Week 2 Intro to Risk Management - Part 2

Three control strategies

Prevent, detect, mitigate (they can be combined)

Control type of staff vetting (per slide)

Procedural, NOT Personnel

Control type of MFA (insider hacking example)

Technical

Control type of password strength rules

Technical and Procedural

Control type of auditing

Procedural

Can one control be two types at once?

Yes, e.g. password strength is technical and procedural

How too many power controls backfire

In a fire, firefighters wait for all power to be off, and batteries may not be stoppable

Lesson from the battery example

Controls can introduce new risks

Risk appetite

Quantity and nature of risk the organisation will accept, trading perfect security against unlimited accessibility

Risk tolerance (risk threshold)

Amount of risk accepted for a particular information asset

Residual risk

Risk that remains after current controls are applied

Appetite vs tolerance

Appetite = whole organisation; tolerance = one specific asset

CISO sets max acceptable risk for the payments database: appetite or tolerance?

Tolerance (specific asset)

Goal of information security

Bring residual risk into line with risk appetite (not zero risk)

SLE

Single Loss Expectancy = AV × EF (loss from one incident)

ALE

Annualised Loss Expectancy = SLE × ARO (expected loss per year)

CBA formula

ALE(prior) − ALE(post) − ACS

AV

Asset Value: development, acquisition, training, implementation, service, maintenance costs

EF

Exposure Factor: fraction of asset value lost in one incident

ARO

Annualised Rate of Occurrence: incidents per year

ACS

Annual Cost of Safeguard

What a negative CBA means

Control costs more than it saves: don't implement (tolerate or transfer)

ARO for once a week

52

ARO for once a month

12

ARO for twice a quarter

8

ARO for once a quarter

4

ARO for once every 5 years

0.2

ARO for once every 10 years

0.1

How to choose controls with a fixed budget

Maximise TOTAL CBA within budget, not the single biggest CBA

Common ALE distractor

The SLE offered as the ALE: do SLE first, then multiply by ARO

Three steps of risk assessment

Identification → analysis → evaluation

Is risk treatment part of risk assessment?

NO: assessment = identification, analysis, evaluation; treatment comes after

Doctor analogy for assessment vs treatment

Assessment = diagnosis; treatment = the cure

Risk identification

Finding, recognising and describing risks (trigger words: find, list, describe)

Risk analysis

Understanding the nature of the risk and determining its LEVEL (trigger: likelihood + impact)

Risk evaluation

COMPARING analysis results with risk CRITERIA and deciding controls

Risk treatment

Modifying risk (trigger words: reduce, control, modify)

Team compares calculated risk levels against criteria: which step?

Risk evaluation

Analyst combines likelihood and impact to get "High": which step?

Risk analysis

Workshop lists every way the portal could be compromised: which step?

Risk identification

Company installs MFA to reduce account takeover: which step?

Risk treatment

First stage of the risk management process

Context establishment

Risk process decision point 1

Assessment satisfactory? No → back to context; Yes → risk treatment

Risk process decision point 2

Risk accepted? No → iterate; Yes → document

Activities running alongside the whole risk process

Communication and consultation; monitoring and review

Risk management framework

The planning and design of the ENTIRETY of risk management efforts

Risk management process

Implementing risk management as the framework specifies

Centre of the risk management framework

Executive governance and support

Framework cycle

Design → implementation → monitoring and review → continuous improvement

STRIDE as a method

Structured, iterative threat modelling; output = system's vulnerabilities and how they could be exploited

Rule for STRIDE mitigations

Each mitigation protects the property that was violated

Spoofing mitigation

Strong authentication (MFA), strong frameworks and libraries (violates authentication)

Tampering mitigation

Encryption and hashing (violates integrity)

Repudiation mitigation

Logging and strong authentication (violates non-repudiation)

Information disclosure mitigation

Encryption and access control (violates confidentiality)

Denial of service mitigation

Site/product SCALABILITY (violates availability)

Elevation of privilege mitigation

Authorisation (violates authorisation)

Game servers crash under fake join requests: STRIDE mitigation?

Scalability

User edits config to grant themselves admin: STRIDE mitigation?

Authorisation

Asset-based identification

Starts from the Asset → threats → vulnerabilities; specific → general; OPERATIONAL scenarios

Event-based identification

Starts from the Enemy (risk source + objective); general → specific; STRATEGIC scenarios

"Start from HR database, list its threats": which method?

Asset-based

"Competitor wants a monopoly, plan back to attacks": which method?

Event-based

Event-based example: organised crime

Illegal activities → exploit port infrastructure → infiltrate dockers' union

Event-based example: aggressive business

Monopoly → influence regulator or remove competition → bribery, lobbying, defamation campaign

MCQ technique: option is a different type of thing

Eliminate it first (e.g. a scoring method offered for an identification question)

Two parts of business impact

Replacement value (cost to recover/replace) and business consequences (business/legal effects, opportunity cost)

Impact level 1

Minor: negligible

Impact level 2

Significant: but limited

Impact level 3

Serious: substantial

Impact level 4

Critical: disastrous

Impact level 5

Catastrophic: beyond the organisation

Likelihood

Numerical value on a defined scale of the probability a vulnerability is exploited

Risk event

A change in circumstance caused by a risk source

Likelihood of threat occurrence

Does the attack ARRIVE at all? (is the phishing email sent to us?)

Ease of exploit

How EASY is the vulnerability to use? (how easily do staff fall for it?)

Likelihood of incident scenario

Does it LEAD TO an actual incident? (does it cause stolen credentials?)

Trigger words for incident scenario

"Leads to" or "results in"

"Will ransomware gangs target us at all this year?" measures

Likelihood of threat occurrence

"How easily can attackers use public tools on our unpatched VPN?" measures

Ease of exploit

Phishing example: threat, vulnerability, source

Threat: phishing email; vulnerability: lack of SETA training; source: cyber-hacker

SETA

Security Education, Training and Awareness

Risk Method E.2

Likelihood of incident scenario (0–4) + business impact (0–4) = 0–8

Risk Method E.1

Threat occurrence (0–2) + ease of exploit (0–2) + asset value (0–4) = 0–8

Do E.1 and E.2 add or multiply?

ADD

E.1 with threat occurrence 2, ease 1, asset value 3

6 out of 8

Component-driven risk management (CyBOK)

Bottom-up: individual components and their threats/vulnerabilities

System-driven risk management (CyBOK)

Top-down: whole system, its goals and how parts interact

When component-driven fits

Simple systems with well-understood connections; single parts

When system-driven fits

Complex interactions, emergent breaches, NO single point of failure, requirements before design

Who cares about component vs system risk

Component: operational staff; system: senior managers

Game analogy: component vs system

One bugged script = component; dupe glitch from trading + DataStore lag + server hop = system

Stakeholders agree what a smart grid must never do before design: which approach?

System-driven

CyBOK four elements of risk

Vulnerability, threat, likelihood, impact

CyBOK definition of threat

An individual, event or action able to exploit a vulnerability

NIST SP800-30 cycle

Prepare, conduct, communicate, maintain

ISO/IEC 27005 phases

Context, assessment (identify, estimate, evaluate), treatment, acceptance, communication, monitoring

NIST vs ISO 27005

NIST puts threats before vulnerabilities and is prescriptive; ISO is less prescriptive

Method strengths: ISO 27005, NIST, FAIR

ISO socio-technical; NIST technology-driven; FAIR economic impact

Method strengths: STRIDE, attack trees, Octave Allegro

STRIDE threat-driven; attack trees attack-driven (root = attacker goal); Octave qualitative workshops