Week 1 Intro to Risk Management - Part 1

Risk management pipeline (4 stages, in order)

Scope → Business Impact Analysis (BIA) → Threats & Vulnerabilities (T&V) → Countermeasures

Why the pipeline order matters

Each stage needs the previous one: you can't assess impact of unscoped assets or pick controls for unassessed risks

Question the Scope stage answers

What assets are in play / what are we protecting?

Question the BIA stage answers

What would the disruption cost the organisation?

Question the T&V stage answers

What can go wrong, through what weakness, and how bad is the risk?

Question the Countermeasures stage answers

What do we do about each risk, with what control, owned by whom?

Security scopes (4)

Technical, Physical, Personnel, Business

Technical scope

All IT and operational technology resources: hardware, software, network

Physical scope

Tangible physical items: buildings, machinery, equipment, physical locations

Personnel scope

People together with their knowledge, skills, experience and capabilities

Business scope

Information, intangibles (e.g. intellectual property, reputation) and processes

Alternative name for Business scope on some slides

IPR (Intellectual Property Rights)

Scope of: a company's brand reputation

Business

Scope of: the office building and server room

Physical

Scope of: the lead developer's undocumented knowledge of the codebase

Personnel

Scope of: the company's routers and cloud servers

Technical

Scope of: the company's order-fulfilment process

Business

Two alternatives to security scopes

IS components (6) and Asset physical types (3)

IS components (6)

Software, Hardware, Data, People, Procedures, Networks

IS component examples: Software

Browser, messaging (email, WhatsApp), operating system, OneDrive

IS component examples: Hardware

Laptop, printer, CD-ROMs, external HDDs, memory sticks

IS component examples: Data

Personal information, credit card details, banking details, backups

IS component examples: People

Human Resources, IT personnel, system administrators

IS component examples: Procedures

Backup, fire and safety, equipment replacement, reimbursement procedures

IS component examples: Networks

Router, ethernet, WiFi (802.11)

IS component of: a backup procedure

Procedures (procedures are assets too)

Asset physical types (3)

Real, Information, Intangible

Real assets

Money, buildings, hardware, people

Information assets

Client/staff details, payroll, designs

Intangible assets

Brand, reputation, plans, software

Asset type of software (per lecture)

Intangible (NOT Real)

Asset type of payroll records

Information

Asset type of company cash reserves

Real

BIA stands for

Business Impact Analysis

Purpose of BIA

Looks at the disruptive impact to the organisation; an important part of business continuity planning

BIA impact directions (5)

Money, Reputation, Legislation & regulation, Safety, Privacy (Many Rich Lawyers Sue People)

RTO

Recovery Time Objective: how quickly a function must be restored

RPO

Recovery Point Objective: how much data loss (time-based) is acceptable

RTO vs RPO memory trick

RTO = time forward until service is back; RPO = time back to the last good copy of data

"Must lose no more than 15 minutes of transactions" (RTO or RPO?)

RPO

"Website must be back online within 4 hours" (RTO or RPO?)

RTO

Game autosaves every 5 minutes, so players lose at most 5 minutes (RTO or RPO?)

RPO

CIA triad

Confidentiality, Integrity, Availability (characteristics of information)

Confidentiality

Preventing disclosure or exposure to unauthorised individuals or systems: who has the need and right to see the information

Integrity

Being whole, complete and uncorrupted; up to date within acceptable limits

Availability

Unobstructed access to information for authorised people, when it's needed

Lecturer's integrity example

Investment broker vs someone who buys shares infrequently: acceptable limits differ by business need

Lecturer's availability example

Oxygen-providing device in intensive care units

Why integrity is business-relative

"Acceptable limits" for data freshness/accuracy depend on what the business needs

Three alternatives to CIA

Parkerian Hexad, D3M, STRIDE

Parkerian Hexad

CIA + Possession, Authenticity, Utility

Aim of the Parkerian Hexad

Expand CIA to cover new attacks: lost data control, unverified identity, unusable files

Possession

Having physical or legal control over the data or device

Possession example

Encrypted USB drive is stolen: confidentiality intact, possession lost

Authenticity

Data is real, genuine and comes from a true source

Authenticity example

Deepfake CFO video-call scam (Hong Kong)

Utility

Data is useful and functional for its intended purpose

Utility example

Data encrypted on a USB but you lost the keys (Swiss Post voting issue)

Encrypted USB stolen vs encryption keys lost

Stolen = Possession lost; keys lost = Utility lost

D3M

Denial, Disclosure, Destruction, Modify: threat-focused variant of the DAD triad

DAD triad

Disclosure, Alteration, Denial (the attacks that break C, I, A)

D3M Denial

Blocking access to information; breaks Availability; levels: inconvenient, serious, disastrous

D3M Disclosure

Information is revealed; breaks Confidentiality; categories: insiders, outsiders, contract-workers

D3M Destruction

Loss of information or asset; breaks Availability AND Integrity; levels: since last reasonable backup, total

D3M Modify

Information has been altered; breaks Integrity; levels: accidental, deliberate

D3M element that breaks two CIA properties

Destruction (Availability + Integrity)

D3M: ransomware wipes a server, last backup was last night

Destruction, level: since last reasonable backup

D3M: contractor leaks customer list

Disclosure, category: contract-workers

D3M: employee mistypes a price in the database

Modify, level: accidental

STRIDE

Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege

Aim of STRIDE

Threat-focused: identifying and analysing threats

Spoofing

Impersonating someone or something (e.g. stolen credentials); breaks Authenticity

Tampering

Modifying code or data without authorisation (e.g. changing database entries); breaks Integrity

Repudiation

Denying performing an action with no proof to the contrary; breaks Non-repudiation

Information disclosure

Exposing confidential data to unauthorised parties (e.g. data leak); breaks Confidentiality

Denial of Service (STRIDE)

Degrading or blocking services for legitimate users; breaks Availability

Elevation of Privilege

Gaining unauthorised capabilities or higher access levels; breaks Authorisation

STRIDE: user gives themselves admin rights via a bug

Elevation of Privilege

STRIDE: attacker logs in with a stolen password

Spoofing

STRIDE: customer denies placing an order and there are no logs

Repudiation

STRIDE: exploiter edits their in-game currency value

Tampering

Threat types (3)

Physical, Personnel, Technical

Physical threat examples

Fire, power failure, water, air conditioning failure, natural disaster

Personnel threat examples

User error, theft/vandalism by insiders or outsiders, terrorism, hacking by insiders or outsiders, staff shortage

Technical threat examples

Applications failure, operations error, OS failure, malicious code, mainframe/storage/printer/LAN/WAN failure

Personal data links to which law

Data Protection Act (slide says DPA 2020; the actual UK Act is DPA 2018)

Payment card data links to which standard

PCI DSS

Natural disaster examples

Fires, floods, earthquakes, lightning, landslides, tornados, hurricanes, tsunamis, solar activity, civil unrest, war

Terrorism contains

Hacktivism/cyberactivism, cyberterrorism, cyberwarfare

Malicious hacking examples

Competitive intelligence, industrial espionage, expert or unskilled hackers, shoulder surfing, password attacks

Password attack types

Cracking, brute force, dictionary, social engineering, rainbow tables

Non-malicious hacking threats (no ill intent by the victim)

Employee mistakes, social engineering, phishing, fake websites, advance-fee fraud

Real example: Facebook and Google

Employees sent fake bills to pay in an email phishing attack

Password cracking takeaway

Length and character variety grow cracking time exponentially (8 letters: under 1s; 16 letters: about 2363 years)

Lock, Carr & Warkentin (1992) four dimensions

Sources (internal/external) → Perpetrators (human/non-human) → Intent (accidental/intentional) → Consequences

Lock, Carr & Warkentin consequences (4)

Disclosure, Modification, Destruction, Denial of use

Willison & Warkentin (2013)

IS Security Threat Vector Taxonomy: splits insider human intent into a continuum

Willison & Warkentin intent continuum (3)

Passive non-volitional noncompliance → Volitional (not malicious) noncompliance → Intentional malicious computer abuse

Passive non-volitional noncompliance examples

Unintentional actions, accidental data entry, forgetful oversights, uninformed violations

Volitional (not malicious) noncompliance examples

Failing to log off when leaving PC, delayed backups, not changing passwords regularly