management and info security

chapter9.pptx

Home >Information Systems homework help >management and info security

ITC358 ICT Management and Information Security

Chapter 9

Risk Management: Controlling Risk

Weakness is a better teacher than strength. Weakness must be learned to understand the obstacles that strength brushes aside. – Mason Cooley, U.S. aphorist

Objectives

Upon completion of this chapter, you should be able to:

Recognise and select from the risk mitigation strategy options to control risk

Evaluate risk controls and formulate a cost-benefit analysis using existing conceptual frameworks

Explain how to maintain and perpetuate risk controls

Describe the OCTAVE Method and other approaches to managing risk

Introduction

To keep up with the competition, organisations must design and create a safe environment in which business processes and procedures can function

This environment must maintain confidentiality and privacy and assure the integrity and availability of organisational data

These objectives are met via the application of the principles of risk management

Risk Control Strategies

An organisation must choose one of four basic strategies to control risks

Avoidance

Applying safeguards that (to) eliminate or reduce the remaining uncontrolled risks for the vulnerability

Transference (insurance)

Shifting the risk to other areas or to outside entities

Mitigation

Reducing the impact if the vulnerability is exploited

Acceptance

Understanding the consequences and accepting the risk without control or mitigation

Avoidance

The risk control strategy that attempts to prevent the exploitation of the vulnerability

Avoidance is accomplished through:

Application of policy

Application of training and education

Countering threats

Implementation of technical security controls and safeguards

Transference

The control approach that attempts to shift the risk to other assets, other processes, or other organisations

May be accomplished by rethinking how services are offered

Revising deployment models

Outsourcing to other organisations

Purchasing insurance

Implementing service contracts with providers

Mitigation

The control approach that attempts to reduce the damage caused by the exploitation of vulnerability

Using planning and preparation

Depends upon the ability to detect and respond to an attack as quickly as possible

Types of mitigation plans

Disaster recovery plan (DRP)

Incident response plan (IRP)

Business continuity plan (BCP)

Mitigation (cont’d.)

Table 9-1 Summaries of mitigation plans

Source: Course Technology/Cengage Learning

Acceptance

The choice to do nothing to protect an information asset

To accept the loss when it occurs

This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure

Acceptance (cont.)

Before using the acceptance strategy, the organisation must:

Determine the level of risk to the information asset

Assess the probability of attack and the likelihood of a successful exploitation of a vulnerability

Approximate the ARO (rate of occurrence) of the exploit

Estimate the potential loss from attacks

Perform a thorough cost benefit analysis

Acceptance (cont.)

Before using the acceptance strategy, the organisation must: (cont’d.)

Evaluate controls using each appropriate type of feasibility

Decide that the particular asset did not justify the cost of protection

Managing Risk

Risk appetite (also known as risk tolerance)

The quantity and nature of risk that organisations are willing to accept

As they evaluate the trade-offs between perfect security and unlimited accessibility

The reasoned approach to risk is one that balances the expense (in terms of finance and the usability of information assets) against the possible losses if exploited

Managing Risk (cont’d.)

Residual risk

When vulnerabilities have been controlled as much as possible, there is often remaining risk that has not been completely removed, shifted, or planned for

Residual Risk is a combined function of:

Threats, vulnerabilities and assets, less the effects of the safeguards in place

Managing Risk (cont’d.)

The goal of information security is not to bring residual risk to zero

Bring it in line with an organisation’s risk appetite

If decision makers have been informed of uncontrolled risks and the proper authority groups within the communities of interest decide to leave residual risk in place, then the information security program has accomplished its primary goal

Once a control strategy has been selected and implemented:

The effectiveness of controls should be monitored and measured on an ongoing basis

To determine its effectiveness and the accuracy of the estimate of the residual risk

Managing Risk (cont’d.)

Source: Course Technology/Cengage Learning

Figure 9-1 Residual risk

Risk control involves selecting one of the four risk control strategies

For the vulnerabilities present

If the loss is within the range of losses the organisation can absorb, or if the attacker’s gain is less than expected costs of the attack, the organisation may choose to accept the risk

Otherwise, one of the other control strategies will have to be selected

Managing Risk (cont’d.)

Source: Course Technology/Cengage Learning

Figure 9-2 Risk-handling action points

Guidelines for risk control strategy selection

When a vulnerability exists

Implement security controls to reduce the likelihood of a vulnerability being exercised

When a vulnerability can be exploited

Apply layered controls to minimise the risk or prevent occurrence

When the attacker’s potential gain is greater than the costs of attack

Apply technical or managerial controls to increase the attacker’s cost, or reduce his gain

When potential loss is substantial

Apply design controls to limit the extent of the attack, thereby reducing the potential for loss

Managing Risk (cont’d.)

Source: Course Technology/Cengage Learning

Figure 9-3 Risk control cycle

Feasibility and Cost-Benefit Analysis

Before deciding on the strategy for a specific vulnerability

All readily accessible information about the consequences of the vulnerability must be explored

Ask “what are the advantages of implementing a control as opposed to the disadvantages of implementing the control?”

There are a number of ways to determine the advantage or disadvantage of a specific control

The primary means are based on the value of the information assets that it is designed to protect

Cost-Benefit Analysis

Economic feasibility

The criterion most commonly used when evaluating a project that implements information security controls and safeguards

Begin a cost-benefit analysis by:

Evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised

This decision-making process is called

Cost-benefit analysis or economic feasibility study

Cost-Benefit Analysis (cont’d.)

It is difficult to determine the value of information

It is also difficult to determine the cost of safeguarding it

Factors that affect the cost of a safeguard

Cost of development or acquisition of hardware, software, and services

Training fees

Cost of implementation

Service and maintenance costs

Cost-Benefit Analysis (cont’d.)

Benefit

The value to the organisation of using controls to prevent losses associated with a specific vulnerability

Usually determined by valuing the information assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset

This is expressed as the annualised loss expectancy (ALE)

Cost-Benefit Analysis (cont’d.)

Asset valuation

The process of assigning financial value or worth to each information asset

The value of information differs within and between organisations

Based on the characteristics of information and the perceived value of that information

Involves estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against loss and litigation

Cost-Benefit Analysis (cont’d.)

Asset valuation components

Value retained from the cost of creating the information asset

Value retained from past maintenance of the information asset

Value implied by the cost of replacing the information

Value from providing the information

Value acquired from the cost of protecting the information

Cost-Benefit Analysis (cont’d.)

Asset valuation components (cont’d.)

Value to owners

Value of intellectual property

Value to adversaries

Loss of productivity while the information assets are unavailable

Loss of revenue while information assets are unavailable

Cost-Benefit Analysis (cont’d.)

An organisation must be able to place a dollar value on each information asset it owns, based on:

How much did it cost to create or acquire?

How much would it cost to recreate or recover?

How much does it cost to maintain?

How much is it worth to the organisation?

How much is it worth to the competition?

Cost-Benefit Analysis (cont’d.)

Potential loss is that which could occur from the exploitation of vulnerability or a threat occurrence

Ask these questions:

What loss could occur, and what financial impact would it have?

What would it cost to recover from the attack, in addition to the financial impact of damage?

What is the single loss expectancy for each risk?

A single loss expectancy (SLE)

The calculation of the value associated with the most likely loss from an attack

SLE is based on the value of the asset and the expected percentage of loss that would occur from a particular attack

SLE = asset value (AV) x exposure factor (EF)

Where EF is the percentage loss that would occur from a given vulnerability being exploited

This information is usually estimated

Cost-Benefit Analysis (cont’d.)

In most cases, the probability of a threat occurring is the probability of loss from an attack within a given time frame

This value is commonly referred to as the annualised rate of occurrence (ARO)

ALE = SLE * ARO

Cost-Benefit Analysis (cont’d.)

CBA determines whether or not a control alternative is worth its associated cost

CBAs may be calculated before a control or safeguard is implemented

To determine if the control is worth implementing

Or calculated after controls have been implemented and have been functioning for a time

Cost-Benefit Analysis (cont’d.)

Cost-benefit analysis formula

CBA = ALE(prior) – ALE(post) – ACS

ALE (prior to control) is the annualised loss expectancy of the risk before the implementation of the control

ALE (post-control) is the ALE examined after the control has been in place for a period of time

ACS is the annual cost of the safeguard

Other Methods of Establishing Feasibility

Organisational feasibility analysis

Examines how well the proposed information security alternatives will contribute to the operation of an organisation

Operational feasibility

Addresses user and management acceptance and support

Addresses the overall requirements of the organisation’s stakeholders

Technical feasibility

Examines whether or not the organisation has or can acquire the technology to implement and support the alternatives

Political feasibility

Defines what can and cannot occur based on the consensus and relationships between the communities of interest

Alternatives to Feasibility Analysis

Benchmarking

Due care and due diligence

Best business practices

Gold standard

Government recommendations

Baseline

Recommended Risk Control Practices

Organisations typically look for a more straightforward method of implementing controls

This preference has prompted an ongoing search for ways to design security architectures that go beyond the direct application of specific controls for specific information asset vulnerability

Qualitative and Hybrid Measures

Quantitative assessment

Performs asset valuation with actual values or estimates

May be difficult to assign specific values

Qualitative assessment

Use scales instead of specific estimates

Hybrid assessment

Tries to improve upon the ambiguity of qualitative measures without using an estimating process

A Single Source Approach to Risk Management

The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Method

Defines the essential components of a comprehensive, systematic, context-driven, self-directed information security risk evaluation

Allows an organisation to make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets

The operational or business units and the IT department work together to address the information security needs of the organisation

The OCTAVE Methods

Three variations of the OCTAVE method

The original OCTAVE method, (forms the basis for the OCTAVE body of knowledge)

Was designed for larger organisations with 300 or more users

OCTAVE-S

For smaller organisations of about 100 users

OCTAVE-Allegro

A streamlined approach for information security assessment and assurance

For more information: www.cert.org/octave/

Microsoft Risk Management Approach

Microsoft Corporation also promotes a risk management approach

Four phases in the Microsoft InfoSec risk management process:

Assessing risk

Conducting decision support

Implementing controls

Measuring program effectiveness

Microsoft Risk Management Approach (cont’d.)

Assessing Risk: Identification and prioritisation of risks facing the organisation

Plan data gathering – discuss keys to success and preparation guidance

Gather risk data – outline the data collection process and analysis

Prioritise risks – outline prescriptive steps to qualify and quantify risks

Microsoft Risk Management Approach (cont’d.)

Conducting Decision Support: Identify and evaluate available controls

Define functional requirements – create the necessary requirements to mitigate risks

Select possible control solutions – outline approach to identify mitigation solutions

Review solution – evaluate proposed controls against functional requirements

Microsoft Risk Management Approach (cont’d.)

Identify and evaluate available controls (cont’d.)

Estimate risk reduction – endeavor to understand reduced exposure or probability of risks

Estimate solution cost – evaluate direct and indirect costs associated with mitigation solutions

Select mitigation strategy – complete cost-benefit analysis to identify the most cost-effective mitigation solution

Implementing controls: deployment and operation of the controls selected from the cost-benefit analyses and other mitigating factors from the previous step

Seek holistic approach – incorporate people, process, and technology in mitigation solution

Organise by defense-in-depth – arrange mitigation solutions across the business

Microsoft Risk Management Approach (cont’d.)

Measuring program effectiveness: ongoing assessment of the effectiveness of the risk management program

Develop risk scoreboard – understand risk posture and progress

Measure program effectiveness – evaluate the risk management program for opportunities to improve

Figure A-1 Security Risk Management Guide

Microsoft Risk Management Approach (cont’d.)

Source: Course Technology/Cengage Learning

Microsoft Risk Management Approach (cont’d.)

Additional information is available at:

www.microsoft.com/technet/security/topics/complianceandpolicies/secrisk/default.mspx

FAIR

The Factor Analysis of Information Risk (FAIR) framework includes:

A taxonomy for information risk

Standard nomenclature for information risk terms

A framework for establishing data collection criteria

Measurement scales for risk factors

A computational engine for calculating risk

FAIR (cont’d.)

The Factor Analysis of Information Risk (FAIR) framework includes: (cont’d.)

A modeling construct for analysing complex risk scenarios

See http://fairwiki.riskmanagementinsight.com

FAIR (cont’d.)

Basic FAIR analysis is comprised of ten steps in four stages

Stage 1 - Identify scenario components

1. Identify the asset at risk

2. Identify the threat community under consideration

Stage 2 - Evaluate loss event frequency

3. Estimate the probable threat event frequency

4. Estimate the threat capability (TCap)

FAIR (cont’d.)

Stage 2 - Evaluate loss event frequency (cont’d.)

5. Estimate Control strength (CS)

6. Derive Vulnerability (Vuln)

7. Derive Loss Event Frequency (LEF)

Stage 3 - Evaluate probable loss magnitude (PLM)

8. Estimate worst-case loss

9. Estimate probable loss

FAIR (cont’d.)

Stage 4 - Derive and articulate Risk

10. Derive and articulate Risk

Unlike other risk management frameworks, FAIR relies on the qualitative assessment of many risk components using scales with value ranges, for example very high to very low

FAIR (cont’d.)

Figure 9-4 Factor analysis of information risk (FAIR)

Source: Course Technology/Cengage Learning (Based on concepts from Jack A. Jones)

ISO 27005 Standard for Information Security Risk Management

The ISO 27000 series includes a standard for the performance of Risk Management

ISO 27005

See http://www.27000.org/iso-27005.htm

ISO 27005 Standard for Information Security Risk Management (cont’d.)

The 27005 document includes a five-stage risk management methodology

Information security risk assessment (ISRA)

Information security risk treatment

Information security risk acceptance

Information security risk communication

Information security risk monitoring and review

Other Methods

Figure 9-5 ENISA ranking of risk management methods

Source: Course Technology/Cengage Learning

Summary

Introduction

Risk control strategies

Risk control strategy selection

Categories of controls

Feasibility studies and cost-benefit analysis

Risk management discussion points

Recommended risk control practices

The OCTAVE method

Summary (cont’d.)

The Microsoft risk management approach

FAIR

ISO 27005 Standard for Information Risk Management