Critical Review

Information Security is Information Risk Management

Bob Blakley Tivoli Systems, Inc.

blakley @ us, ibm.com

Ellen McDermott J.P. MorganChase

Dan Geer @ Stake

ABSTRACT Information security is important in proportion to an organization's dependence on information technology. When an organization's information is exposed to risk, the use of information security technology is obviously appropriate. Current information security technology, however, deals with only a small fraction of the problem of information risk. In fact, the evidence increasingly suggests that information security technology does not reduce information risk very effectively.This paper argues that we must reconsider our approach to information security from the ground up if we are to deal effectively with the problem of information risk, and proposes a new model inspired by the history of medicine.

1. INFORMATION RISK Information security is required because the technology applied to information creates risks. Broadly, information might be improperly disclosed (that is, its confidentiali ty could be compromised), modified in an inappropriate way (that is, its integrity could be compromised), or destroyed or lost (that is, its availability could be compromised).

Compromise of a valuable information asset will cause dollar losses to the information's owner whether acknowledged or not; the loss could be either direct (through reduction in the value of the information asset itself) or indirect (through service interruption, damage to the reputation of the information's owner, loss of competitive advantage, legal liability, or other mechanisms).

1.1 What is Risk? In business terms, a risk is the possibility of an event which would reduce the value of the business were it to occur. Such an event is called an "adverse event."

Every risk has a cost, and that cost can be (more or less precisely) quantified. The cost of a particular risk during a particular period of time is the probability of an adverse event occurring during the time period multiplied by the downside consequence of the adverse event. The probability of an event occurring is a number between zero and one, with zero representing an event which will definitely not occur and one representing an event which definitely will occur. The

Permission to make digital or hard copies of all or part of this work for personal or classroom use is grmted without fee provided that copies are not made or dislributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redisl3"ibute to lists, requires prior specific permission and/or a fee. NSPW'OI, September 10-13 m, 2002, Cioudcroll, New Mexico, USA. Copyright 2002 ACM 1-58113457-6/01/0009...$5.00.

consequence of an event is the dollar amount of the reduction in business value which the event will cause if it occurs [Har]

1.2 Measuring Risk A common measure of the cost of risk is "Annualized Loss Expectation," or ALE. ALE is the expected cumulative cost of risk over a period of one year as estimated in advance. For example, a chemical company estimates the probability of an explosion at one of its plants during the year 2001 as one in a million. If an explosion occurs, it will cost the company 150 million dollars in direct and indirect expenses, (for example, repair costs, legal costs, or lost business).

The ALE created by the risk of a plant explosion for the year 2001 is simply:

ALEffi $15,000,000 x (1/1,000,000) ffi $150

It's important to understand that the actual cost of this risk will never be that of the ALE, i.e., it will never be $150 during a particular year - it will be either $0 or $150 million. In less certain situations, the probability or the cost may be ranges rather than point estimates. If the probability of the explosion is between one in five hundred thousand and one in a mi l l ion while the cost varies between 100 million and 200 million, the ALE would be:

ALE= ($100M$200M)x (1/5 00,000.1/1,000,000 =$100.$4.00

It may be possible to estimate the probability distribution of expected loss within the range (so for example, the ALE for the example above might be uniformly distributed between $100 and $400). ALEs can also be figured based on inequalities, as is doubtless obvious.

2. MANAGING RISK Businesses routinely manage risk as part of their day-to-day operations. Risks can be managed using a variety of mechanisms, including liability transfer, indemnification, mitigation, and retention.

2.1 Liability Transfer A business can transfer liability for an adverse event to another party. This takes the risk off the business's books. Liability can be transferred in two ways: by disclaimer and by agreement.

• A business disclaims liability when it undertakes an activity with the explicit understanding that it will not be held responsible for the consequences of certain adverse events, but without specifying who will be responsible for those consequences.

• A business transfers liability by entering into an agreement; to do this the business engages in an activity with counter-party after they both agree that the counter- party will be responsible for the consequences of certain adverse events.

97

2.2 Indemnif icat ion A business can indemnify itself against the consequences of an adverse event. There are two major types o f indemnif icat ion: pool ing and hedging;.

• In pool ing schemes, several businesses share the cost o f certain risks. If adverse events are unl ikely to happen simultaneously to a meaningful fi'action of the bus ines ses in the pool, pooling will decrease the cost of risk to each organizat ion in the pool while increasing the predictability of the cost of risk for each business in the pool. Insurance policies are th,: most common type o f r isk-pool ing scheme.

• In hedging schemes, a single business essentially places a bet that an adverse event will happen to it. If the event i s improbable, other organizat ions or individuals are l ike ly to take the bet, because the probabi l i ty is high that they will win the bet. I f the adverse event does not happen, the business will pay off the bet. I f the adverse event does happen, the bettors will have to pay the business. In th i s case, the business uses the money it collects from winning the bet to defray the ccsts of the adverse event. The key to a successful hedging scheme is getting the odds right on the bet. Being! better than others at estimating the true odds of an adverse event can enable a business or an indiv idual to make money on h e d g i n g schemes in the same way as easi'nns make money on card games. Options are the best- imown example of r isk- hedging scheme.

2.3 Mitigat ion A business can try to reduce the expected cost of a risk, ei ther by reducing the probabil i ty of the adverse event occurring, or by reducing the consequences i f it does occur.

• The probabi l i ty of an adverse event can be reduced by redesigning systems or processe.~; to el iminate the e ve n t ' s known or suspected causes. :Ln the extreme case, the probability of an event can be reduced to zero by ent i re ly avoiding the activity which creates the risk. In bus ine s s terms this might mean foregoirtg an opportuni ty which has potential rewards but also carries substantial risk.

• The consequences of an adverse event can be reduced b y taking steps to l imit the damage the event causes. These steps either prevent the damage caused by the adverse event from spreading, or they shorten the t ime du r ing which the event causes damage by accelerating de tec t ion and recovery. Building codes that anticipate ear thquakes do nothing to prevent earthquakes but they do lessen the damage that would otherwise be inevitable and uncont ro l led .

2.4 Retention If an adverse event is not very costly or not very likely to occur, or if the benefits to be realized from taking a risk are great, a business may choose to retain the risk which the adverse event creates.

• If the business chooses to set aside funds to offset the cost of retained risks, it is s;iid to self-insure aga ins t these risks. Cyclical industries often approach inheren t sector risk in this way, storing up funds in fat years against the lean.

• A business which retains risks without setting aside funds to offset their costs is said to accept retained risks. Many large companies do this with respect to the travel risks their employees incur, for example when they rent automobi les .

3. INFORMATION SECURITY Up to this point we have used examples unlrelated to information risk to illustrate risk management . Failures of information security are clearly adverse events which cause losses to business; therefore, informat ion security is a r i sk management discipline, whose job is to manage the cost o f information risk to the business.

3.1 W h a t is Informat ion Security? Where information risk is well enough understood and at least in broad terms stable, information security starts with pol icies . These policies describe "'who should be allowed to do what" to sensit ive information.

Once an information security policy has been defined, the nex t task is to enforce the policy. To do this, the business dep loys a mix of processes and technical mechanisms. These processes and mechanisms fall into four categories:

• Protection measures (both processes and technical mechanisms) aim to prevent adverse events from occurring.

• Detection measures alert the business when adverse events o c c u r .

• Response measures deal with the consequences of adverse events and return the business to a safe condi t ion after an event has been dealt with.

• Assurance measures Validate the effectiveness and proper operation of protection, detection, and response measures.

The final information security task is an audit to determine the effectiveness of the measures taken to protect in fo rmat ion against risk, We say "final" but, obviously, the job of information risk management is never done. The po l icy definition, protection, and audit tasks are performed over and over again, and the lessons learned each time through the cycle are applied during the next cycle.

3.2 W h a t ' s w r o n g w i t h information security? I t ' s increasingly evident that informat ion security as def ined above simply i sn ' t doing the job. Every day, newspapers and trade journals carry stories of the latest virus, denia l -of-service attack, website defacement, or bug in an important secur i ty product. The public is gett ing the message even if the o n l y sensible reaction is dread.

Why is informat ion security failing7 We posit two reasons: information security focuses on only a small part of the problem of information risk, and it doesn ' t do a very good j o b of protecting businesses against even that small part.

3.2.1 Focus Information security technology focuses primarily on r i sk mitigation. Informat ion security risk analysis processes are geared toward imagin ing and then confirming technical vulnerabi l i t ies in informat ion systems, so that steps can be taken to mitigate the risks those vulnerabi l i t ies create. In some cases management will be asked to sign a risk acceptance

98

(that is, to retain a risk) after a risk analysis. A risk acceptance will typically include either a plan for future mitigation or a justification of the economic rationale for choosing not to mitigate.

Information security as a discipline is often biased

• toward technological mechanisms rather than process mechanisms,

• in favor of logical (that is, computer hardware and software) mechanisms, and

• against physical mechanisms (such as locks, walls, cameras, etc...)

Even within the category of risk minimization activities, information security focuses more on reducing probability of an adverse event than on reducing its consequences. And where consequence reduction is implemented, it tends to focus much more strongly on quick recovery (for example, by using aggressive auditing to identify the last known good state of the system) than on minimizing the magnitude of a loss through measures to prevent damage from spreading.

Information security activities rarely include any discussion of indemnity or liability transfer, although some organizations do address these issues in an "operational risk" organization separate from the information security organization.

The following chart organizes information security products end processes according to the risk management activities they implement. The chart clearly illustrates the problem.

Table 1.

mmilm, m im

m

m l n m

r ~ - v h ~ 4

Iqv6

mTImm, lmm- Idmm Emma,

wmlm lammL

mmm4* dm~m,

m w f ~

all, b y mmow..

ram-

3.2.2 Effectiveness The annual FBI/CSI computer crime surveys and the CERT coordination center annual summaries [CERT] have shown substantial increases in the number o f security incidents and in the dollar losses resulting from incidents in each of the past five years.

The year 2000 FBI/CSI survey [CSI] nevertheless reports that use of information security technologies is very widespread - close to 100% of companies responding to the FBI/CSI survey use antivirus, firewall, and access control technologias.

The combination of nearly universal deployment of security technology with rapidly and steadily rising losses strongly suggests that security technologies (and processes, although these are not covered in the FBI/CSI survey) do not prevent losses - in other words, they don't work[

Further, as Arbaugh, Fithen, and McHugh have shown [AFM], identification of a vulnerability end its exploitation are both separated in time. Furthermore, risks arising from a vulnerability are often multiplied both by scripting of the attack and by the haphazard deployment of patches even when they are easily available.

4. QUANTIFICATION OF INFORMATION SECURITY RISK

Risk analysis has been recognized as an important information security discipline for a long time. Information security risk analysis methodologies were developed long ago, and some of these methodologies have been included in formal information security standards. The large majority of these standards have been qualitative - t h a t is, their assessment of probability and consequence of risks is based on a "low/medium/high" characterization rather than on a specific probability and a specific dollar amount of loss. Qualitative information security risk management standards include the US Federal standards [FIPS31] and [FIPS191]. Recent guidelines which recommend qualitative risk analysis techniques include [GAO] and the newly issued draft t~STRMO].

Quantitative information security risk management standards have been developed, including the now withdrawn [FIPS65]. The authors are not aware of any current information security standard which mandates the use of a quantitative risk analysis method, though the Australian national standard for risk analysis [AS] permits the use of either qualitative or quantitative analysis. Methodologies for quantitative and mixed quentitative/qualitative information security risk analysis have been published; see for example [Pelt]. Quantitative risk analysis is used extensively in disciplines other then information security, including finance, healthcare, and safety (see [KBPS] for a number of examples). There is a large body of literature on methods for quantitative risk analysis in these fields; sources include [Koll] and [Vosc].

Good data is a prerequisite to qualitative risk analysis, and the lack nfgood data may be the main reason qualitative analysis o f information security risk is not usually performed. [GAO] explicitly acknowledges this: "Reliably assessing information security risks can be more difficult than assessing other types of risks, because the data on the likelihood and costs associated with information security risk factors are often more limited and because risk factors are constantly changing."

Insurers seem to agree that data is lacking. The National Underwriter Company's guide to risk in the wired world [ERisk] warns: "The lack of historical data presents one of the most difficult challenges when trying to analyze online exposures.., the insurance industry typically depends on large bodies of actuarial data collected over long periods of time to develop pricing models for insurable exposures. But in the Wired World exposures arc so new and are growing so rapidly in terms of frequency and severity that this is not an easy task."

Despit© the lack of actuarial data, many insurers (including AIG, Lloyd's, Chubb, Zurich, and others; a partial list can be found in [ECov]) are offering policies which cover losses due to failures of information security. But the actuarial basis for these policies is unclear, as the National Underwriter Company [ECov] explains: "The insurance industry has worked closely

99

with actuaries and f inancial anal:rsts to map out the calculat ions for the p robab i l i t i e s o f loss, the probable c o s t s for various scenarios o f loss, and for r, i tes and rat ing s t ruc tures for acceptable risks. Af te r years, decades, and even centuries o f study, calculat ions for var ious probabi l i t i es have been developed. These tables end charts t yp ica l ly deal in a wor ld where the events that tend to cause the damages have been ident if ied prev ious ly and provide a basis for which the future can be predicted. The new economy has d is rupted t h i s equi l ibr ium. New risks are emerging, and the insurance indust ry has had only a b r ie f per iod o f t /me to scratch the surface for potent ia l l iabi l i t ies . So far there have been re la t ive ly few claims that have mater ia l ly affected the t echno logy industry. It is too early to es tabl ish ac tuar ia l tables to quant i fy t echno logy r isks . . . Because the actuar ies don ' t have the data needed to predic t losses, the f inanc ia l analysts arc hampered in pred ic t ing hhe f inancial v iab i l i ty o f insur ing t echno logy r isks ."

The f inance indust ry cer ta inly sees a lack o f i n f o r m a t i o n securi ty r isk data. The revised Basel accord [Basel], wh ich governs the amount o f capi tal that banks must set aside as a hedge agains t risk, requires for the first t ime that banks se t aside capital to offset operational, risk (which i nc ludes informat ion securi ty risks). Banks which can demons t ra te , start ing in January 2005 and based on 3 years o f a u d i t a b l e data, that their r isk exposure is lower than the Basel a c c o r d ' s estimate, can reduce their capi tal set, as ide from the ve ry substant ia l amount required by the accord as a baseline. A large number o f f inancial ins t i tu t ions have c o m m e n t e d [BCom] on the revised accord. The Amer ican B a n k e r ' s Assoc ia t ion wrote " . . . o n l y a few iJ.lstitutions appear to be act ively mode l ing opera t iona l risk, and mode l ing is ve ry much in deve lopment . . , whether a t tempt ing to m o d e l operat ional risks or not, most banks have not captured the da ta necessary to evaluate opera t ional ~.sk, even at a theore t i ca l level". Bank o f Amer ica wrote "We do not bel ieve tha t opera t ional r isks are measurable us ing methods and data tha t are avai lable at this t ime. . . Only e. handful o f banks have implemented quant i ta t ive apprc.aches for m e a s u r i n g opera t ional r isk and the models an: largely untested." The Richmond Federal Reserve wrote: " W e arc concerned about the lack o f data on opera t ional risk, and acknowledge that b a n k s have been very reluctant to publici:,,e detai ls o f losses f rom such problems as def ic iencies in internal controls, h u m a n error, or system failure."

In order to quant i fy in format ion securi ty risk, and the effect iveness o f informat ion securi ty r isk control measures , the fo l lowing informat ion needs to be collected. Some is a lready in good supply, some is not. There will be t e m p t a t i o n s to extrapolate f rom avai lable data to less-avai lable data, and to apply r i sk -measurement methods which am a l r eady unders tood outs ide o f their appropr ia te domains o f use; the authors caution that these tempta t ions should be avoided.

4.1 V u l n e r a b i l i t i e s A comprehens ive l ist o f in format ion securi ty v u l n e r a b i l i t i e s needs to be developed. For each vu lnerab i l i ty , i n f o r m a t i o n needs to be gathered and regular ly upda ted about the ease and f icqucncy o f exploitat ion, and ease and speed o f recovery f rom exploi ta t ion. This in format ion must be col lected and made avai lable in a way that demons t r ab ly minimizes the probabi l i ty o f exploi ta t ion in an eccmomical ly harmful way

4.2 I n c i d e n t s Informat ion needs to be gathered about securi ty i n c i d e n t s exper ienced by businesses worldwide. This informat ion m u s t include what vulnerabi l i t ies were exp lo i t ed and how r e s p o n s e and recovery were handled. Incidents that are t raceable to vu lnerab i l i t i es already known are one thing and will be a matter o f d i scuss ion between insurers and v ic t ims i f in n o other situation. Incidents that h igh l igh t p rev ious ly u n k n o w n vulnerab i l i t i es must be fed back to that catalog. This information needs to be col lected and made avai lable in a way which does not create addi t iona l l iabi l i t ies for the r epo r t i ng organizat ions (and hence incent ives to avoid report ing).

4.3 Losses For each incident identif ied, informat ion needs to be co l l ec t ed about direct monetary losses caused by the incident and a b o u t indirect losses (for example , reputa t ion damage or l o s t bus iness) with an es t imate o f the monetary losses r e s u l t i n g from these indirect losses. The ca lcula t ion o f losses needs to be done using a uniform me thodo logy , and the i n fo rma t ion needs to be col lected and made avai lab le in a way which d o e s not create addi t iona l l iabi l i t ies for the r e p o r t i n g o rgan iza t ions .

The Nat ional Underwri ter Company [ECov], recogniz ing the lack o f this k ind o f actuarial in format ion about i n fo rma t ion - secur i ty-re la ted losses, has sol ic i ted the aid o f the t e c h n o l o g y staff o f the insurance indus l ry i t se l f in f ixing the p r o b l e m : "Even though insurance IT staffers can revert to the same techie talk that t echno logy cl ients use, they are often requi red to expla in t echno log ica l advancements and enhancements to upper management o f the insurance company, especia l ly when discussing IT expenditures. I f they can do that, why can ' t t hey be used to help underwri ters develop assessment and underwri t ing tools and train c la ims profess iona l s in the intr icacies o f IT losses."

We ask a s imi lar quest ion: i f the IT secur i ty industry can design countermeasures and counsel cl ients on how to de fend their systems, why can ' t we help underwri ters d e v e l o p assessment and underwr i t ing tools and Urain c la ims profess iona l s in the int r icacies o f IT losses? Do we have something more impor tant to do7

4.4 C o u n t e r m e a s u r e E f f e c t i v e n e s s A comprehens ive list o f ava i lab le securiW measures needs to be developed, together wi th informat ion about about the c o s t o f acquiring, managing, and main ta in ing each secu r i ty measure. For each incident identif ied, information needs to be collected about which securi ty measures were in use at the t ime o f the incident, which securi ty measures were bypassed, which security measures were defeated, and how much t ime and effor t were required to c i rcmnvant or defeat the securi ty measures in place. Some mechanism mus t be put in place to combat the obvious tempta t ions to d is tor t pre- and pos t -even t r ead ines s and pro tec t ion postures and event detai ls in order to obscure or conceal the occurrence o f events, to embel l i sh war stories, or to avoid personal or corpora te accountabi l i ty .

S. W H A T D O E S T H E C U R R E N T S I T U A T I O N L O O K L I K E ?

We have descr ibed a world in which we have very l i t t l e informat ion about f requency o f occurrence o f adverse even t s and about the ser iousness o f their consequences. We a l so

i00

know very little about the effectiveness of the measures we take to prevent adverse events or alleviate their consequences. The people to whom these events happen have few incentives to report them; conversely, they have many incentives to suppress information about them. Finally, the system we are attempting to protect (roughly composed of the g lobal Internet and everything attached to it) is far too complex to be understood in detail.

This situation looks to the authors very much like the state of medical practice in the 19th century (for a good general treatment of the development of scientific medicine, see [Por], which includes an extensive bibliography). Medical practitioners had a poor understanding of the prevalence, , and likely outcomes of illness causes (the 1899 first edition of the Merck Manual [Merl] contains no information about causes, symptoms, or mortality rates of the conditions it describes; i t consists entirely of lists of preparations which could be administered for each condition, with no advice on how to choose among the many options), and the safety and effectiveness of treatments (The 1900 edition of the Old Farmer's Almanac includes an advertisement for Wistar 's Balsam of Wild Cherry, which claims that "It is the most reliable preparation in the world for the cure of Coughs, Influenza, Bronchitis, Whooping Cough, and all Throat and Lung Troubles, and in many well attested cases, Consumption [i.e. Tuberculosis] has yielded to its wonderful influence" [OFA]). The public feared medical treatment (for good reasons, despite frequent outbreaks of serious diseases), and widely considered medicine to be ineffective. And of course, the human organism was too complex to really understand.

The world of medicine today is very different - even though the human organism is still too complex to understand. Today, drug advertising is heavily regulated, and advertisements are required to provide extensive information on side effects, effectiveness as measured in clinical studies, contraindications, interactions with other medications, considerations for use in children and pregnant women, and s o o n .

The 2000 Centennial Edition of the Merck Manual [Merl7] lists, for each condition it describes, the cause or causes, etiology and pathology information, related or similar conditions together with methods for distinguishing between them, syptoms, signs, and methods of diagnosis, laboratory tests and findings, and prognosis and treatment regimens. Much of this information is based on quantitative studies of outcomes.

The 2002 edition of the Prentice-Hall Health Professional 's Drug Guide [HPDG] includes, for each listed medication, information on action and pharmacodynamics, uses ( including unlabelled uses), pregnancy risk category, routes o f administration and dosages, pharmacokinetics, contraindications and precautions, adverse reactions and side effects, interactions with drugs and medicinal herbs, assessment of patients during the course of therapy, and patient and family education. Again, this information is based on strict quantitative studies of use of the medications included.

What has made all this possible is the increased professionalism of medical practice, based in large part on the collection and study of quantitative data about prevalence and outcomes of illnesses and treatments. Three critical developments helped modernize western medicine:

• Mandatory professional education and liccnsure of practitioners

• Systematic collection and study of public health data

• Systematic observational studies of safety and effectiveness of treatments

We propose that these same developments would put information risk management on a sound footing. In the next three sections, we make specific proposals which could drive these developments into the practice of information r isk management.

6. HOW SHOULD INFORMATION RISK BE MANAGED?

Today, information risk management professionals have training but often no formal information risk management education. They don' t hold revocable licenses (or any licenses at all). They have no formally recognized ethical obligation to use only safe, effective risk management treatments for the problems they encounter. No professional body exists which could discipline ethical lapses if they occurred. There is no ethical obligation imposed on information risk management professionals to avoid the use of ineffective or even harmful treatments. There is no obligation of confidentiality to the organizations they treat - other than those negotiated on a case-by-case basis in employment agreements or consul t ing contracts. There is no obligation whatsoever to report information which might have "public health" or "public safety" implications to an established authority (and in fact sometimes the aforementioned employment agreements and consulting contracts explicitly forbid such disclosures).

The authors posit that in the future, information risk should be treated by professionals with the characteristics of a physician. A physician has:

• A specialized professional education

• A revocable license to practice

• An ethical obligation to treat patients appropriately and keep their private information in confidence

• A professional obligation to control (through the power of prescription) the use of potentially harmful treatments

• A professional obligation to report, important publ ic health information to the proper authorities.

Information risk professionals should have all these things too. Particularly important in our view are the ethical obligation to apply only appropriate treatments and protect confidentiality of those treated, and the professional obligation to report information to "public health" authorities.

The information risk management professional's obligation to treat appropriately, and to control the use of potent ial ly harmful treatments, will require assessing the costs and benefits of all risk treatment options - liability transfer, indemnification, and retention as well as mitigation, detection and response as well as prevention, and procedural as well as technical treatments. Choice of treatment options should be based on the welfare of the "patient" - which will be maximized by optimizing cost of risk to the business rather than on minimizing probability of occurrence of adverse events. Needless to say, the information risk professional will

101

be obl iga ted to avoid the use o f r isk treatments whose effect iveness is demons t rab ly low.

Profess ional t ra ining in management o f informat ion secur i ty r isk should present a broad and in'tegrated view t rea tments ( including, for example, r isk transfer and indemni f i ca t ion ) , rather than the one-d imens iona l , v u i n e r a b i l i t y - r n i t i g a t i o n focus common today. At the s imples t level, this means tha t informat ion securi ty risk educat ion should include f inanc ia l and legal d isc ip l ines in addi t ion to the technical d i s c i p l i n e s taught today. Some risk-managemerLt experts have begun to descr ibe how risk management acti,vities can be in t eg ra t ed across the entire spectrum of business r isks [Shim]; informat ion securi ty educat ion should be buil t on this kind o f comprehens ive f ramework.

6.1 Reporting Today, a lmost all informat ion sec~c~-ity r isk assessments use qual i ta t ive rather than quant i ta t ive methods . Some r i sk analysis me thodo log ie s and s tandards a l ready incorpora te rud imentary loss -expec ta t ion es t imat ion methods, but these are usual ly l imi ted to a " low/med ium/h igh" c a t e g o r i z a t i o n with arbitrary dol lar ranges ass igned to the categories. Some industr ies already quant ify inte l lectual proper ty r isk in f inancial terms and take steps to m;mage risk using f inanc ia l ins t ruments .

Risk assessment f indings are essent ia l ly never shared wi th anyone except the business being assessed, and poss ib ly i t s external auditors.

In the future, the authors bel ieve that information security r i sk assessments should focus not j u s t on ident i fy ing risks, b u t also on quan t i fy ing them. Specif ical ly , in format ion secur i ty r isks should be character ized in Financial terms, as ann ua l i z e d loss expec ta t ions

Once risks are ident i f ied and quantif ied, the resul t ing da ta should be reported (by the informat ion r isk m a n a g e m e n t professionals, in a w a y that respects their ethical ob l iga t ion to protect the pr ivacy o f those they treat) to the informat ion r i sk equivalent o f a publ ic heal th service. The next s e c t i on discusses this service at more length.

7. H O W S H O U L D I N F O R M A T I O N R I S K B E STUDIED?

Today, some data on r isk prevalence and sever i ty is co l l ec t ed by the US FBI, CERT, and other organizat ions . However, report ing to these organizat ions is voluntary, and only a smal l sample o f bus inesses even receive the ques t ionnai res which these bodies use to co l lec t their summary in format ion . Furthermore, no s tandard t axonomies o f vu ine rab i l i t i e s , incidents, losses, or countermeasures are used in the c o l l e c t i o n or repor t ing o f this information.

In the future, col lect ion o f data on informat ion r isk needs to be much more regular, formal, and comprehens ive . I n f o r m a t i o n r isk should be s tudied by an independen t body with t he character is t ics o f a publ ic heal th service. This " Pub l i c Securi ty Service" should collecl; f~om informat ion r i s k management professionals , in a w a y which protects the p r i v a c y o f the organiza t ions those p ro fess iona l s treat, data on the prevalence o f losses, the causes o f losses, the effects o f losses , and the effect iveness o f informal:ion r isk treatments. The Publ ic Securi ty Service should analyze this data and p u b l i s h the results o f its analyses as a way to improve the state o f

informat ion r isk management practice, and to inform p u b l i c po l i cy decis ions about informat ion risk management ,

Obvious ly , the advanced research which drives t he deve lopmen t o f new ~eatrnents and deeper unders tanding o f the causes o f r isks wil l cont inue to be carried out in the academic and business communi t ies , jus t as advanced med ica l research into new drugs and the causes o f disease is carried o u t by academic medica l schools and pharmaceut ica l research labs today .

8. H O W S H O U L D I N F O R M A T I O N S E C U R I T Y T E C H N O L O G Y B E EVALUATI~.D?

Today, informat ion secur i ty technologies are subjected to design and implementa t ion analyses def ined by a number o f assurance regimes (most no tab ly the Common Cri ter ia [CC]). Bus inesses can also submit vo lun ta r i ly to "seal" p rograms , whose cer t i f icat ions are based on dep loymen t o f p o p u l a r technologies , and on conl3"act, process and s y s t e m conf igura t ion audits. Bus inesses can contract for p e n e t r a t i o n testing, but the authors are not aware o f any ce r t i f i ca t ion regime which requires pene t ra t ion testing, or any o the r expl ic i t measure o f the ef fec t iveness o f securi ty p r o t e c t i o n measures , as a condi t ion o f grant ing cert if ication.

No sys temat ic effect iveness tes t ing o f informat ion secu r i ty measures is done by any independen t body, and the results o f effect iveness tes t ing done by vendors and thei r contractors are a lmost never publ i shed . In format ion r isk m a n a g e m e n t profess ionals have no t ra in ing in the des ign o f exper iments t o test effect iveness o f the measures they design, and no t r a i n i n g in publ i sh ing or rev iewing the results o f such experiments .

A workshop par t ic ipant po in ted out that the i n f o r m a t i o n securi ty indust ry has no equiva len t o f the white l abo ra to ry mouse which can be used to test the effect iveness o f s ecu r i ty mechanisms wi thout having to subjec t bus iness ' p r o d u c t i o n systems to unethical levels o f risk. This is an important , and true, observat ion.

The authors observe also, however, that medic ine has n o t a lways had white labora tory mice as models either, and wc urge research into the d e v e l o p m e n t o f an appropr ia te " secur i ty mouse analog" for use as an ef fec t iveness tes tbcd for secur i ty m e a s u r e s ,

In the future, the authors be l i eve that the effect iveness o f in format ion securi ty t e c hno logy would be most e f fec t ive ly evaluated by an impart ia l b o d y fo l lowing a process s imilar to the one used by the US Food and Drug Admin i s t r a t ion (FDA) to approve medica l t reatments for use. The F D A ' s process i s based on systemat ic , quant i ta t ive observa t iona l s tudies o f actual outcomes, and includes an ongo ing moni tor ing phase which updates safety and effect iveness informat ion after treatments have been approved and are in use by the med ica l c o m m u n i t y .

Securi ty t e chno logy deve lopmen t and select ion should be based on quant i ta t ive obse rva t iona l s tudies o f effect iveness , not on synthet ic a pr ior i assurance o f vu lne rab i l i ty avoidance . Probab i l i t i e s o f exp lora t ion mus t be balanced wi th consequences. ALEs (that is, obse rved outcomes) must rule, not the emot ion o f a good story and the fear, uncer ta in ty and doubt that cont inues to be the sel l ing p ropos i t ion for m o s t secur i ty technology.

!02

While assessment o f technical vulnerabilities and the likelihood of their exploitation should and will remain a part of information technology risk management, assessment must include the overall risk control process, including personnel, physical, and technical measures. It must be sensitive to the rate of change in each of these parameters.

A determined effort should be made to evaluate all kinds o f protection, detection, and response measures (both technical and non-technical) to quantify how each measure the affects annualized loss expectation arising from many specific k inds of risks.

The impartial body which carries out evaluations could be a government agency. (such as the US NCSC) or government- sponsored security laboratory (such as the CERT Coordinat ion Center), a commercial organization through a seal program, an industry consortium such as IT-ISAC, an insurers' consortium similar to Underwriters' Laboratories, a consumer organization similar to Consumers' Union, or a combination of some or all of the above.

Information risk management professionals should, as stated in the previous section, be professionally obligated to avoid the use of demonstrably ineffective treatments.

8.1 Tracking and Reporting Today, no equivalent of The Lancet or Journal of the American Medical Association exists to enable publication and review of information about the effectiveness of information r isk treatments, and information risk management professionals do not have training in technical writing or review of other practitioners' results. We note in passing that journals of this sort are useful to, and used by working practitioners (not j u s t academics) in some disciplines; for example, police laboratory personnel regularly publish in and read the Journal o f Forensic Science.

The effectiveness of information risk treatments will change over time as the technical environment and the r isk environment "in the wild" evolve. Information r isk management professionals should be required to report regularly to the evaluation body on the effectiveness of the treatments they "prescribe" to their "patients". The evaluation body should continually update its assessments of treatment effectiveness based on the information it receives, and should distribute these updates to the community of information r isk management professionals.

9. A WORD ABOUT ~ ETHICS OF RISK QUANTIFICATION

A review of an earlier draft of this paper questioned whether quantification of certain types of risks (particularly risks to human life and safety) in fmancial terms is ethical ly acceptable.

The first point to be made in this context is that systems which pose known or suspected risks to human life or safety should be treated using techniques for managing risk in safety-critical systems, even if they also require information security r isk treatment (see for example [Leve] or [Stor] for full treatments of risk in safety-critical systems). The authors do not claim that information security risk management techniques do, or should, protect against safety risks.

The second point to be made is that society must take risks i t considers unacceptable out of the realm of economic

justification by imposing mandatory control regimes. Serious safety risks should be controlled using a regime which is not voluntary and is not based on a cost/benefit analysis. I f a society concludes that a certain safety risk is sufficiently serious that controlling it is mandatory, that society should use legal and regulatory mechanisms to mandate control o f that risk.

At least in capitalist societies, any risk for which there is no legally required control regime will be controlled only to the extent that the cost of control can be economically justif ied. The economics of controlling risks can be distorted by competition. Risk-tolerant firms may gain temporary competitive advantage against risk-averse firms by spending less on control (especially for risks with low probability o f occurrence) as long as they are lucky and the risks do not cause them losses. The authors maintain that cost- just i fying risk controls can only be effective i f the risks can be quantified.

The third point which needs to be made is that accurate quantification of the costs of risks to human life and safety might in fact provide powerful incentives for control. Putt ing a price tag on a human life is certainly fraught with ethical dangers. On the other hand, i f NASA had had a realistic estimate of the probability that the Space Shuttle Challenger would be destroyed, and had also had an accurate estimate o f the financial and reputation costs of this event, there seems little doubt that the Challenger launch would have been delayed and the ship saved.

One argument against this point of view might be that the real cost of the loss of a life to the organization which causes the loss is not very great in some cases. Estimates of the total cost of the Union Carbide Bhopal plant to the Union Carbide corporation vary, but the direct cost of the legal settlement ($US 470 million) represents only about SUS 12,400 for each of the roughly 3800 people killed by the accident, and this does not include consideration of the more than 2700 people permanently disabled. Twelve thousand dollars for a human life is an uncomfortably low figure. Does this mean that quantifying this risk is ethically irresponsible? The authors think not - the fact that a life costs a major corporation only $12,000 looks to us like a call for reform of the l iabi l i ty system.

In summary, while the authors do not believe that every risk should be controlled using a monetary cost/benefit framework, we do believe that all risks should be quantified to the greatest extent possible, regardless of the anticipated control regime. We also believe that information security risks will be poor ly understood until we do a much better job of quantification o f economic losses. Finally, we believe that information security countermeasures will continue to be difficult to justify in voluntary control regimes until their effectiveness can be expressed as a quantifiable reduction of economic losses.

10. A C K N O W L E D G E M E N T S The authors are grateful to the anonymous reviewers, and specifically to the reviewer who called the issue of the ethics of quantification of losses to our attention.

The first author would like to acknowledge the support of the Open Group in providing an ongoing forum for his investigations into the topic of security and Risk Management.

103

11. R E F E R E N C E S [AS] Standards Australia, "AS/NZS 4360:1999 Risk

Management", 1999.

[CSI] Computer Security Institute ~md US FBI, "Computer Security Issues & Trends", C SI, 2000.

[AFM] Arbaugh, W., Fithen, W., and McHugh, J., "Windows of Vulnerability, .a Case Study Analysis", IEEE Computer, IEEE, Dece]mber, 2000.

[Basel] Bank for International Settlements, "The New Basel Capital Accord", Basel: Bank for International Settlements, 2001.

[Bcom] Comments on New !Basel Capital Accord, http://www.bis.org/bcbs/cacomments.hUn

[CERT] CERT, CERT Annual Reports, http ://www.cert.org/annual_rpts/index.html

[ECov] TechRisk.Law, "e-Cove-age", Cincinnati, OH: National Underwriter Company, 2000.

[ERisk] Lang, S., Davis, J., Jaye, D., Erwin, D., Mullamey, J., Clarke, L., and Loesch, M., "e-risk: Liabilities in a Wired ~'orld", Cincinnati, OH: National Underwriter Compemy, 2000.

[FIPS3 I] US Depa~h,.ent of Con~nerce/National Bureau of Standards, "Guidelines For Automatic Data Processing Physical Security and Risk Management", 1974.

[FIPS 191] US Department of Cmnmerce/National Institute of Standards and Technology, "'Guideline for the Analysis of Local Area Network Security", 1994.

[GAO] US General Accounting Office, "Information Security Risk Assessment: Practices of Leading Organizations", 1999.

[Har] Harrington, S., and Niehau~, G., "Risk Management and Insurance", Boston, Irwin/McGraw Hill, 1999.

[HPDG] Shannon, M., Wilson, B., and Stang, C. (eds.), "Health Professional's Drug Guide", Upper Saddle River, NJ, Prentice Hall, 2002.

[Koll] Koller, G., "Risk Assessment and Decision Making in Business and Industry", Boca Raton, Fla.: CRC Press, 1999.

[KBPS] Kolluru, R., Bartell, S., Pitblado, R., and Stricoff, S., "Risk Assessment and Management Handbook for Environmental, Health, and Safety Professionals", Boston: McGraw-Hill, 1996.

[Leve] Leveson, N., "Safeware: System Safety and Computers", Reading, Mass.: Addison-Wesley, 1995.

[Merl] Merck & Co., "Merck's 1899 Manual", New York, Merck & Co., 1899.

[Merl7] Beers, M., and Berkow, R. (eds.), "The Merck Manual of Diagnosis and Therapy", 17th ed., Whitehouse Station, N J, Merck Research Laboratories, 1999.

[NISTRMG] US National Institute of Standards and Technology, "Special Publication 800-30: Risk Management Guide" (Draft), 2001.

[OFA] Thomas, R. (ed.), "Old Farmer's Almanac", William Ware & Co., Boston, 1900.

[Pelt] Peltier, T., "Information Security Risk Analysis", Boca Raton, Fla: Auerbach Publications, 2001.

[Por] Porter, R., "The Greatest Benefit to Mankind", New York, W.W. Norton & Company, 1997.

[Shim] Shimpi, P., "Integrating Corporate Risk Management, New York, Texere, 1999.

[Stor] Storey, N., "Safety-Critical Computer Systems", Reading, Mass.: Addison-Wesley, 1996.

104