"A risk assessment of the Piql Services" by FFI

The number of scenarios chosen to be part of the assessment is abnormally large for an assignment this size, yet it was unavoidable as the risks and threats which may harm the Piql Preservation Services in its current application areas are so many. Including such a large number of scenarios is made possible by the use of a scenario template. We now turn our attention to the development and adaptation of the scenario template, and finally, present the finished scenarios for further analysis.

7 Developing a Scenario Template

The purpose of developing a scenario template to help with the process of scenario description is twofold. The first is that it will enable thorough analysis of a greater number of scenarios. A risk assessment of this scale necessitates a wide range of scenarios covering a wide range of possible security challenges and vulnerabilities threatening the Piql Preservation Services. Making use of a template means that we can more easily cover a greater number of scenarios without the risk of omitting important elements as they are all clearly and distinctly laid out. The second reason for utilising a template for the scenario description is simply ease of use for interested parties at later stages. As this report is part of a larger project, it is meant to be used by the Consortium partners in later work packages when revised design and requirement specifications of the components of the Piql Preservation Services are developed. By using a template, the format of every scenario is identical, which makes them clear and comprehensible. The vulnerabilities and the security challenges faced by the Piql Preservation Services are distinctly listed, making it easier for the Consortium partners to refer back to the scenarios and the risks they identify if needed. In the template it is also possible to list divergences from the ISO standard used as ideal storage conditions that may occur in a scenario for future testing purposes. Additionally, by presenting the scenarios in this stylised form, it is meant to be simple for existing and potential Piql partners to use this general risk assessment when analysing their own more specific safety and security needs. They should easily be able to follow the logic of the developments in the scenarios and adapt it to their circumstances, or they can even use the empty template as an initial tool to perform their individual risk and vulnerability assessments. The scenario template used in the report to develop risk scenarios for the Piql Preservation Services is shown in figure 7.1. The text in italics is instructions and explanations on what information is to be filled in, and is meant to be replaced by the relevant information for a given scenario.

59

FFI-RAPPORT 16/00707