Assignment Instructions
Project 3 – Identifying and Analyzing Threats, Vulnerabilities, and Exploit
Purpose
In Projects 1 and 2, you established the organizational and risk management context for the Sabine Coastal Health Network (SCHN) and identified the assets and business activities that require protection.
Project 3 continues that work.
Your role is to identify and analyze the threats, vulnerabilities, and potential exploits that could affect the important assets and business activities you identified in Project 2
The goal is not to create the longest possible list of cybersecurity problems. Your goal is to determine which threats and vulnerabilities are meaningful within SCHN’s specific operating environment and explain how they could affect the organization.
Your analysis must remain grounded in:
The SCHN scenario
Your decisions from Projects 1 and 2
The Project 3 scenario update
The assigned textbook chapters
SCHN’s operational, financial, technical, and organizational realities
You continue to serve as a cybersecurity analyst advising SCHN leadership. AI may assist you as a junior analyst, but you are responsible for evaluating its recommendations and making all final decisions.
Required Sources
Primary Sources: Assigned Textbook Chapters
The textbook is the primary source for this project.
Your analysis should demonstrate that you understand and can apply concepts from the following chapters of Managing Risk in Information Systems, 3rd Edition:
Chapter 2 – Managing Risk: Threats, Vulnerabilities, and Exploits
Use Chapter 2 to help distinguish and relate:
Threats
Threat sources
Vulnerabilities
Exploits
Risk
Organizational exposure
Chapter 6 – Performing a Risk Assessment
Use Chapter 6 for the broader risk-assessment context, including:
Identifying relevant risk information
Understanding organizational exposure
Connecting threats and vulnerabilities to assets and activities
Recognizing uncertainty and information gaps
You are not performing the complete risk assessment in this project. You will formally evaluate likelihood, impact, and overall risk in Project 4.
Chapter 8 – Identifying and Analyzing Threats, Vulnerabilities, and Exploits
Chapter 8 is the primary chapter for the analytical work in Project 3.
Use it to help:
Identify realistic threats
Identify vulnerabilities
Analyze potential exploits
Connect threats and vulnerabilities
Determine how weaknesses could affect organizational assets and activities
Support your prioritization of the exposures requiring further assessment
Source Priority
When developing your analysis:
1. Assigned textbook chapters are the primary source.
2. The SCHN scenario provides the organizational facts and conditions you must analyze.
3. NIST publications may be used as secondary supporting sources.
4. Other credible sources may provide limited additional support when necessary.
5. AI output is not a source and does not replace assigned readings.
Your work should not rely primarily on NIST publications, websites, or AI-generated explanations instead of the assigned textbook.
Optional NIST Secondary Sources
The following NIST Special Publications may be used to supplement the textbook.
They are secondary sources only and are not substitutes for the assigned chapters.
NIST SP 800-30 Rev. 1 – Guide for Conducting Risk Assessments
This is the most useful NIST secondary source for Project 3.
Students may use it for additional support related to:
Threat sources
Threat events
Vulnerabilities
Predisposing conditions
Risk-assessment information
Uncertainty within risk analysis
The threat, threat-event, and vulnerability guidance may be particularly useful when evaluating whether an exposure identified for SCHN is reasonable.
Do not move ahead into detailed likelihood, impact, or risk calculations. Those concepts will be addressed more directly in Project 4.
NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations
This publication may be used for additional context regarding the NIST Risk Management Framework (RMF).
For Project 3, it may help students understand how identifying threats and vulnerabilities contributes to the larger risk management process.
Do not attempt to complete the entire RMF or turn this project into a control-selection exercise.
NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management
This publication may be useful when analyzing the Microsoft 365 security incident introduced in this project.
It may provide secondary support for understanding:
Cybersecurity incidents
Incident-related information
Organizational consequences
The relationship between incidents and cybersecurity risk management
Information that may be needed before conclusions can be reached
The purpose of using this publication is to support your analysis of the incident. You are not developing a complete incident response plan in Project 3.
Relationship to Projects 1 and 2
Project 3 must build directly on your previous work.
Project 1 established:
SCHN’s organizational environment
Important business functions
Technology environment
Stakeholders
Third-party dependencies
Organizational constraints
Risk management context
Project 2 identified and prioritized:
Important assets
Important business activities
Information and technology resources
Dependencies among assets and activities
Consequences if important assets or activities were compromised or unavailable
Project 3 asks:
What could realistically threaten those assets and activities, what weaknesses could make those threats successful, and how could those weaknesses potentially be exploited?
Use your previous work rather than starting over.
However, cybersecurity risk is not static. You may revise a conclusion from Projects 1 or 2 if the new information in this project changes a previous assumption.
If you revise a previous decision, briefly explain what changed and why.
Project 3 Scenario Update
Suspicious Microsoft 365 Account Activity
SCHN recently experienced a security incident involving an employee in the centralized billing office.
The employee received an email that appeared to be a Microsoft 365 security notification. The message directed the employee to a website that closely resembled the Microsoft sign-in page. The employee entered a username and password, then became suspicious and contacted the help desk.
The IT department reset the employee’s password approximately 30 minutes later.
A preliminary review identified the following:
A successful login to the employee’s Microsoft 365 account occurred from an unfamiliar Internet address shortly after the employee entered the credentials.
A new email forwarding rule had been created in the employee’s mailbox.
The employee routinely communicates by email with insurance companies, patients, healthcare partners, and other SCHN employees.
The employee has access to billing, claims, insurance, and patient-related information required to perform the job.
SCHN has not determined whether sensitive information was accessed or removed.
No evidence currently indicates that the electronic health record was accessed through the compromised account.
IT personnel are continuing to investigate.
Executive leadership wants to know whether this incident is isolated or evidence of broader exposure within SCHN.
Important
Do not assume that a major data breach occurred.
Do not assume that SCHN is secure simply because a breach has not been confirmed.
Treat the available information as incomplete evidence that must be analyzed.
Assignment
Prepare a Threat, Vulnerability, and Exploit Analysis for SCHN.
Your analysis must connect realistic threats to specific organizational assets, business activities, vulnerabilities, and potential exploitation methods.
You are expected to exercise professional judgment.
Do not simply generate a generic list of cybersecurity threats.
Required Sections
1. Project 2 Continuity and Changes
Briefly explain how this analysis builds on your Project 2 work.
Identify the 3–5 assets or business activities from Project 2 that will receive the greatest attention in this project.
For each, briefly explain why it remains important.
If the new scenario information causes you to change a priority or assumption from Project 2, identify the change and explain why.
You are not required to change your previous conclusions simply because new information was provided. Revise them only when you believe the evidence justifies doing so.
2. Threat Identification
Identify at least six meaningful threat scenarios that could affect the assets or business activities selected for analysis.
Your six scenarios must collectively include:
At least one threat related to the Microsoft 365 incident
At least one third-party or vendor-related threat
At least one internal or human-related threat
At least one physical or environmental threat, such as hurricane, flooding, fire, power failure, severe weather, or another condition relevant to SCHN
One threat scenario may satisfy more than one category when appropriate.
For each threat, explain:
The threat source or event
The asset or business activity affected
Why the threat is relevant to SCHN
The possible effect on confidentiality, integrity, and/or availability
Avoid generic statements such as:
“Hackers could attack the network.”
Instead, describe a realistic relationship between the threat and SCHN’s environment.
3. Vulnerability Analysis
For each threat scenario, identify one or more vulnerabilities or weaknesses that could allow the threat to cause harm.
Vulnerabilities may involve:
Technology
People
Processes
Configuration
Access management
Physical security
Third parties
Legacy systems
Medical devices
Remote access
Monitoring
Backup practices
Training
Documentation
Business processes
Infrastructure or facilities
Clearly distinguish a vulnerability from a threat.
For example:
Threat: Credential phishing
Potential vulnerability: Weak employee awareness or inadequate authentication
Potential exploit: Stolen credentials used to gain unauthorized account access
Whenever possible, support vulnerabilities using information from the SCHN scenario.
If you identify a reasonable vulnerability that is not specifically stated in the scenario, label it as an:
Assumption or information gap requiring verification
Do not present assumptions as established facts.
4. Threat–Vulnerability–Exploit Analysis Table
Create a table covering your six or more threat scenarios.
|
Asset or Business Activity |
Threat |
Relevant Vulnerability |
Potential Exploit or |
C/I/A Affected |
Potential |
Scenario Evidence or |
Your entries should demonstrate the following relationship:
Asset/Activity → Threat → Vulnerability → Potential Exploit → Organizational Consequence
The table should summarize your analysis rather than replace your explanation.
5. Deeper Analysis of Three Priority Exposure Paths
Select the three threat-vulnerability combinations that you believe deserve the greatest management attention.
For each, address the following.
What is at risk?
Identify the important asset, information, system, or business activity involved.
What is the threat?
Explain the threat source or event.
What makes SCHN vulnerable?
Identify the weakness, condition, or exposure that could allow the threat to succeed.
How could the vulnerability be exploited?
Explain the plausible method or pathway through which the vulnerability could be used.
Describe the exploit conceptually. Do not provide attack code, commands, penetration-testing instructions, or detailed procedures for compromising systems.
What could happen to SCHN?
Explain realistic consequences, considering factors such as:
Patient safety
Patient care
Confidentiality
Information integrity
System availability
Regulatory responsibilities
Financial operations
Revenue
Employee productivity
Third-party relationships
Organizational reputation
Explain why the exposure matters to SCHN, rather than simply labeling it “high risk.”
6. Analysis of the Microsoft 365 Incident
Provide a focused analysis of the new security incident.
Address:
1. What threat or threats are represented by the incident?
2. What vulnerabilities may have contributed to the incident?
3. What appears to have been successfully exploited?
4. What additional assets or business activities could potentially be affected?
5. What additional information should SCHN collect before determining the severity and scope of the incident?
6. Does the incident change any assumption or priority from Projects 1 or 2? Why or why not?
Your analysis should clearly distinguish among:
Known
Facts directly supported by the scenario.
Reasonably Inferred
Conclusions that are supported by available evidence but are not confirmed.
Unknown
Information that SCHN would need to obtain before reaching a conclusion.
7. Priority Information Gaps
Identify at least three important information gaps that limit your ability to analyze SCHN’s threats and vulnerabilities.
For each:
State what information is missing.
Explain why it matters.
Explain how obtaining the information would improve the analysis.
Information gaps could involve:
Technical configurations
User permissions
Authentication requirements
Vendor practices
System inventories
Logging
Backup arrangements
Medical devices
Remote access
Physical safeguards
Security awareness practices
Do not invent missing information simply to complete your analysis.
Recognizing uncertainty is part of professional risk analysis.
8. Preparation for Project 4
Conclude by identifying the three threat-vulnerability combinations that should move forward into formal risk assessment in Project 4.
Briefly explain why each deserves further assessment.
At this stage, do not:
Assign formal likelihood ratings
Assign formal impact ratings
Calculate overall risk scores
Develop a complete risk matrix
Those activities belong in Project 4: Defining and Performing a Risk Assessment.
Applying the Assigned Readings
Simply mentioning a textbook chapter or defining terminology is not sufficient.
Your analysis should demonstrate that you can apply course concepts to SCHN.
For example, instead of writing:
“A vulnerability is a weakness that can be exploited.”
Apply the concept:
“SCHN’s inconsistent use of MFA may create a vulnerability because stolen employee credentials could provide unauthorized access to cloud services.”
The second example demonstrates application rather than definition.
The textbook should provide the primary conceptual foundation for your analysis. NIST guidance may strengthen or support your reasoning but should not replace the textbook.
AI Use Requirement
Continue to treat AI as a junior analyst, not the decision-maker.
AI may help you:
Identify possible threats
Generate questions about vulnerabilities
Identify relationships you may have overlooked
Challenge assumptions
Suggest alternative interpretations
Review your reasoning
Identify weaknesses in your analysis
Organize information
AI can easily produce long lists of generic cybersecurity threats. Your responsibility is to determine whether an AI recommendation is actually relevant to SCHN and supported by the available evidence.
Complete the same AI Prompt and Evaluation Log requirements used in Projects 1 and 2.
At least one documented interaction must show that you challenged, corrected, substantially revised, or rejected part of an AI response. AI-generated content is not a primary or secondary academic source.
What Not to Do
Do not:
Start over with a different organization.
Ignore decisions made in Projects 1 and 2.
Submit a generic list of cybersecurity threats.
Assume every possible vulnerability exists at SCHN.
Treat threats, vulnerabilities, and exploits as interchangeable.
Invent technical details without identifying them as assumptions.
Assume the Microsoft 365 incident resulted in a confirmed major data breach.
Provide detailed attack or penetration-testing procedures.
Calculate a complete risk score or risk matrix.
Develop a complete mitigation or control implementation plan.
Rely primarily on AI, NIST, or general Internet sources instead of the assigned textbook.
Accept AI-generated recommendations without evaluating their relevance to SCHN.
Submission Requirements
Submit one professional document containing the required Project 3 analysis.
Suggested Length
5 pages of project content
The following do not count toward the five-page maximum:
Title page
References
Threat–Vulnerability–Exploit Analysis Table
AI Prompt and Evaluation Log appendix
Formatting
Use clear headings corresponding to the required sections.
Use professional business writing.
Support your analysis primarily with the assigned textbook chapters.
Cite NIST or other secondary sources when used.
Use APA-style citations and references where appropriate.
Include the AI Prompt and Evaluation Log as an appendix.
Review your work for consistency with Projects 1 and 2 before submitting.
Primary Question to Keep in Mind
Given what SCHN values and depends upon, what realistic threats could take advantage of its weaknesses, how could that occur, and why should management care?
Your job is not to identify every possible cybersecurity problem.
Your job is to provide SCHN leadership with a focused, evidence-based, and defensible analysis of the exposures that matter most to this organization.