1 / 49

Save tremendous resources and time with Automated Risk Assessments Risk Reporter Family

ACR 2 Solutions, Inc . Simplifying Information Security Compliance. Save tremendous resources and time with Automated Risk Assessments Risk Reporter Family . May 2009. About ACR 2 Solutions. We are a developer of enterprise level real-time risk management software

lane
Download Presentation

Save tremendous resources and time with Automated Risk Assessments Risk Reporter Family

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. ACR 2 Solutions, Inc. Simplifying Information Security Compliance Save tremendous resources and time with Automated Risk Assessments Risk Reporter Family May 2009

  2. About ACR 2 Solutions • We are a developer of enterprise level real-time risk management software • Simple, elegant, easy to use compliance solutions. • Tools to support regulatory laws and regulations such as: FISMA, GLBA, HIPAA, NAIC, NERC and PCI DSS. • Risk and Compliance solutions for public, private, and government organizations. • Risk and Compliance solutions that lower the total cost of (Information Security) Compliance (TCC).

  3. Risk Reporter Overview • What is Risk Reporter ? • Why do I need it? • How does it work? • Where can I see it or try it? • Where can I get more information?

  4. Risk Reporter Overview • What is Risk Reporter ? • Why do I need it? • How does it work? • Where can I see it or try it? • Where can I get more information?

  5. What is Risk Reporter ? Risk Reporter family of “near real-time” automated risk assessments for companies wanting to implement “best practices” compliance or regulated under: FISMA – Federal Information Security Management Act GLBA – Graham Leach Bliley Act NAIC – National Assoc. of Insurance Commissioners HIPAA – Health Info. Portability and Accountability Act PCI-DSS – Payment Card Ind. - Digital Security Standard All of the above regulations will soon have to support continuous monitoring of risk as required by NIST 800-39

  6. Risk Reporter Overview • What is Risk Reporter ? • Why do I need it? • How does it work? • Where can I see it or try it? • Where can I get more information?

  7. Why AutomateRisk Assessments? Partial display of almost current documents NIST and FIPS Referenced Documents

  8. Definitions of TermsRelationships of terms Gives rise to Threat Agent Threat Exploits Vulnerability Leads to Risk Directly Effects Asset Can Damage Exposure Safeguard And cause an Can be counter-measured by a

  9. Definitions of Terms Technical Terminology UTM’s – Unified Threat Management devices Firewall with Secure Access, IPS, AV, logging and others IPS/IDS – Intrusion Detection/ Intrusion Prevention System These system monitor the attempted or real access of the network SCAP – Security Content Automation Program A Department of Homeland Security initiative to standardize results SCAP validated Vulnerability Scanner Network vulnerability scanners that have passed the test

  10. Risk Reporter Overview • What is Risk Reporter ? • Why do I need it? • How does it work? • Where can I see it or try it? • Where can I get more information?

  11. How does it work? Three types of input to Risk Assessment • Management Data • Policy Data • Technical Controls This is the most difficult to answer – 600+ or more.. SCAP Vulnerability Scanners UTM / IPS / Firewall Syslog Generate the Compliance Reports Use the ‘Gap’ report to prioritize remediation and put safeguards in place

  12. And on and on and on..

  13. Risk Reporter H. R. 2458 (FISMA) § 3544. Federal agency responsibilities (a) …The head of each agency shall... (2) ensure that senior agency officials provide information security ... through— (A) assessing the risk (B) determining the...information security appropriate (C) implementing policies and procedures... (D) periodically testing...security controls

  14. FISMA and NIST Protocols How is a FISMA compliant risk assessment done? FISMA risk assessment procedures are in NIST special publication 800-30. NIST protocols are binding on agencies one year after publication. 800-30 was published in 2002. An update is expected in July of 2008.

  15. What is Risk? “Risk is the net negative impact of the exercise of a vulnerability, considering both the probability and the impact of occurrence” (NIST 800-30, p1).

  16. Vulnerability and Risk Vulnerability assessment is a part of Risk Assessment. Probability and impact must also be considered. Vulnerability assessment alone cannot meet the FISMA requirements for Risk Assessment.

  17. Vulnerability Scanning "Organizations should keep in mind that a CVSS score only assesses the relative severity of a vulnerability when compared to other vulnerabilities, and does not take into account any security controls that might mitigate exploitation attempts…” (NISTIR 7435, p 22)

  18. Vulnerability vs. Risk The NIST 800-30 definition of probability of risk (page 21) defines probability of risk as follows; High - The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective.

  19. Automated Risk Management Using Risk Reporter. Required Steps For an NIST Risk Assessment Step1System Characterization (Section 3.1) Step 2 Threat Identification (Section 3.2) Step 3 Vulnerability Identification (Section 3.3) Step 4 Control Analysis (Section 3.4) Step 5 Likelihood Determination (Section 3.5) Step 6 Impact Analysis (Section 3.6) Step 7 Risk Determination (Section 3.7) Step 8 Control Recommendations (Section 3.8) Step 9 Results Documentation (Section 3.9) (NIST 800-30, p8)

  20. 3.1 System Characterization Questionnaires, document review and automated scanning tools (800-30, p12). 3.1 Risk Reporter System Characterization SCAP validated scanner Secutor Magnus is available as a bundle w/ Risk Reporter but we support most scanners. Risk Reporter includes an extensive policy questionnaire keyed to ALL of the NIST minimum safeguards.

  21. Risk Reporter Scan

  22. Risk Reporter Questions

  23. 3.2 Threat Identification Natural threats, human threats and environmental threats (800-30, p13). Microsoft’s classification of threats (1999) Natural Disasters Human Error Malicious Insiders and Malicious Outsiders.

  24. Security Threats

  25. 3.3 Vulnerability Sources National Vulnerability Database (NVD), superseded the I-CAT database (800-30, p16). More than 36,000 Vulnerabilities Incorporated into the Risk Reporter SCAP validated scanner. Areas of Vulnerability in management, operations and technical areas all need to be considered (800-30, p18).

  26. 3.3 Vulnerability Sources Vulnerability Sources Arise From: Management Procedure implementation and Internal controls Operational Data acquisition, Data storage, Data retrieval, Data modification and Data transmission

  27. 3.3 Vulnerability Sources Vulnerability Sources also Arise From: Technical System design Environmental Wind, Fire, Flood, Power loss and Vehicle collision

  28. 3.4 Controls Analysis The 800-30 process was dramatically simplified by the 2005 publication of 800-53, “Recommended Security Controls for Federal Systems.”

  29. 3.4 Controls Analysis The frequently updated 800-53 list, in conjunction with the SCAP validated scan engine, is the basis for much of the Automated Risk Management program from the ACR process. Two key elements in control analysis are anti-virus protection and intrusion protection. Both are highly important precautions provided by Fortinet.

  30. 3.5 Likelihood Determination For an 800-30 risk assessment, likelihood has a specific legal meaning: High - The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective. Medium - The threat-source is motivated and capable, but controls are in place that may impede successful exercise of the vulnerability.

  31. 3.5 Likelihood Determination Low - The threat-source lacks motivation or capability, or controls are in place to prevent, or at least significantly impede, the vulnerability from being exercised. Since 2004, cybercrime has exceeded illegal drugs as the #1 criminal enterprise Threat-source capability may be assumed.

  32. 3.5 Likelihood Determination Map Controls to Vulnerabilities List all of the safeguards of NIST 800-53. Map safeguards to the four threat sources (Environmental, Human Error, Malicious Insider and Malicious Outsider) by inspection. Map safeguards to subsections within each threat source.

  33. 3.5 Likelihood Determination Although 800-30 allows the option of higher levels of granularity, Risk Reporter has kept the recommended settings of Low, Medium and High. NIST 800-39 is the “flagship document” of the NIST 800 series of FISMA compliance guidance documents. Page 1 notes that “Managing risk is not an exact science.”

  34. 3.6 Impact Analysis Impact levels under 800-30 have very specific definitions. High - Exercise of the vulnerability (1) may result in the highly costly loss of major tangible assets or resources; (2) may significantly violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human death or serious injury.

  35. 3.6 Impact Analysis Medium - Exercise of the vulnerability (1) may result in the costly loss of tangible assets or resources; (2) may violate, harm, or impede an organization’s mission, reputation, or interest; or (3) may result in human injury. Low - Exercise of the vulnerability (1) may result in the loss of some tangible assets or resources or (2) may noticeably affect an organization’s mission, reputation, or interest.

  36. 3.6 Impact Analysis Example The calculation of impact levels also maps to 800-53 safeguards in a fairly obvious fashion. For example, a system that does not meet the requirements of safeguard CP-9 (Information System Backup) will be much more impacted by Fire than a system which is compliant with CP-9 and has a well written contingency plan (CP-2) that includes training (CP-3) and testing (CP-4).

  37. 3.7 Risk Determination The calculation algorithm for the risk assessment is given on page 25 of 800-30. Low, Medium, and High likelihoods of adverse events are scored at 0.1, 0.5 or 1.0, respectively. In the same manner, Low, Medium, and High impacts are scored at 10, 50 and 100 respectively. By multiplying the likelihood score and the impact score, a risk score from 1 (low) to 100 (high) is calculated.

  38. 3.8 Control Recommendations The Risk Reporter Gap Analysis report gives a mapping of the featured safeguards which are missing, against the identified risks in order of impact. This report may be used to prioritize changes in safeguards.

  39. 3.8 Control Recommendations

  40. 3.9 Results Documentation Upon completion of the Automated Risk Management program from the Risk Reporter risk assessment, the initial set of data will produce two reports, a “Baseline Report” showing the risk scores ordered by threat source and a “Risk Assessment Chart.” Samples are shown on the next slide

  41. Reports

  42. Reports

  43. Reports

  44. Gap Report

  45. FISMA Compliance Report

  46. Enterprise

  47. Risk Reporter • What is it? • Why do my customers want it? • How does it work? • Where can I see it? • Who has more information?

  48. How can I try it ? Free Demo Kits with licenses Government Technology Solutions 800-326-5683 info@gvTechSolutions.com

  49. Thanks for your attendance One DC agency just did one of these assessments manually. They want this automation software!

More Related