High |
| Likelihood 2 | Low | Low | Low | Medium | Medium |
| Likelihood 1 | Low | Low | Low | Low | Medium |
4. Asset Inventory#
4.1 Information Assets#
| Asset | Classification | Owner | Location |
|---|---|---|---|
| Customer PII | Confidential | Platform | Database (relational database) |
| User Credentials | Confidential | Platform | Database (hashed) |
| Encryption Keys | Confidential | Customer | Database (encrypted) |
| API Tokens | Confidential | Customer | Database (hashed) |
| Application Code | Internal | Development | Server/Repository |
| System Configurations | Internal | Operations | Server |
| Logs | Internal | Operations | Server |
4.2 Technical Assets#
| Asset | Type | Location | Criticality |
|---|---|---|---|
| Web Server | Infrastructure | Hetzner Cloud | High |
| Database Server | Infrastructure | Hetzner Cloud | Critical |
| Presidio Services | Application | Hetzner Cloud | High |
| Frontend Application | Application | Hetzner Cloud | High |
5. Threat Identification#
5.1 External Threats#
| Threat | Description |
|---|---|
| Cyber Attacks | Targeted attacks, hacktivism |
| DDoS | Distributed denial of service |
| Malware | Ransomware, trojans |
| Social Engineering | Phishing, pretexting |
| Data Theft | Intellectual property theft |
5.2 Internal Threats#
| Threat | Description |
|---|---|
| Insider Threat | Malicious or negligent insiders |
| Human Error | Misconfiguration, accidental disclosure |
| Process Failure | Inadequate procedures |
5.3 Environmental Threats#
| Threat | Description |
|---|---|
| Hardware Failure | Server/storage failure |
| Network Failure | Connectivity issues |
| Power Failure | Data center power issues |
| Natural Disaster | Fire, flood, earthquake |
6. Risk Register#
6.1 Critical Risks#
| ID | Risk | Likelihood | Impact | Risk Level | Treatment |
|---|---|---|---|---|---|
| R001 | Customer data breach via SQL injection | 2 | 5 | Medium | Mitigate: Secure ORM, parameterized queries |
| R002 | Credential theft via brute force | 3 | 4 | Medium | Mitigate: Account lockout, 2FA |
| R003 | Service outage due to DDoS | 3 | 3 | Medium | Mitigate: Rate limiting, Hetzner DDoS protection |
6.2 High Risks#
| ID | Risk | Likelihood | Impact | Risk Level | Treatment |
|---|---|---|---|---|---|
| R004 | Unauthorized admin access | 2 | 4 | Medium | Mitigate: SSH keys, 2FA, audit logging |
| R005 | Data exposure via API vulnerability | 2 | 4 | Medium | Mitigate: JWT auth, feature gating, rate limiting |
| R006 | Encryption key compromise | 1 | 5 | Medium | Mitigate: AES-256-GCM, key per user, secure storage |
6.3 Medium Risks#
| ID | Risk | Likelihood | Impact | Risk Level | Treatment |
|---|---|---|---|---|---|
| R007 | Session hijacking | 2 | 3 | Low | Mitigate: Secure cookies, JWT, HTTPS |
| R008 | XSS vulnerability | 2 | 3 | Low | Mitigate: CSP, frontend framework auto-escaping |
| R009 | Dependency vulnerability | 4 | 2 | Medium | Mitigate: npm audit, regular updates |
| R010 | Data loss due to backup failure | 2 | 4 | Medium | Mitigate: Hetzner snapshots, tested recovery |
6.4 Low Risks#
| ID | Risk | Likelihood | Impact | Risk Level | Treatment |
|---|---|---|---|---|---|
| R011 | Minor service degradation | 3 | 1 | Low | Accept: Monitoring, auto-restart |
| R012 | Non-critical feature unavailable | 3 | 1 | Low | Accept: Graceful degradation |
7. Risk Treatment#
7.1 Treatment Options#
| Option | Description | When to Use |
|---|---|---|
| Mitigate | Implement controls to reduce risk | Risk exceeds tolerance |
| Transfer | Insurance, outsourcing | Cannot fully mitigate |
| Accept | Acknowledge and monitor | Risk within tolerance |
| Avoid | Eliminate risk source | Risk too high, cannot mitigate |
7.2 Implemented Controls#
| Risk ID | Control | Status | Effectiveness |
|---|---|---|---|
| R001 | Secure ORM (parameterized queries) | ✅ Implemented | High |
| R002 | Account lockout (5 attempts/30 min) | ✅ Implemented | High |
| R002 | Password complexity (12+ chars) | ✅ Implemented | High |
| R002 | 2FA support (TOTP/Email) | ✅ Implemented | High |
| R003 | Rate limiting | ✅ Implemented | Medium |
| R004 | SSH key authentication | ✅ Implemented | High |
| R004 | Brute force protection | ✅ Implemented | High |
| R005 | JWT authentication | ✅ Implemented | High |
| R005 | Feature gating | ✅ Implemented | High |
| R006 | AES-256-GCM encryption | ✅ Implemented | High |
| R007 | Secure cookies (HttpOnly, Secure) | ✅ Implemented | High |
| R007 | HTTPS only (TLS 1.2+) | ✅ Implemented | High |
| R008 | Content Security Policy | ✅ Implemented | High |
| R009 | npm audit in CI | ✅ Implemented | Medium |
| R010 | Hetzner cloud snapshots | ✅ Implemented | High |
8. Residual Risk#
After implementing controls, the following residual risks remain:
| Risk ID | Original Level | Residual Level | Notes |
|---|---|---|---|
| R001 | Medium | Low | Secure ORM prevents SQL injection |
| R002 | Medium | Low | Multiple controls in place |
| R003 | Medium | Low | Rate limiting + provider protection |
| R004 | Medium | Low | SSH keys + brute force protection |
| R005 | Medium | Low | JWT + feature gating |
| R006 | Medium | Low | Strong encryption, key isolation |
| R009 | Medium | Low | Regular updates, dev deps only |
9. Risk Monitoring#
9.1 Key Risk Indicators (KRIs)#
| KRI | Threshold | Monitoring Frequency |
|---|---|---|
| Failed login attempts | > 100/day | Daily |
| API error rate | > 5% | Real-time |
| Vulnerability count (high/critical) | > 0 in prod deps | Weekly |
| Service availability | < 99.9% | Real-time |
| Security incidents | Any P1/P2 | Immediate |
9.2 Review Schedule#
| Activity | Frequency |
|---|---|
| Risk register review | Quarterly |
| Full risk assessment | Annually |
| Control effectiveness review | Bi-annually |
| Threat landscape review | Quarterly |
10. Document Control#
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | 2025-12-29 | Security Team | Initial release |