Rapport

FFI-RAPPORT 16/00707

piqlFilms is, in other words, a casualty of war. As all the piqlFilms are annihilated in the

explosion, the integrity and availability of the information is forever lost, whereas the

confidentiality remains intact. See appendix B.12 for full details.

9 The Vulnerabilities and Security Challenges of the

Piql Preservation Services

In this chapter we provide an overview of the vulnerabilities and security challenges to the Piql

Preservation Services which were identified in the scenario descriptions. Additionally, some

vulnerabilities and security challenges which were not a direct result of the scenario analysis are

presented. As stressed in chapter 6, where the method for scenario selection was developed and

the final selection was chosen, there are many possible scenario descriptions which would fit

into a scenario class applicable to the Piql Preservation Services. We had to make a selection

which would not describe all the vulnerabilities and security challenges. Some that we had to

leave out have been described in other documents FFI have had access to. We therefore include

them here as well, in order for this document to serve as a (as near as possible) complete and

exhaustive list of the vulnerabilities and security challenges faced by the Piql Preservation

Services.

Before the risks faced by the Piql Preservation Services are described, however, it must be

stressed that the assessments made here are purely theoretical. They are based on the

information we have received from Piql AS and other members of the PreservIA Consortium

and evaluations of our own. The results have not yet been practically tested: we leave this up to

other participants in the PreservIA project.

It should also be noted that the severity of the vulnerabilities of the Piql Preservation Services,

and the consequences thereof, varies between and within different market areas. Especially with

regards to threats related to intentional acts, the piqlFilms face a different level of risk

depending on the varying degrees of sensitive information stored on them. Broadly speaking,

the higher the sensitivity of the information, the higher the potential value and return for a threat

actor, and thus the higher the commitment for said threat actor to somehow access or damage

the information stored on the Piql Preservation Services, if that is their goal. Having the right

security and safety measures in place thus becomes vital for the data owner, and their

sophistication must be higher than if the piqlFilms stored less valuable information. It is

important to address potential points of vulnerability in the Piql Preservation Services, as these

piqlFilms will potentially be subjected to more attempts to compromise CIA – confidentiality,

integrity and availability – than others. Additionally, the severity of the loss of information due

to unintentional events increases the more sensitive the information stored on the piqlFilms is.

Lacking protective measures would thus have far greater consequences where highly sensitive