Monitoring indicators. To ease understanding of indicators, let us first give an explanation of indicators. • An Indicator is a piece of information that is relevant for assessing the risk level and it may be assigned to any risk-model element. Let us consider a simple example. Let assume that we have modelled a vulnerability Weak password. Then, a potential indicator for this vulnerability could be the number of users that do not follow the password policy. If we gather information indicating a large number of users not complying with the password policy, we may argue that the target under analysis is most likely exposed to the vulnerability Weak password. Thus, the indicators are defined in terms of questions, for example, "How many users do not comply with the password policy?" The objective of this section is to associate some of the metrics generated by the currently available sensors in the WISER monitoring infrastructure (described in detail in section 4.1.3) with indicators that could be relevant for the risk assessment. These metrics can be: • generated directly by a Sensor: in this case the sensor variables will be sent to the RabbitMQ in the way of JSON Events by the WISER Agent • generated by the Monitoring Engine from incoming events with sensor variables received from the RabbitMQ. Indicators will be generated by the Risk Assessment Engine based on one or several different events and/or alarms. This document will help to identify the mapping required in the Risk Assessment Engine for the generation of the indicators values from the incoming events/alarms provided by the WISER Monitoring infrastructure and stored in the Data Warehouse. These indicators will be considered in the WISER modelling module to determine the Cyber risk patterns. Examples of reports as JSON documents are presented below. The first example depicts an example of an alarm generated by the Monitoring Engine as it is received in the RabbitMQ Server. The description of each field is explained in section 8.2. In this case, the alarm is the one to be used in the Risk Assessment Engine for the generation of the indicator NetworkScan: {"AlarmEvent":{
Monitoring indicators. Indicators Goal 2006 2007 2008 2009 Activities Assumptions % of DCA mechanism use in P+L 100% 30% 40% 30% 0 4.1.1, 4.1.2, Enterprises interested in and EE 4.2.1, 4.2.3, loans to invest in P+L 4.2.5, 4.3.1 efficiency adopted 4.1.4, 4.2.1, enterprises 4.2.3, 4.2.4, 4.2.5, 4.2.7 Number of voluntary agreements 10 5 5 4.1.1, 4.1.2, Government authorities for cleaner production, defined 4.1.3, 4.2.2 and private sector ready to 4.2.4,4.2.6 sign voluntary agreements Number of incentives or flexible 1 1 4.1.1, 4.1.2 Governmental authorities mechanisms adopted 4.1.3, 4.2.2 ready to support incentive instruments Number of people trained in the 400 80 120 160 40 4.1.1, 4.1.2, public and private sector in P+L 4.2.2, 4.2.3, and EE 4.2.4. 4.3.1 Number of consultation received inP+L and EE 90 10 20 40 20 4.3.1, Economic savings as a product of 4.1.1, 4.1.2, Readiness of enterprises in cleaner technology and production 4.1.4, 4.2.1, sharing savings adoption 4.2.3, 4.2.4, information 4.2.5, 4.2.7 V. Budget Functions /Activities 2006 8 months 2007 12 months 2008 12 months 2009 6 months TOTAL
Monitoring indicators. Indicators Goal 2006 2007 2008 2009 Activities Discussion forum for the environment and trade/economy agenda constituted and working 100% 5.1.1,5.1.2,5.1.3,5.1.4 Number of regional forums regular meetingsperformed for the coordination and articulation 15 4 4 4 3 5.1.1,5.1.2,5.1.3,5.1.4 V. Budget Functions /Activities 2006 8 months 2007 12 months 2008 12 months 2009 6 months TOTAL
Monitoring indicators. No Indicator Numbe r % 2006 % 2007 % 2008 % 2009 Activities Assumptions
