Risk Management Notes

Risk Management: Controlling Risk In Information Security

Risk Plan

A risk plan involves:

• Assessing risks

• Identifying hazards

• Evaluating risks l

• Reviewing risks

• Implementing controls

• Monitoring risks

• Controlling risks

Risk Assessment

• Information risks are the combination of likelihood and impact of threats to the confidentiality, integrity, and/or availability of information.

• Cyber risk is the likelihood of suffering negative disruption to sensitive data, finances, or business operations.

• Cyber risk can be calculated as: $Risk = Threat \times vulnerability \times information value$ or $Risk = Probability \space of \space threat \space attack \times impact$

• Risk assessment (as defined by the NIST) is used to identify, estimate, and prioritize risk to organizational operation

Why Risk Management?

Risk Management should answer these questions:

• What constitutes sensitive information?

• Where is it located?

• How much of it is there?

• How effectively is it protected?

• What are the vulnerabilities that could lead to compromise?

• What is the likelihood of compromise?

• What is the potential impact?

• What is the most effective use of protection resources?

The Purpose of Risk Management

• Ensure overall business and business assets are safe

• Protect against competitive disadvantage

• Compliance with laws and best business practices

• Maintain a good public reputation

• Avoid data breaches

• Reduction of long-term costs

• Avoid regulatory issues

• Prevent data loss

Security Risk Assessment

• Risk assessment is fundamental to the security of any organization.

• It is essential in ensuring that controls and expenditure are fully commensurate with the risks to which the organization is exposed.

• Security in any system should be based on its risks.

• The process to determine which security controls are appropriate and cost effective, is quite often a complex and sometimes a subjective matter.

Risk Analysis

• One of the prime functions of security risk analysis is to put this process onto a more objective basis.

• There are two types to risk analysis: quantitative and qualitative.

Quantitative Risk Analysis

• This approach employs two fundamental elements: the probability of an event occurring and the likely loss should it occur.

• Quantitative risk analysis makes use of a single figure produced from these elements, called the 'Annual Loss Expectancy (ALE)' or the 'Estimated Annual Cost (EAC)'.

• ALE Calculation: Calculated for an event by simply multiplying the potential loss by the probability.

• It is thus theoretically possible to rank events in order of risk (ALE) and to make decisions based upon this.

Problems with Quantitative Risk Analysis

• The problems with this type of risk analysis are usually associated with the unreliability and inaccuracy of the data.

• Probability can rarely be precise and can, in some cases, promote complacency.

• Controls and countermeasures often tackle a number of potential events, and the events themselves are frequently interrelated.

• A number of organizations have successfully adopted quantitative risk analysis.

Qualitative Risk Analysis

• This is by far the most widely used approach to risk analysis.

• Probability is not required, and only estimated potential loss is used.

• Most qualitative risk analysis methodologies make use of a number of interrelated elements: THREATS, VULNERABILITIES, CONTROLS

Qualitative Risk Analysis Elements: Threats

• THREATS: These are things that can go wrong or that can 'attack' the system. Examples might include fire or fraud. Threats are ever present for every system.

Qualitative Risk Analysis Elements: Vulnerabilities

• VULNERABILITIES: These make a system more prone to attack by a threat or make an attack more likely to have some success or impact.

• For example, for fire, a vulnerability would be the presence of inflammable materials (e.g., paper).

Qualitative Risk Analysis Elements: Controls

• CONTROLS: These are the countermeasures for vulnerabilities. There are four types:

  • Deterrent controls reduce the likelihood of a deliberate attack

  • Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact

  • Corrective controls reduce the effect of an attack

  • Detective controls discover attacks and trigger preventative or corrective controls.

Relational Model of Threats, Vulnerabilities, and Controls

• Depicts the relationships between threats, vulnerabilities, controls, and their impact.

• THREAT: Creates likelihood of ATTACK.

• VULNERABILITY: Exploited by ATTACK, results in IMPACT.

• DETERRENT CONTROL: Reduces likelihood of ATTACK.

• PREVENTATIVE CONTROL: Protects VULNERABILITY, reduces IMPACT.

• DETECTIVE CONTROL: Discovers ATTACK, triggers controls.

• CORRECTIVE CONTROL: Reduces IMPACT.

Risk Assessment Business Objectives

• Focus on key assets

• Protect against likely threats

• Prioritize future actions

• Balance cost with benefits

• Identify / Justify appropriate controls

Risk Assessment Positive Factors

• Enables security risks to be managed

• Maximizes cost effectiveness

• Safeguards information assets

• Enables IT risks to be taken more safely

Risks

• Unauthorised or accidental disclosure

• Unauthorised or accidental modification

• Unavailability of facilities / services

• Destruction of assets

Risk Impact

• Monetary losses

• Loss of personal privacy

• Loss of commercial confidentiality

• Legal actions

• Public embarrassment

• Danger to personal safety

Risk Control Strategy

• Risk prevention

• Reduction of impact

• Reduction of likelihood

• Early detection

• Recovery

• Risk transfer

Risk Assessment Recap

• Risk Assessment is a business requirement

• Risk Assessment is part of overall security management

• Can be complex

• Methods exist

• Approach must suit your organisation

The Benefits of Security Risk Analysis

• Cost Justification

• Productivity: Audit/Review Savings

• Breaking Barriers - Business Relationships

• Self-Analysis

• Security Awareness

• Targeting Of Security

• 'Baseline' Security and Policy

• Consistency

• Communication

Cost Justification

• Additional security almost always involves additional expense. As this does not directly generate income, it should always be justified in financial terms.

• The Risk Analysis process should directly and automatically generate justification for security recommendations in business terms.

Productivity: Audit/Review Savings

• A Risk Analysis program should enhance the productivity of the security or audit team.

• By creating a review structure, formalizing a review, and utilizing "self-analysis" features, much more productive use of time is possible. The ability to 'build-in' expertise should also alleviate the need for expensive external security consultants.

Breaking Barriers - Business Relationships

• Security should be addressed by both business management and IT staff.

• Business management are responsible for decisions relating to the security risk/level that the enterprise is willing to accept.

• IT management are responsible for decisions relating to specific controls and application

• Risk Analysis should relate security directly to business issues.

Self-Analysis

• The Risk Assessment system should be simple enough to enable its use without the need for particular security knowledge, or IT expertise.

• This approach enables security to be driven into more areas and to become more devolved.

• It enables security to become part of the enterprises culture, allowing business unit management to take more of the responsibility for ensuring an adequate and appropriate level of security.

Security Awareness

The widespread application of a risk assessment program, by actively involving all of staff, will increase security awareness within the enterprise.

Targeting Of Security

• Security should be properly targeted and directly related to potential impacts, threats, and existing vulnerabilities

• Risk Analysis promotes far better targeting and facilitates related decisions.

'Baseline' Security and Policy

• Many enterprises require adherence to certain 'baseline' standards. This could be for a variety of reasons, such as legislation (e.g., Data Protection Act), enterprise policy, regulatory controls, etc.

• The Risk Analysis methodology should support such requirements and enable rapid identification of any failings.

Consistency

• A major benefit of the application of Risk Analysis is that it brings a consistent and objective approach to all security reviews. This not only applies across different applications but also different types of business systems.

Communication

• By obtaining information from different parts of a business unit, a Risk Assessment aids communication and facilitates decision making.

• There are also a number of other important, but less tangible, benefits to be accrued via the application of Risk Analysis

Steps of a Risk Management Plan

• Step 1: Identify Risk

• Step 2: Assess Risk

• Step 3: Control Risk

Asset Identification

• Identify assets – “anything which needs to be protected” – of value to organization to meet its objectives

  • Tangible or intangible

  • In practice, try to identify significant assets

• Draw on the expertise of people in relevant areas of the organization to identify key assets

  • Identify and interview such personnel

  • See checklists in various standards

Threat Identification

• To identify threats or risks to assets ask:

  • Who or what could cause it harm?

  • How could this occur?

• Threats are anything that hinders or prevents an asset providing appropriate levels of the key security services:

  • Confidentiality, integrity, availability, accountability, authenticity and reliability

• Assets may have multiple threats

Threat Sources

• Threats may be

  • Natural “acts of god”

  • Man-made and either accidental or deliberate

• Should consider human attackers

  • Motivation

  • Capability

  • Resources

  • Probability of attack

  • Deterrence

• Any previous history of attack on the organization

Elements of Threat Identification

• Depends on risk assessors experience

• Uses a variety of sources

  • Natural threat chance from insurance stats

  • Lists of potential threats in standards, IT security surveys, info from governments

  • Tailored to organization’s environment

  • And any vulnerabilities in its IT systems

Vulnerability Identification

• Identify exploitable flaws or weaknesses in the organization’s IT systems or processes

• Hence determine the applicability and significance of threat to organization

• Need combination of threat and vulnerability to create a risk to an asset

• Again can use lists of potential vulnerabilities in standards etc

Risk Identification steps

The steps to risk identification are:

• Identify your organization’s information assets

• Classify and categorize assets into useful groups

• Rank assets based on necessity to the organization

Risk Assessment steps

The steps to risk assessment are:

• Identify threats and threat agents

• Prioritize threats and threat agents

• Assess vulnerabilities in the current InfoSec plan

• Determine the risk of each threat

$R = P * V – M + U$

Where:

• R = Risk

• P = Probability of threat attack

• V = Value of Information Asset

• M = Mitigation by current controls

• U = Uncertainty of vulnerability

Risk Control steps

The steps to risk control are:

• Cost-Benefit Analysis (CBA)

• Single Loss Expectancy (SLE)

• Annualized Rate of Occurrence (ARO)

• Annual Loss Expectancy (ALE)

• Annual Cost of the Safeguard (ASG)

• Feasibility Analysis

  • Organizational Feasibility

  • Operational Feasibility

  • Technical Feasibility

  • Political Feasibility

• Risk Control Strategy Implementation

Risk Assessment - Single Loss Expectancy (SLE)

• Expected monetary loss each time a risk occurs

• Calculated by multiplying the asset value (AV) by exposure factor (EF)

• The exposure factor is the percentage of asset value likely to be destroyed by a particular risk (% of asset affected)

Risk Assessment - Annualized Loss Expectancy (ALE)

• Expected monetary loss over a one-year period

• Multiply SLE by annualized rate of occurrence

• Annualized rate of occurrence (ARO): probability that a risk will occur in a particular year

• It can be calculated by multiplying the annual rate of occurrence (ARO) by single loss expectancy (SLE).

Example Calculation

• Suppose that an asset is valued at $100,000, and the Exposure Factor (EF) for this asset is 25%.

• The single loss expectancy (SLE) = 25% × $100,000 = $25,000.

• Assume annual rate of occurrence = 1, then annualized loss expectancy = 1 × $25,000 = $25,000

Formulas

• $SLE = AV * EF$

• $ALE = SLE * ARO$

• $CBA = ALE (pre-control) – ALE (post-control) – ASG$

Where:

• Asset Value = AV

• Single loss expectancy = SLE

• Exposure Factor = EF

• Annualized loss expectancy = ALE

• Annualized rate of occurrence = ARO

• Cost-Benefit Analysis = CBA

• Annual Cost of the Safeguard = ASG

Feasibility analysis

• Organizational: Does the plan correspond to the organization’s objectives?

• Operational: Will shareholders (users, managers, etc.) be able/willing to accept the plan?

• Technical: Is the necessary technology owned or obtainable? Are our employees trained and if not can we afford to train them? Should we hire new employees?

• Political: Can InfoSec department acquire the necessary budget and approval to implement the plan? Is the budget required justifiable?

Risk control Strategies

• Defense

• Transferal

• Mitigation

• Acceptance (Abandonment)

• Termination

Risk Control Strategy: Defense

• Defense: Prevent the exploitation of the system via application of policy, training/education, and technology. Preferably layered security (defense in depth)

  • Counter threats

  • Remove vulnerabilities from assess

  • Limit access to assets

  • Add protective safeguards

Risk Control Strategy: Transferal

• Transferal: Shift risks to other areas or outside entities to handle

  • Can include:

    • Purchasing insurance

    • Outsourcing to other organizations

    • Implementing service contracts with providers

    • Revising deployment models

Risk Control Strategy: Mitigation

• Mitigation: Creating plans and preparations to reduce the damage of threat actualization

  • Preparation should include:

    • Incidence Response Plan

    • Disaster Recovery Plan

    • Business Continuity Plan

Risk Control Strategy: Acceptance

• Acceptance: Properly identifying and acknowledging risks, and choosing to not control them

• Appropriate when:

  • The cost to protect an asset or assets exceeds the cost to replace it/them

  • When the probability of risk is very low and the asset is of low priority

  • Otherwise acceptance = negligence

Risk Control Strategy: Termination

• Termination: Removing or discontinuing the information asset from the organization

• Examples include:

  • Equipment disposal

  • Discontinuing a provided service

  • Firing an employee

Pros and Cons of each strategy

Standard Approaches to Risk Management

• U.S CERT’s Operationally Critical Threat Assessment Vulnerability Evaluation (OCTAVE) Methods (Original, OCTAVE-S, OCTAVE-Allegro)

• ISO 27005 Standard for InfoSec Risk Management

• NIST Risk Management Model

• Microsoft Risk Management Approach

• Jack A. Jones’ Factor Analysis of Information Risk (FAIR)

• Delphi Technique

Analyze Risks

• Specify likelihood of occurrence of each identified threat to the asset given existing controls

  • Management, operational, technical processes, and procedures to reduce exposure of the organization to some risks

• Specify consequence should threat occur

• Hence derive overall risk rating for each threat: $risk = probability \space threat \space occurs \times cost \space to \space organization$

• In practice, very hard to determine exactly

• Use qualitative not quantitative ratings for each

• Aim to order resulting risks in order to treat them

Determine Likelihood Rating

Determine Consequence Rating

Determine Resultant Risk Consequences

• Risk Level Description

  • Extreme (E): Will require detailed research and management planning at an executive/director level. Ongoing planning and monitoring will be required with regular reviews. Substantial adjustment of controls to manage the risk is expected, with costs possibly exceeding original forecasts.

  • High (H): Requires management attention, but management and planning can be left to senior project or team leaders. Ongoing planning and monitoring with regular reviews are likely, though adjustment of controls is likely to be met from within existing resources

  • Medium (M): Can be managed by existing specific monitoring and response procedures. Management by employees is suitable with appropriate monitoring and reviews.

  • Low (L): Can be managed through routine procedures.

Document in Risk Register and Evaluate Risks

Risk Treatment Judgement

• If the Cost of Treatment is uneconomic so accept.

Risk Register (Example)

Risk Assessment Methodology Overview

Data classification

• Start with the data classification policy.

• Consider other potentially sensitive data, for example:

  • Student Info

    • SSN

    • Financial Info

    • Credit Card Info

    • Driver’s License

    • Protected Health Info

    • Academic Records

  • Employee / Faculty (HR) Info

    • SSN

    • Payroll Info

    • Driver’s License

    • Bank Account Info

    • Protected Health Info

  • Alumni and Donor Info

    • SSN

    • Credit Card Info

    • Driver’s License

    • Bank Account Info

  • Financial Data

    • University Finances

  • Point-of-Sale

    • Customer Credit Card Data

  • Physical Plant

    • Buildings, Facilities, Utilities

    • Grounds

  • Cyber Infrastructure

    • Access Info, Logs, LDAP

  • Other PII

    • Human Subject Research

    • Key Performance Indicators

  • Protected Health Info (PHI)

    • Info in Non-medical Systems

  • Intellectual Property

    • Courseware, Research, Papers, Books, Code

  • Library

    • Citation DB

    • Digital Full Text

    • Circulation

Data and asset inventory

• Map the assets to data types and locations and attempt to roughly quantify the data

Exposure analysis

• After completing the inventory exercise, identify the key assets and departments on which to focus.

Vulnerabilities Risk Assessment

• Controls Assessment

• Controls Threats

• Assets (Apps, DBs, etc.)

• Departments and Units

• Regulations

Threat analysis

• Select an appropriate threat model:

  • Malicious activity

  • Malfunction

  • Human error

  • Environmental

Controls analysis

• Start at a high level and drill down.

• For example, we examine:

  • Access Control

  • Encryption

  • Backup / Restore

  • Physical / Environmental Control

  • Monitoring

  • Documentation

  • Anti-Virus

Control Maturity Model

Cost-Benefit Analysis

• Review exposures, vulnerabilities, and potential impact

• Create a list of remediation options

• Estimate costs and compare with benefits

• Outline security roadmap

• Identify long-range plans

• Highlight action items

  • Quick wins

  • High-priority exposures

• Determine on-going risk assessment schedule

  • To revisit units and departments

  • Visit new units and departments

  • Drill down on areas that need further investigation and more detail