From 09fb70d75f798930e416b0d6691847b6b2146087 Mon Sep 17 00:00:00 2001 From: Antoine Bouchardy Date: Sat, 19 Apr 2025 12:57:31 -0700 Subject: [PATCH] Update risks.json Update risk library Signed-off-by: Antoine Bouchardy Signed-off-by: Antoine Bouchardy Signed-off-by: Bryan Frimin --- apps/console/public/data/risks/risks.json | 522 +++++++++++++--------- 1 file changed, 315 insertions(+), 207 deletions(-) diff --git a/apps/console/public/data/risks/risks.json b/apps/console/public/data/risks/risks.json index 2b65fb150..18ff27fc6 100644 --- a/apps/console/public/data/risks/risks.json +++ b/apps/console/public/data/risks/risks.json @@ -1,254 +1,362 @@ [ { - "name": "Data Breach via Phishing", - "description": "Phishing attacks targeting employees can lead to unauthorized access to sensitive data, such as credentials, which can result in a data breach.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 4, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "category": "Compliance & Legal", + "name": "Regulatory penalty with GDPR non-compliance", + "description": "Failure to comply with data privacy laws such as GDPR leads to fines and reputational harm." }, { - "name": "Ransomware Locking Critical Systems", - "description": "Attackers can encrypt critical business data and systems, demanding ransom to restore access. This disrupts operations and can result in financial loss.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 5, - "likelihood": 2, - "recommendedTreatment": "Transfer" - } - ] + "category": "Compliance & Legal", + "name": "Intellectual property infringement", + "description": "Using or integrating third-party content or software without proper licensing results in lawsuits or product takedowns." }, { - "name": "Malicious or Negligent employee", - "description": "An employee could leak sensitive data or compromise systems, leading to data loss or operational damage.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 3, - "recommendedTreatment": "Reduce" - } - ] + "category": "Compliance & Legal", + "name": "Legal Exposure via employment law violations", + "description": "Improper classification of employees or non-compliance with labor laws can lead to penalties or legal disputes." }, { - "name": "Theft of Intellectual Property (IP)", - "description": "Attackers, including competitors, could steal intellectual property, including designs, algorithms, or trade secrets, harming competitive advantage.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 1, - "recommendedTreatment": "Accept" - } - ] + "category": "Compliance & Legal", + "name": "Business suspension due to missing licenses or permits", + "description": "Operating without required business authorizations results in fines or forced operational halt." }, { - "name": "Exploitation of Unpatched Vulnerabilities", - "description": "Failure to apply security patches on time leaves systems vulnerable to known exploits, allowing attackers to compromise or control critical systems.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "category": "Compliance & Legal", + "name": "Contractual risk due to poorly drafted agreements", + "description": "Weak contracts leads to disputes, missed deliverables, or revenue leakage" }, { - "name": "Distributed Denial-of-Service (DDoS) Attack", - "description": "A DDoS attack overwhelms your online services with fake traffic, making them unavailable to customers, causing operational downtime and reputational damage.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 2, - "recommendedTreatment": "Reduce" - } - ] + "category": "Compliance & Legal", + "name": "Cross-border operations creates jurisdictional risk", + "description": "Operating in multiple countries without understanding local laws exposes the company to fines or bans" }, { - "name": "Third-Party Vendor Breach Compromising Startup Data", - "description": "If a third-party vendor with access to your systems is breached, your sensitive data may be exposed due to poor security on the vendor's side.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 1, - "likelihood": 1, - "recommendedTreatment": "Accept" - } - ] + "category": "Compliance & Legal", + "name": "Data sovereignty issue with cloud storage", + "description": "Storing user data in the wrong jurisdiction violates local data sovereignty laws" }, { - "name": "Loss of data due to poor or nonexistant Backup Strategy", - "description": "Inadequate or nonexistent backups can lead to permanent data loss, potentially halting operations for extended periods.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 3, - "recommendedTreatment": "Reduce" - } - ] + "category": "Compliance & Legal", + "name": "IP infringement due to generative AI misuse", + "description": "Use of generative AI without proper content controls can create outputs that violate copyright or trademark protections" }, { - "name": "Account Compromise via Weak Authentication", - "description": "Weak passwords or lack of multi-factor authentication (MFA) can lead to unauthorized access to accounts and critical business systems.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "category": "Cybersecurity", + "name": "Data Breach via phishing", + "description": "Phishing attacks targeting employees can lead to unauthorized access to sensitive data, such as credentials, which can result in a data breach." }, { - "name": "Reputational Damage from Customer Data Leak", - "description": "A breach that exposes sensitive customer data can cause significant reputational damage, reducing trust and potentially leading to lost revenue.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 4, - "likelihood": 3, - "recommendedTreatment": "Transfer" - } - ] + "category": "Cybersecurity", + "name": "Ransomware locking critical systems", + "description": "Attackers can encrypt critical business data and systems, demanding ransom to restore access. This disrupts operations and can result in financial loss." }, { - "name": "Regulatory Non-Compliance Leading to Penalties", - "description": "Failure to meet legal standards for data protection (e.g., GDPR) can result in fines and legal action following a breach or violation.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 4, - "likelihood": 2, - "recommendedTreatment": "Reduce" - } - ] + "category": "Cybersecurity", + "name": "Malicious or negligent employee", + "description": "An employee could leak sensitive data or compromise systems, leading to data loss or operational damage." }, { - "name": "Fraud via Social Engineering (Impersonation or BEC)", - "description": "Social engineering tactics such as impersonating executives or vendors can trick employees into making fraudulent payments, causing financial loss.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 1, - "recommendedTreatment": "Accept" - } - ] + "category": "Cybersecurity", + "name": "Theft of intellectual property (IP)", + "description": "Attackers, including competitors, could steal intellectual property, including designs, algorithms, or trade secrets, harming competitive advantage." }, { - "name": "Device Theft Leading to Data Exposure", - "description": "Loss or theft of employee devices without proper encryption or remote wipe capabilities can result in exposure of sensitive company data.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 1, - "likelihood": 3, - "recommendedTreatment": "Reduce" - } - ] + "category": "Cybersecurity", + "name": "Exploitation of unpatched vulnerabilities", + "description": "Failure to apply security patches on time leaves systems vulnerable to known exploits, allowing attackers to compromise or control critical systems." }, { - "name": "Cloud Misconfiguration Causing Data Exposure", - "description": "Misconfigured cloud environments can accidentally expose sensitive data (e.g., public-facing storage buckets), leading to data leaks.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 3, - "recommendedTreatment": "Reduce" - } - ] + "category": "Cybersecurity", + "name": "Distributed denial-of-service (DDoS) attack", + "description": "A DDoS attack overwhelms your online services with fake traffic, making them unavailable to customers, causing operational downtime and reputational damage." }, { - "name": "API Exploits Leading to Data Breaches", - "description": "Poorly secured or vulnerable APIs can be exploited, allowing attackers to access, manipulate, or steal sensitive data from the backend.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 5, - "likelihood": 3, - "recommendedTreatment": "Transfer" - } - ] + "category": "Cybersecurity", + "name": "Third-party vendor breach compromising startup data", + "description": "If a third-party vendor with access to your systems is breached, your sensitive data may be exposed due to poor security on the vendor’s side." }, { - "name": "Employee Mishandling of Data Leading to Privacy Violations", - "description": "Untrained or negligent employees could mishandle sensitive data, resulting in accidental exposure or privacy law violations.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "category": "Cybersecurity", + "name": "Loss of data due to poor or nonexistant backup strategy", + "description": "Inadequate or nonexistent backups can lead to permanent data loss, potentially halting operations for extended periods." }, { - "name": "Account Hijacking of Social Media Platforms", - "description": "If attackers hijack your startup's social media accounts, they could post harmful content or engage in fraudulent activities, damaging the brand.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 1, - "likelihood": 2, - "recommendedTreatment": "Reduce" - } - ] + "category": "Cybersecurity", + "name": "Account compromise via weak authentication", + "description": "Weak passwords or lack of multi-factor authentication (MFA) can lead to unauthorized access to accounts and critical business systems." }, { - "name": "Weak Encryption Causing Data Exposure", - "description": "Insufficient encryption of sensitive data can lead to exposure in the event of interception or theft, making the data easily accessible to attackers.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "category": "Cybersecurity", + "name": "Reputational damage from customer data leak", + "description": "A breach that exposes sensitive customer data can cause significant reputational damage, reducing trust and potentially leading to lost revenue." }, { + "category": "Cybersecurity", + "name": "Regulatory non-compliance leading to penalties", + "description": "Failure to meet legal standards for data protection (e.g., GDPR) can result in fines and legal action following a breach or violation." + }, + { + "category": "Cybersecurity", + "name": "Fraud via social engineering (impersonation or BEC)", + "description": "Social engineering tactics such as impersonating executives or vendors can trick employees into making fraudulent payments, causing financial loss." + }, + { + "category": "Cybersecurity", + "name": "Device theft leading to data exposure", + "description": "Loss or theft of employee devices without proper encryption or remote wipe capabilities can result in exposure of sensitive company data." + }, + { + "category": "Cybersecurity", + "name": "Cloud misconfiguration causing data exposure", + "description": "Misconfigured cloud environments can accidentally expose sensitive data (e.g., public-facing storage buckets), leading to data leaks." + }, + { + "category": "Cybersecurity", + "name": "API exploits leading to data breaches", + "description": "Poorly secured or vulnerable APIs can be exploited, allowing attackers to access, manipulate, or steal sensitive data from the backend." + }, + { + "category": "Cybersecurity", + "name": "Employee mishandling of data leading to privacy violations", + "description": "Untrained or negligent employees could mishandle sensitive data, resulting in accidental exposure or privacy law violations." + }, + { + "category": "Cybersecurity", + "name": "Account hijacking of social media platforms", + "description": "If attackers hijack your startup’s social media accounts, they could post harmful content or engage in fraudulent activities, damaging the brand." + }, + { + "category": "Cybersecurity", + "name": "Weak encryption causing data exposure", + "description": "Insufficient encryption of sensitive data can lead to exposure in the event of interception or theft, making the data easily accessible to attackers." + }, + { + "category": "Cybersecurity", "name": "Ineffective change management process", - "description": "Without proper control over changes to systems of softwares, unauthorized or untested changes could introduce vulnerabilities", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 4, - "recommendedTreatment": "Transfer" - } - ] + "description": "Without proper control over changes to systems of softwares, unauthorized or untested changes could introduce vulnerabilities" }, { + "category": "Cybersecurity", "name": "Insufficient incidient response plan", - "description": "A poorly defined or tested response plan can lead to a slow or inadequate response from the team in reaction to a security breach.", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 1, - "likelihood": 5, - "recommendedTreatment": "Reduce" - } - ] + "description": "A poorly defined or tested response plan can lead to a slow or inadequate response from the team in reaction to a security breach." }, { + "category": "Cybersecurity", "name": "Inadequate logging & monitoring", - "description": "Without proper logging and monitoring, suspicious activities or security incidents may go unnoticed", - "variations": [ - { - "context": "B2B SaaS SMB", - "impact": 3, - "likelihood": 3, - "recommendedTreatment": "Reduce" - } - ] + "description": "Without proper logging and monitoring, suspicious activities or security incidents may go unnoticed" + }, + { + "category": "Finance", + "name": "Cash flow shortage", + "description": "Running out of funds due to high burn rate or delayed revenue forces premature closure of the startup." + }, + { + "category": "Finance", + "name": "Growth stagnation due to delayed fundraising", + "description": "Delays in securing investment halts product development, hiring, or expansion plans." + }, + { + "category": "Finance", + "name": "Misalignment with investors", + "description": "Differences in strategic vision or milestones between founders and investors causes conflicts or withdrawals." + }, + { + "category": "Finance", + "name": "Revenue loss due to pricing strategy", + "description": "Setting product prices too high or low either repels customers or leads to unsustainable margins." + }, + { + "category": "Finance", + "name": "Revenue concentration on few clients", + "description": "Overreliance on one or two large customers makes cash flow vulnerable if they leave" + }, + { + "category": "Finance", + "name": "Forecasting errors due to inaccurate assumptions", + "description": "Poor financial planning based on optimistic projections leads to undercapitalization" + }, + { + "category": "Finance", + "name": "Non-paying clients lead to debt accumulation", + "description": "Providing services before payment without proper vetting leads to bad debt accumulation" + }, + { + "category": "Human capital", + "name": "Inability to attract talent leads to hiring delay", + "description": "Lack of brand visibility, resources, or appeal prevents the startup from hiring the skilled talent it needs." + }, + { + "category": "Human capital", + "name": "Poor hiring fit leads to culture break", + "description": "Recruiting individuals who do not align with the startup’s values or pace cause conflict and reduce cohesion." + }, + { + "category": "Human capital", + "name": "Leadership breakdown due to co-founder conflict", + "description": "Disputes among founders over equity, vision, or roles fracture leadership and jeopardize the company." + }, + { + "category": "Human capital", + "name": "Unsustainable pace leads to team burnout", + "description": "Intense work environments without balance leads to high turnover and decreased productivity" + }, + { + "category": "Human capital", + "name": "Leadership gaps due to delayed hiring", + "description": "Postponing key leadership hires limits decision-making quality and organizational growth" + }, + { + "category": "Human capital", + "name": "Homogenous culture limit diversity, equity and inclusion", + "description": "Lack of diversity affects innovation, morale, and stakeholder perception" + }, + { + "category": "Operations", + "name": "Fragile infrastructure prevent scaling", + "description": "Systems or processes not built to scale breaks down under rapid growth" + }, + { + "category": "Operations", + "name": "Operational blackout due to dependency on single tool", + "description": "Relying on one saas tool for operations creates vulnerability if access is lost or the vendor fails" + }, + { + "category": "Operations", + "name": "Lack of documented process impact customer service", + "description": "Inconsistent execution due to absence of documented procedures affects customer experience" + }, + { + "category": "Operations", + "name": "Execution delays due to inefficient internal processes", + "description": "Inefficient or manual workflows slows execution, reduces quality, and increases costs across core operations." + }, + { + "category": "Operations", + "name": "Supply disruption via vendor dependency", + "description": "Over-reliance on single suppliers or service providers causes operational halts if disruptions occur." + }, + { + "category": "Operations", + "name": "Knowledge loss with departure of key people", + "description": "Loss of a critical employee without backup plans disrupts core activities and strategic continuity." + }, + { + "category": "Operations", + "name": "Customer churn due to product/service failure", + "description": "Bugs, outages, or poor product performance drives away users and damages long-term brand trust." + }, + { + "category": "Reputational", + "name": "Brand damage with negative public reviews", + "description": "Poor customer experience or public backlash quickly damage reputation, especially on digital platforms." + }, + { + "category": "Reputational", + "name": "Reputational loss via unethical conduct", + "description": "Engagement in or association with unethical behavior leads to public criticism and loss of trust." + }, + { + "category": "Reputational", + "name": "Trust erosion due to lack of transparency", + "description": "Hiding problems or failing to communicate openly with stakeholders undermines credibility and confidence." + }, + { + "category": "Reputational", + "name": "Reputation loss due to poor crisis management", + "description": "Mishandling incidents such as downtime or breaches escalate to public backlash" + }, + { + "category": "Reputational", + "name": "Misinformation spreads with social media", + "description": "Missteps or false information on social platforms spreads rapidly, harming the brand" + }, + { + "category": "Reputational", + "name": "Overpromising impacts credibility", + "description": "Making bold claims that go unfulfilled damages trust with customers and investors" + }, + { + "category": "Reputational", + "name": "Customer backlash via lack of AI transparency", + "description": "Using AI in ways not disclosed to users breach trust or data protection regulations, leading to complaints or sanctions" + }, + { + "category": "Strategic", + "name": "Market failure due to misalignment with customer needs", + "description": "Failure to understand or respond to actual market demand leads to product rejection and poor sales performance." + }, + { + "category": "Strategic", + "name": "Inability to pivot", + "description": "Sticking to an ineffective business model despite market feedback results in lost opportunities and startup failure." + }, + { + "category": "Strategic", + "name": "Competitive loss due to market disruption", + "description": "New or existing competitors offering better or cheaper solutions rapidly erodes market share and customer base." + }, + { + "category": "Strategic", + "name": "Operational instability due to parnership", + "description": "Unreliable or misaligned partners may cause delivery delays, service breakdowns, or reputational damage." + }, + { + "category": "Strategic", + "name": "Unfocused expansion dilutes brand", + "description": "Expanding too quickly into unrelated markets dilutes the brand and confuse customers" + }, + { + "category": "Strategic", + "name": "Poor differentiation limits traction", + "description": "Lack of clear value proposition makes it difficult to stand out, leading to weak market traction" + }, + { + "category": "Strategic", + "name": "Founder vision misalignment", + "description": "Differences in long-term vision between founders leads to disjointed strategies and stalled progress" + }, + { + "category": "Technology", + "name": "Development bottlenecks with accumulated technical debt", + "description": "Short-term coding shortcuts limits scalability and requires costly refactoring, delaying future development." + }, + { + "category": "Technology", + "name": "Resource waste with overengineering", + "description": "Overbuilding features with little customer value leads to unnecessary complexity and resource exhaustion." + }, + { + "category": "Technology", + "name": "Technology dependency due to platform lock-In", + "description": "Relying on a third-party platform that changes terms or shuts down disrupts operations and force migration." + }, + { + "category": "Technology", + "name": "Shadow IT introduces security vulnerability", + "description": "Employees using unapproved tools introduces security gaps and compliance risks" + }, + { + "category": "Technology", + "name": "Outdated stack limits performance", + "description": "Failure to update tech stack reduces performance and increase integration challenges" + }, + { + "category": "Technology", + "name": "Poor test coverage led to system failures", + "description": "Inadequate testing before release lead to bugs, crashes, and poor user experience" + }, + { + "category": "Technology", + "name": "Unbalanced training data leads to bias", + "description": "AI systems trained on incomplete or biased datasets produce discriminatory or inaccurate results, risking compliance and fairness" + }, + { + "category": "Technology", + "name": "Overreliance on AI models leads to decision failure", + "description": "Automated systems making critical decisions without human oversight cause strategic or operational errors" + }, + { + "category": "Technology", + "name": "Security exposure due to AI-generated code vulnerabilities", + "description": "AI-generated code that lacks proper validation introduces security flaws or backdoors into production systems" } ]