Phase 1: Risk Identification & Assessment
1. Define the Enterprise
Zalo is a large-scale social networking and messaging platform developed by VNG Corporation.
It provides communication services such as text, voice, video calls, and mobile payment through
ZaloPay. The platform includes:
- Mobile App (iOS, Android)
- Web App (chat.zalo.me)
- Backend Services: Messaging Engine, Media, Payment, API Gateway
- Databases: SQL (user info), NoSQL (messages), Object Storage (media)
- Big Data & AI: Spam detection, recommendations, analytics
Zalo, part of VNG Corporation, aims to:
Ensuring information security and user privacy in accordance with Vietnamese law
(Law on Cybersecurity, Decree 13/2023/ND-CP on personal data protection).
Maintain the availability and stability of uninterrupted messaging, voice calling, and
payment services, serving tens of millions of users.
Protect brand assets and business reputation, avoid cybersecurity incidents that affect
user trust.
Comply with international standards in data security and payment (ISO/IEC 27001,
PCI DSS).
Optimize user experience by applying AI and Big Data while still ensuring information
security.
2. Identify Critical Assets
Asset Description Importance
User Database Stores user profiles, contacts, High
and authentication data
Messaging System Core chat, call, and High
communication features
Payment System (ZaloPay) Manages e-wallet and High
financial transactions
Application Servers Handle all client and backend High
processes
Cloud Storage Keeps backups, media, and Medium
logs
Admin Tools Used by internal staff for Medium
moderation and maintenance
Asset Relationship Diagram
3. Identify Threats
Threat Description
Account Hijacking / Phishing Attackers steal login tokens, OTPs, or session
IDs
DDoS Attacks Overload messaging servers, disrupting user
communication
Malware / Ransomware Encrypt or destroy user or system data
Insider Threat Employees leak or misuse sensitive
information
Payment Fraud Fake or unauthorized ZaloPay transactions
Spam / Bot Abuse Automated spam messages and scams
4. Identify Vulnerabilities
- Weak password protection and missing 2FA
- Outdated system patches and unpatched software
- API endpoints misconfiguration
- Incomplete spam filtering mechanisms
- Poor access control and monitoring of admin activities
- Unsecured or unencrypted backups
- Weak session management or QR login vulnerability on the web version, which
may allow attackers to hijack sessions or reuse authentication tokens.
- Mobile app permission misuse, where excessive access to contacts, microphone,
or storage could lead to privacy leakage.
5. Qualitative Risk Assessment
Likelihood Impact (1– Asset Value Risk Value
Asset Threat Risk Level
(1–5) 5) (1–5) (L×I×A)
Data
User
Breach / 5 5 5 125 Critical
Database
Leak
Messaging
DDoS Attack 4 4 5 80 High
System
Payment
ZaloPay 3 5 5 75 High
Fraud
Insider
Admin Tools 3 4 3 36 Medium
Threat
Cloud Ransomwar
2 4 3 24 Medium
Storage e
Likelihood Impact (1– Asset Value Risk Value
Asset Threat Risk Level
(1–5) 5) (1–5) (L×I×A)
Misconfigur
API Gateway 3 3 3 27 Medium
ation Exploit
6. Summary
- Key Risks: Data leakage, DDoS disruption, and payment fraud.
- Most Critical Assets: User database and ZaloPay transaction systems.
- Next Step (Phase 2): Develop security policies and controls to mitigate risks, followed by cost-
benefit analysis for each mitigation strategy.
