1 / 70

Risk Management - Security

Risk Management - Security. Lecture 3 SD3043. Outline. Define risk management and its role in the organization Risk management techniques to identify and prioritize risk factors for information assets

lucian
Download Presentation

Risk Management - Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Risk Management - Security Lecture 3 SD3043 Management of Information Security, Whitman & Mattord

  2. Outline Define risk management and its role in the organization Risk management techniques to identify and prioritize risk factors for information assets Assess risk based on the likelihood of adverse events and the effects on information assets when events occur Document the results of risk identification Risk mitigation strategy options to control risk Risk control classification categories OCTAVE approach to managing risk Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 2

  3. Introduction Managing risk is one of the key responsibilities of every manager within the organization In any well-developed risk management program, two formal processes are at work: Risk identification and assessment Risk control Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 3

  4. Figure 7-1Risk Identification Process Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 4

  5. Risk Identification Risk identification begins with the process of self-examination Managers identify the organization’s information assets, classify them into useful groups, and prioritize them by their overall importance Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 5

  6. Creating an Inventory of Information Assets Identify information assets, including people, procedures, data and information, software, hardware, and networking elements This step should be done without pre-judging the value of each asset; values will be assigned later in the process Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 6

  7. Table 7-1Organizational Assets Used in Systems Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 7

  8. Classifying and Categorizing Assets Once the initial inventory is assembled, determine whether its asset categories are meaningful Inventory should also reflect sensitivity and security priority assigned to each information asset A classification scheme categorizes these information assets based on their sensitivity and security needs Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 8

  9. Classifying and Categorizing Assets (continued) Management of Information Security, Whitman & Mattord Each of these categories designates the level of protection needed for a particular information asset Some asset types, such as personnel, may require an alternative classification scheme that would identify the clearance needed to use the asset type Classification categories must be comprehensive and mutually exclusive Management of Information Security, 2nd ed. - Chapter 7 Slide 9

  10. Assessing Values for Information Assets As each information asset is identified, categorized, and classified, assign a relative value Relative values are comparative judgments made to ensure that the most valuable information assets are given the highest priority, for example: Which information asset is the most critical to the success of the organization? Which information asset generates the most revenue? Which information asset generates the highest profitability? Which information asset is the most expensive to replace? Which information asset is the most expensive to protect? Which information asset’s loss or compromise would be the most embarrassing or cause the greatest liability? Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 10

  11. Figure 7-2Sample Asset Classification Worksheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 11

  12. Listing Assets in Order of Importance The final step in the risk identification process is to list the assets in order of importance This goal can be achieved by using a weighted factor analysis worksheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 12

  13. Table 7-2Weighted Factor Analysis Worksheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 13

  14. Data Classification Model Data owners must classify the information assets for which they are responsible and review the classifications periodically Example Public For official use only Sensitive Classified Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 14

  15. Data Classification Model (continued) Management of Information Security, Whitman & Mattord • The U.S. military classification scheme relies on a more complex five-level classification scheme as defined in Executive Order 12958 • Unclassified data • Sensitive but unclassified (SBU) data • Confidential data • Secret data • Top Secret data Management of Information Security, 2nd ed. - Chapter 7 Slide 15

  16. Security Clearances In a security clearance structure, each user of an information asset is assigned an authorization level that indicates the level of information classification they may access Most organizations have developed roles and corresponding security clearances, so individuals are assigned into groups that correlate with the classifications of the information assets they need for their work In the need-to-know principle, regardless of one’s security clearance, an individual is not allowed to view data simply because it falls within that individual’s level of clearance Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 16

  17. Management ofClassified Information Assets Managing an information asset includes considering the storage, distribution, portability, and destruction of that information asset An information asset that has a classification designation other than unclassified or public must be clearly marked as such and must be available only to authorized individuals To maintain the confidentiality of classified documents, managers can implement a clean desk policy When copies of classified information are no longer valuable or too many copies exist, care should be taken to destroy them properly to discourage dumpster diving Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 17

  18. Threat Identification Any organization typically faces a wide variety of threats If you assume that every threat can and will attack every information asset, then the project scope becomes too complex To make the process less unwieldy, each step in the threat identification and vulnerability identification process is managed separately and then coordinated at the end Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 18

  19. Identify and Prioritize Threats and Threat Agents Each threat presents a unique challenge to information security and must be handled with specific controls that directly address the particular threat and the threat agent’s attack strategy Before threats can be assessed in the risk identification process, however, each threat must be further examined to determine its potential to affect the targeted information asset In general, this process is referred to as a threat assessment Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 19

  20. Table 7-3Threats to Information Security Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 20

  21. Vulnerability Assessment Once you have identified the information assets of the organization and documented some threat assessment criteria, you can begin to review every information asset for each threat This review leads to the creation of a list of vulnerabilities that remain potential risks to the organization Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset At the end of the risk identification process, a list of assets and their vulnerabilities has been developed This list serves as the starting point for the next step in the risk management process: risk assessment Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 21

  22. The TVA Worksheet At the end of the risk identification process, a list of assets and their vulnerabilities has been developed Another list prioritizes threats facing the organization based on the weighted table discussed earlier These lists can be combined into a single worksheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 22

  23. Table 7-5Sample TVA Spreadsheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 23

  24. Risk Identification Estimate Factors Risk is The likelihood of the occurrence of a vulnerability Multiplied by The value of the information asset Minus The percentage of risk mitigated by current controls Plus The uncertainty of current knowledge of the vulnerability Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 24

  25. Likelihood Likelihood is the overall rating—often a numerical value on a defined scale (such as 0.1 – 1.0)—of the probability that a specific vulnerability will be exploited Using the information documented during the risk identification process, you can assign weighted scores based on the value of each information asset, i.e. 1-100, low-med-high, etc. Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 25

  26. Assessing Potential Loss To be effective, the likelihood values must be assigned by asking: Which threats present a danger to this organization’s assets in the given environment? Which threats represent the most danger to the organization’s information? How much would it cost to recover from a successful attack? Which threats would require the greatest expenditure to prevent? Which of the aforementioned questions is the most important to the protection of information from threats within this organization? Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 26

  27. Percentage of Risk Mitigated by Current Controls If a vulnerability is fully managed by an existing control, it can be set aside If it is partially controlled, estimate what percentage of the vulnerability has been controlled Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 27

  28. Uncertainty It is not possible to know everything about every vulnerability The degree to which a current control can reduce risk is also subject to estimation error Uncertainty is an estimate made by the manager using judgment and experience Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 28

  29. Risk Determination Example Asset A has a value of 50 and one vulnerability, which has a likelihood of 1.0 with no current controls. Your assumptions and data are 90% accurate. Asset B has a value of 100 and has two vulnerabilities: vulnerability #2 has a likelihood of 0.5 with a current control that addresses 50% of its risk; vulnerability # 3 has a likelihood of 0.1 with no current controls. Your assumptions and data are 80% accurate. Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 29

  30. Risk Determination Example (continued) Management of Information Security, Whitman & Mattord • The resulting ranked list of risk ratings for the three vulnerabilities is as follows: • Asset A: Vulnerability 1 rated as 55 = (50 × 1.0) – 0% + 10% • Asset B: Vulnerability 2 rated as 35 = (100 × 0.5) – 50% + 20% • Asset B: Vulnerability 3 rated as 12 = (100 × 0.1) – 0 % + 20% Management of Information Security, 2nd ed. - Chapter 7 Slide 30

  31. Identify Possible Controls For each threat and its associated vulnerabilities that have residual risk, create a preliminary list of control ideas Three general categories of controls exist: Policies Programs Technical controls Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 31

  32. Access Controls Access controls specifically address admission of a user into a trusted area of the organization These areas can include information systems, physically restricted areas such as computer rooms, and even the organization in its entirety Access controls usually consist of a combination of policies, programs, and technologies Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 32

  33. Documenting the Results of Risk Assessment The goal of the risk management process so far has been to identify information assets and their vulnerabilities and to rank them according to the need for protection In preparing this list, a wealth of factual information about the assets and the threats they face is collected Also, information about the controls that are already in place is collected The final summarized document is the ranked vulnerability risk worksheet Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 33

  34. Table 7-7Risk Identification and Assessment Deliverables Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 7 Slide 34

  35. Risk Control Strategies An organization must choose one of four basic strategies to control risks Avoidance: applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability Transference: shifting the risk to other areas or to outside entities Mitigation: reducing the impact should the vulnerability be exploited Acceptance: understanding the consequences and accepting the risk without control or mitigation Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 35

  36. Avoidance Avoidance is the risk control strategy that attempts to prevent the exploitation of the vulnerability Avoidance is accomplished through: Application of policy Application of training and education Countering threats Implementation of technical security controls and safeguards Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 36

  37. Transference Transference is the control approach that attempts to shift the risk to other assets, other processes, or other organizations This may be accomplished by rethinking how services are offered, revising deployment models, outsourcing to other organizations, purchasing insurance, or by implementing service contracts with providers Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 37

  38. Mitigation Mitigation is the control approach that attempts to reduce, by means of planning and preparation, the damage caused by the exploitation of vulnerability This approach includes three types of plans: Disaster recovery plan (DRP) Incident response plan (IRP) Business continuity plan (BCP) Mitigation depends upon the ability to detect and respond to an attack as quickly as possible Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 38

  39. Acceptance The choice to do nothing to protect an information asset and to accept the loss when it occurs This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 39

  40. Acceptance (continued) Management of Information Security, Whitman & Mattord • The only valid use of the acceptance strategy occurs when the organization has: • Determined the level of risk to the information asset • Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability • Approximated the ARO (annualized rate of occurrence) of the exploit • Estimated the potential loss from attacks • Performed a thorough cost benefit analysis • Evaluated controls using each appropriate type of feasibility • Decided that the particular asset did not justify the cost of protection Management of Information Security, 2nd ed. - Chapter 8 Slide 40

  41. Managing Risk Risk appetite (also known as risk tolerance) defines the quantity and nature of risk that organizations are willing to accept, as they evaluate the trade-offs between perfect security and unlimited accessibility The reasoned approach to risk is one that balances the expense (in terms of finance and the usability of information assets) against the possible losses if exploited Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 41

  42. Managing Risk (continued) When vulnerabilities have been controlled as much as possible, there is often remaining risk that has not been completely removed, shifted, or planned for; in other words, residual risk “Residual Risk is a combined function of (1) a threat less the effect of threat-reducing safeguards; (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.” Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 42

  43. Managing Risk (continued) The goal of information security is not to bring residual risk to zero, but to bring it in line with an organization’s risk tolerance If decision makers have been informed of uncontrolled risks and the proper authority groups within the communities of interest decide to leave residual risk in place, then the information security program has accomplished its primary goal Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 43

  44. Evaluation, Assessment, and Maintenance of Risk Controls Once a control strategy has been selected and implemented, the effectiveness of controls should be monitored and measured on an ongoing basis to determine its effectiveness and the accuracy of the estimate of the risk that will remain after all planned controls are in place Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 44

  45. Risk Control Strategy Selection Risk control involves selecting one of the four risk control strategies for the vulnerabilities present within the organization If the loss is within the range of losses the organization can absorb, or if the attacker’s gain is less than expected costs of the attack, the organization may choose to accept the risk Otherwise, one of the other control strategies will have to be selected Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 45

  46. Risk Control Strategy Selection Some rules of thumb: When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exercised When a vulnerability can be exploited: Apply layered controls to minimize the risk or prevent occurrence When the attacker’s potential gain is greater than the costs of attack: Apply protections to increase the attacker’s cost, or reduce the attacker’s gain, using technical or managerial controls When potential loss is substantial: Apply design controls to limit the extent of the attack, thereby reducing the potential for loss Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 46

  47. Feasibility Studies and Cost Benefit Analysis Before deciding on the strategy for a specific vulnerability, all readily accessible information about the consequences of the vulnerability must be explored “What are the advantages of implementing a control as opposed to the disadvantages of implementing the control?” There are a number of ways to determine the advantage or disadvantage of a specific control The primary means are based on the value of the information assets that it is designed to protect Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 47

  48. Cost Benefit Analysis (CBA) The criterion most commonly used when evaluating a project that implements information security controls and safeguards is economic feasibility Organizations are urged to begin a cost benefit analysis by evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised This decision-making process is called a cost benefit analysis or an economic feasibility study Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 48

  49. Cost Just as it is difficult to determine the value of information, it is difficult to determine the cost of safeguarding it Some of the items that affect the cost of a control or safeguard include: Cost of development or acquisition of hardware, software, and services Training fees Cost of implementation Service costs Cost of maintenance Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 49

  50. Benefit Benefit is the value to the organization of using controls to prevent losses associated with a specific vulnerability The benefit is usually determined by valuing the information asset or assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset This is expressed as the annualized loss expectancy (ALE) Management of Information Security, Whitman & Mattord Management of Information Security, 2nd ed. - Chapter 8 Slide 50

More Related