Risk 1

1. Risk 1 CST 481/598 Many thanks to Jeni Li

2. Risk • Potential negative impact to an asset • Probability of a loss • A function of three variables • The probability of a threat • The probability of a vulnerability • The potential impact • A measurable quantity

3. Types of Risk • Technical • Information Security • Business • Where measured • How Measured • Who cares – stakeholdersregulatory requirements, corporate governance • CIA – Confidentiality, Integrity, Availability

4. Asset • "An asset is a resource controlled by the enterprise as a result of past events and from which future economic benefits are expected to flow to the enterprise.” • IOW, the stuff that has value to your company and its ability to conduct its business operations

5. Asset (examples) • Information • Customer records • Sales leads • Intellectual property • Business transaction records • Systems • Workstations, servers, network infrastructure • People • Staff, clientele • Products (may be outside our scope)

6. Impact • The magnitude of a potential loss • The seriousness of an event

7. Vulnerability • A weakness that provides the opportunity for a threat to occur • Examples • Operating system vulnerabilities • Exploitable Web applications • Staff members susceptible to social engineering • Server room located directly below the bathrooms?

8. Threat • A possible danger that might exploit a vulnerability • Anything that could cause harm to your assets • May be accidental or intentional

9. Types of threats • Accidental • Natural disasters • Earthquake, fire, flood, lightning • True accidents • Unintentional misuse or damage by employees • Other unintended threats • Power grid outage

10. Types of threats • Intentional (aka, malicious) • Caused by a threat agent • Examples • Corporate espionage • Terrorist attack • Hacktivism

11. Threat agent • An individual or group that will implement the threat. Needs the following factors: • Motivation • Why does the attacker want to attack? • Capability • Skills and resources • Opportunity • Physical or electronic access to the target • Catalyst • Something that causes the attacker to act

12. Types of threat agents • Nation state sponsored • Terrorist • Pressure (activist) group • Commercial organization • Criminal group • Hacker group • Disgruntled insider

13. Threat vector • The path or tool used by a threat agent • Examples • Spam, instant messaging, a specific worm • Sniffer, keystroke logger, dumpster diving • Pipe bomb, truck bomb

14. Threat inhibitors • Factors that influence the threat agent not to carry out the attack against the target

15. Threat amplifiers • Factors that encourage the threat agent to carry out the attack against the target

16. Controls • Measures taken to eliminate or mitigate risk • Examples • Physical security (e.g., locks, barriers) • Personnel security (e.g., background checks, training) • Procedural security (e.g., policies/other documents) • Technical security (hardware, software) • Must be cost-effective • Sometimes the best control is no control at all

17. The general process • Identification • Assessment • Treatment plan • Development • Implementation • Review/evaluation

18. Identification • Assets • Vulnerabilities • Threats • Threat vectors • Threat agents

19. Assessment • Estimate or measure the risk • Can be qualitative or quantitative • Qualitative is good for comparing risks • Quantitative is good for determining ROI

20. (probability of event) x (impact of event) = risk

21. Australian standard technical risk assessment • EC: Adequacy of Existing Controls 1 (excellent) to 7 (none) • L: Likelihood of the Risk Occurring 1 (may never occur) to 5 (is expected to occur) • I: Impact/Consequence 1 (minimal to no impact) to 5 (total destruction) Risk = (7*EC + 3*L + 4*I)/84

22. Cost Effectiveness Analysis • Asset value (AV) • Exposure factor (EF) • Single loss expectancy (SLE) • Annualized rate of occurrence (ARO) • Annualized loss expectancy (ALE)

23. Estimate • Asset value: What’s it worth to you? • Tangible and intangible • If we lost this asset, we would lose $... • Exposure factor: How bad would it be? • Percentage of asset loss caused by a threat • 0 to 100% • Annualized rate of occurrence • How many times per year could it happen? • Once in 5 years = 1/5

24. Calculate • Single loss expectancy • SLE = AV x EF • Annualized loss expectancy • ALE = ARO x SLE

25. Compare • ALE before safeguard/control • ALE after safeguard/control • Cost to deploy safeguard/control • ALEb – ALEa – Cost = Value of safeguard • Careful how you define those costs!

26. Risk treatment plan • How will you handle each risk? • Avoidance (get out of the business) • Mitigation (apply a safeguard/control) • Retention (live with it) • Transfer (buy insurance)

27. Other approaches exist • Multi-Attribute Risk Assessment, • Security Attribute Evaluation Method • Monte Carlo analysis • CCTA Risk Analysis/Management Method (CRAMM) • Enterprise risk management • … and so on

28. What’s important about each asset? • Confidentiality • Integrity • Availability • Non-repudiability

29. Infosec Assessment Method(ology) • Uses the CIA model • Identify information assets • Build an information criticality matrix • Identify systems • Build a systems criticality matrix • Determine most critical systems • Identify safeguards/controls