Critical Analysis.

1. Combating cyber risk in the supply chain

http://www.scmagazine.com/combating-cyber-risk-in-the-supply-chain/article/381050/

2. Module 3: Risk and Risk Management

Topics

I Risk Concepts

II Risk Management

III Information Systems Security Risk Management

I. Risk Concepts

The term risk has many different uses and meanings in society. On Wall Street or in the financial markets, investors talk about calculating or taking risks in order to make a profit. In everyday speech, we use the adjective risky to describe behaviors such as not wearing a seat belt or eating junk food. At work, we talk about managing risk to reduce on-the-job injuries or to avoid cost overruns or schedule delays. We can increase risk, decrease risk, manage risk, or avoid it. But, what exactly is risk?

The answer is: It depends. How we define and use the term risk is dependent upon context and perspective. In this section and throughout this course module, we will examine the concept of risk as it is used within the fields of cybersecurity and information security in business, government, and other types of organizations. Organizations are our context. Cybersecurity and information security are our perspective.

A. Risk

Risk is the uncertain outcome of an event that has not yet occurred. Or, said another way, a risk is the possibility that an event may occur that carries with it the potential for an organization to either benefit or suffer a loss or harm.

For example, the loss of a thumb drive is a possible future event that could be a source of risk to an organization. The thumb drive could be lost forever, or it could be found and returned. Each of these outcomes is uncertain since it is not possible to determine in advance whether or not a lost thumb drive would be found and returned to its owner.

A consequence is a potential outcome of a specific risk. Loss of confidentiality due to theft of data is an example of a consequence.

Every risk has a likelihood or probability of occurrence.

Each risk also has a payoff value. This payoff may be positive or negative and is associated with the consequence. Some consequences are good or beneficial while other consequences are bad or harmful. Payoff values are usually expressed in monetary terms and can require complex calculations involving multiple consequences for a single risk.

The term impact is used to refer to the change in the value of an asset that results from the occurrence of a specific risk. Impact can be positive or negative and is usually expressed in monetary terms. Impact can also be expressed in relative terms (low, medium, high).

A simple risk impact metric (see below) can be calculated using the likelihood of the event and the payoff if the event occurs.

RISK = Likelihood  ×  Payoff

Let’s see how the risk impact metric influences a decision.

How to Make a Decision Using a Risk Metric

Terry is trying to decide which version of a textbook to purchase. The textbook publisher offers a printed version of the textbook for $150. The electronic version of the same textbook costs $90 for a six-month subscription. (To keep things simple, the only option being considered in this example is purchasing a new copy.) A new subscription key must be purchased if Terry needs to have access for more than six months (i.e., if Terry does not complete the course in a single semester).

Terry estimates the likelihood or probability for not completing the course in one semester at 25 percent. The payoff value is the difference in cost between the print and electronic versions of the textbook. Using the risk metric shown above, we can calculate the likely cost of buying the electronic version of the book.

RISK	=	Likelihood  ×  Payoff
RISK	=	.25 × $60.00 = $15.00

The value of the risk metric represents the amount of money that is at risk if Terry purchases the electronic version of the book. By adding this amount to the purchase price, we can compare the likely cost of the electronic version against the actual cost of the printed version of the textbook.

Actual Cost of Print Version = $150.00

Likely Cost of Electronic Version = $90.00 + $15.00 = $105.00

Since the likely cost of the electronic version is less than the actual cost of the print version, Terry decides that the electronic version may be a cost-effective choice for the course textbook.

B. Opportunities and Threats

Opportunities are situations or events where the anticipated payoff of a risk is positive or beneficial. For example, our textbook buyer (discussed previously) has the opportunity to save money by purchasing a lower-cost, time-limited access for an electronic version of the textbook for a course.

Threats, in contrast, are situations or events that could result in negative payoffs or undesirable outcomes. Undesirable outcomes may be financial losses or, for information and information systems, the outcome may be a loss of confidentiality, integrity, availability, nonrepudiation, and so on.

For our textbook-buyer example, there is the risk of purchasing access to the electronic textbook for a course that is dropped or cancelled. If the publisher has a no-refunds policy for electronic textbooks, this risk would be a threat since the student could not obtain a refund for the purchase price of the textbook.

Think About It…

Does the anonymity of the Internet decrease risk to cyber criminals?

Law enforcement agencies estimate that one group of cyber criminals sold over $72 million in fake antivirus software over a period of three years (Department of Justice, 2011). The heart of this particular scam was the use of malware embedded in web advertisements to trick over 900,000 consumers into buying the fake product. This particular type of malware is called scareware. Consumers paid up to $129 each to download and run the fake antivirus program.

Prior to being arrested, these criminals believed that the anonymity of the Internet would allow them to conduct their scam with little to no risk of being identified and caught (Department of Justice, 2011). These criminals viewed the sale of fake software as an opportunity to make huge profits at low risk.

C. Vulnerabilities

A vulnerability is a weakness in an asset that can be exploited by a threat to cause harm or loss. For risks arising out of threats, the risk metric is expanded to incorporate a measure of the vulnerability of the asset to each specific threat. The risk metric becomes:

RISK (threat, asset) = PROBABILITY × VULNERABILITY × IMPACT

Where:

RISK (threat, asset) means the risk metric associated with a specific threat to a specific asset.

And where:

PROBABILITY is the likelihood of occurrence

VULNERABILITY is a measure of the asset’s susceptibility to the threat

IMPACT is a measure of loss or damage to the asset (based upon the asset’s value)

Let’s see how the risk metric influences an organization’s decision about security.

Making a Risk-based Decision Using Vulnerability Information

An organization has the resources to test only one additional patch for inclusion in next week’s patch update for its internal computer systems. But, two patches have just come in from software vendors. Each vendor has labeled its software patch as critical.

Patch #1 will close a software vulnerability that affects 80 percent of the organization’s computers. Successful attacks exploiting this vulnerability have had an estimated impact of $50,000 per occurrence in other organizations of a similar size. The vendor estimates that the probability of a successful attack within one month is 30 percent. What is the financial risk to the organization if it cannot push the patch out until next month?

RISK (threat, asset) = PROBABILITY x VULNERABILITY x IMPACT

RISK(1)	=	30% × 80% × $50,000
	=	.30 × .80 × $50,000
	=	$12,000

Patch #2 will close a software vulnerability that affects 30 percent of the organization’s computers. Successful attacks exploiting this vulnerability have had an estimated impact of $1,000,000 per occurrence in similar organizations. The probability of a successful attack within one month is estimated to be 2 percent. What is the financial risk if this patch cannot be pushed out until next month?

RISK(2)	=	2% × 30% × $1,000,000
	=	.02 × .30 × $1,000,000
	=	$6,000

The risk for delaying Patch #1 by one month is $12,000. This risk is much higher (100% higher) than the risk for delaying Patch #2 by one month.

Using this information, management can make a risk-based decision as to which patch to include and which patch to delay. Management should decide to include Patch #1 this month and delay Patch #2 until next month.

II. Risk Management

Risk management is an integral part of an organization’s governance structure . Figure 3.1 illustrates a generic risk management process that can be used to manage risk at the organization level. This process is described in general terms in ISO Standard 31000 and is used in NIST Special Publication 800-39 to describe the process of managing security risks associated with information and information systems (National Institute of Standards and Technology, 2011). This risk management process is focused upon identifying and managing risks to the organization as a whole. The four elements of this risk management process (frame, assess, respond, monitor) are discussed in the sections that follow.

Figure 3.1

Risk Management Process

Frame

Risk framing is a business process that uses organizational context (problem frame) to guide the identification and categorization of risks to assets. Risk framing categorizes risks according to the type of asset, source of the risk to that asset (threat), and the vulnerability of the asset to the threat. It is usually the first step in the risk management process.

Risk sources are divided into two categories: opportunities and threats. The opportunity category is primarily used to frame risks in project management risk analyses and financial analyses (investment planning). Security risks are usually expressed in terms of threats to assets and further categorized by the type of threat.

Risks may also be identified using information from published lists and databases of known threats and vulnerabilities for specific products (hardware and software). Authoritative vulnerability identification and description information can be obtained from NIST, the Department of Defense (Defense Information Systems Agency), the Department of Homeland Security (US-CERT), and the Mitre Corporation (a government contractor).

Assess

Risk assessment is a business process used to evaluate and rank the risks identified in the framing process. The output of the risk assessment process is a risk register containing entries for individual risks and their associated risk impact metrics (discussed in section I of this course module). Risk assessment may be quantitative or qualitative. Quantitative risk assessments use statistical techniques to analyze data from simulations, experiments, and threat models. Qualitative risk assessments use expert opinion and judgment. Both types of assessment may use historical information obtained from documents and reports.

Respond

Organizations use four types of risk response strategies:

· acceptance

· avoidance

· transfer

· mitigation

When a strategy is applied to a specific risk it is referred to as a risk treatment.

We will discuss each of the four types of risk response strategies below.

Acceptance has two forms. For opportunity-based risks, an organization accepts the risk in the expectation of a beneficial or profitable outcome. This form of acceptance usually involves a deliberate action (e.g., signature on a memorandum) that authorizes the acceptance of the risk. For threat-based risks, an organization accepts a risk when the costs of taking action to prevent harm exceed the expected costs of doing nothing. This form of acceptance may be either de facto (through no action) or de jure (formally approved or agreed to by an oversight group).

Avoidance occurs when an organization makes a deliberate decision to avoid the circumstances or situations in which a risk could arise. For example, after reviewing an opportunity to invest in a new security technology, a venture capitalist could determine that the potential payoff is too low when compared to other uses of the money and so decides to not invest in the security technology. Not making the investment is an avoidance strategy.

Transfer is accomplished by transferring responsibility for the outcome of the risk to another organization. Two common types of transfer strategies are insurance and outsourcing. Cyber insurance is purchased to protect an organization from financial losses resulting from cyber attacks. Outsourcing transfers financial responsibility for specific risks as part of a service-level agreement or other form of contract-for-services. Under US law, ultimate responsibility for harm or loss to information and information systems remains with the owners of those assets and cannot be transferred to an outside organization.

Mitigation is the most complex of the four risk management strategies. This strategy requires that organizations identify specific actions, processes, and technologies that can be used to lessen the impact of a risk. Some mitigation measures focus upon reducing vulnerabilities in assets (e.g., patching software) while others are used to lower the probability of occurrence (e.g., deploying antivirus software to detect and block malware before an infection occurs). Most security controls are intended as risk mitigation measures.

Did You Know?

Defense-in-depth is a risk mitigation strategy that uses layers of protective measures to reduce the likelihood that a cyber attack will be successful. Commonly used protective measures include:

· antivirus software

· content-filtering software

· encryption

· firewalls and intrusion detection systems

· honeypots (decoy systems and networks)

· strong authentication (e.g., two-factor with biometrics)

Monitor

Risk monitoring is used to track the implementation and operation of security controls as part of the organization’s risk management strategy. Continuous monitoring of information system risks can be accomplished using automated tools that test security controls for networks, hardware devices, and software applications. Audits and inspections are examples of intermittent risk monitoring. Both types of monitoring, continuous and intermittent, are used to examine and assess the overall effectiveness of the organization’s risk management activities.

III. Information Systems Security Risk Management

NIST Special Publication 800-37 defines a six-step, structured risk management process for individual information systems that is used by government agencies and contractors (National Institute of Standards and Technology, 2010). This framework is based upon the systems life-cycle and emphasizes the implementation of security controls (a type of risk response strategy) across all phases of the systems lifecycle. At each step in the framework, the results are compared to the organization’s overall risk management approach (as discussed in section II of this course module). The framework is illustrated in figure 3.2 and discussed in the sections that follow.

Figure 3.2

Risk Management Process for Information Systems Security

Categorize Information System

In this process step, a detailed description of the information system is prepared. This description includes a listing of the system’s owner, its purpose, the types and sensitivity of data that are processed by the system, a listing of the hardware and software components belonging to the system, and a description of the system’s interactions with other information systems.

For federal information systems, FIPS 199 requires a Security Category (SC) evaluation using the three FISMA objectives: confidentiality, integrity, and availability. The SC metric, which measures the impact on confidentiality, integrity, and availability, is evaluated for each type of information that the organization processes or handles.

Examples of information types include:

· public information (e.g., press release) published to an agency’s website

· medical records stored in a database

· non-public financial information (e.g., information collected as part of an investigation)

Impact is evaluated as:

· low (minimal impact)

· moderate (serious impact)

· high (grave impact)

· not applicable (does not apply to this information system)

The NIST guidelines for determining impact levels are shown in table 3.1.

Table 3.1

Evaluation Categories for Information Systems

(adapted from National Institute of Standards and Technology, 2004, p. 6)

SECURITY OBJECTIVE	POTENTIAL IMPACT
	LOW	MODERATE	HIGH
Confidentiality Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. [44 U.S.C., SEC. 3542]	The unauthorized disclosure of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.	The unauthorized disclosure of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.	The unauthorized disclosure of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Integrity Guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. [44 U.S.C., SEC. 3542]	The unauthorized modification or destruction of information could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.	The unauthorized modification or destruction of information could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.	The unauthorized modification or destruction of information could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Availability Ensuring timely and reliable access to and use of information. [44 U.S.C., SEC. 3542]	The disruption of access to or use of information or an information system could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals.	The disruption of access to or use of information or an information system could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.	The disruption of access to or use of information or an information system could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

 

Play This Game!

How good are you at evaluating impact levels of security objectives?

Play this game to see!

 

Select Security Controls

Security controls are selected from approved lists containing both mandatory and recommended controls. To save time and ensure consistency across multiple information systems, organizations usually decide in advance which types of information systems security controls will be approved for internal use.

Did You Know?

Federal law and government regulations are used to mandate specific types of security controls for information systems owned or operated on behalf of federal agencies. Laws and regulations are also used to require information systems security controls for certain regulated industries. For example, password-protected logins (mandatory access controls) are required in both the health care industry (for individually identifiable medical records) and financial services industry (for individually identifiable credit information).  

For federal information systems, approved lists of controls are found in NIST Special Publication 800-53 (National Institute of Standards and Technology, 2009). This publication lists 18 groupings of controls organized into three categories (operational, management, and technical). Examples of security controls are shown in table 3.2.

Table 3.2

Examples of Security Controls for Information Systems

Control Group	Control Category	Example
Access Control	Technical	Password controlled login for an information system.
Awareness and Training	Operational	Web-based training module to teach employees how to construct good passwords.
Audit and Accountability	Technical	Automatically generated audit logs showing user ID and IP address for each system login.
Security Assessment and Authorization	Management	System certification and accreditation process (C&A) resulting in a formal authority to operate (ATO) or authority to connect (ATC).
Configuration Management	Operational	Change control board that approves all requests for changes to approved system configurations.
System and Communications Protection	Technical	Hardware encryption for network transmissions of sensitive information.

Implement Controls

In the implementation step, selected controls are built into the information system’s components, put into practice in the operational environment, or applied to system management practices and procedures. Implementation examples include:

· using a formal approval process to control changes to information systems

· deployment of fingerprint readers for login access control

· publication of a monthly security awareness newsletter

Implementation of controls occurs during all phases of the systems development lifecycle. For more information, see Chapter 3 of NIST Special Publication 800-100 System Development Life Cycle (Bowen, Hash, & Wilson, 2006).

Assess Controls

The assessment step includes the use of reviews, inspections, and audits to determine whether or not the security controls have been properly implemented and are operating as intended. The overall goal of the assessment step is to evaluate the effectiveness of the implemented security controls. Organizations may schedule assessments on an event-driven basis (i.e., when specified milestones are met during system development), or on a calendar basis (annually, monthly, weekly, etc.). Detailed descriptions of how and when controls should be assessed are found in Chapter 3 of NIST Special Publication 800-100 System Development Life Cycle (Bowen et al., 2006).

Authorize IT Systems

System authorization is a formal decision process used to give permission for the operation of an information system. This step is used to ensure that security controls have been implemented in the information system and will operate as intended to protect the organization from unacceptable levels of risk. System authorization includes a review of the risks associated with the information system and the effectiveness of the security controls for those risks. System authorization also includes a review of all security documentation for the information system to ensure compliance with applicable security policies, processes, and procedures. If deficiencies are found, the authorizing official will usually require remedial actions to fix the identified problems before granting permission for the operation of the information system.

Authorization of IT systems is usually performed as part of an agency’s IT governance process. Governance processes are used to ensure that an agency is in compliance with legal and regulatory requirements for management of federal information resources. A detailed description of these requirements is found in Chapter 2 of NIST Special Publication 800-100 Information Security Governance (Bowen et al., 2006).

Monitor Security Controls

Monitoring of security controls is accomplished using both automated and manual methods. Automated tools can be used to test security controls for networks, hardware devices, and software applications. Audits and inspections are examples of manual methods of monitoring the implementation and operation of security controls. These may be scheduled on a regular basis (monthly, weekly, daily) or performed as needed—i.e., after a security incident has occurred.

During the monitoring phase of risk management, information system owners prepare and submit system security status reports to senior managers of their agency. These reports are reviewed and used to prepare agency level reports that are sent to the White House for inclusion in reports to Congress.

Some monitoring activities are performed by external organizations. The Government Accountability Office (GAO) publishes reports of its information security assessments and evaluations. These reports can be found on GAO’s website . The Congressional Research Service (CRS), at the request of members of Congress, also prepares analyses and evaluations of agency operations, including information systems security. These reports are not directly available from CRS but are sometimes archived in Government Document Repositories at university libraries or published to the Internet on agency websites.

References

Bowen, P., Hash, J., & Wilson, M. (2006). Information security handbook: A guide for managers (NIST Special Publication 800-100). Retrieved from http://csrc.nist.gov/publications/nistpubs/800-100/SP800-100-Mar07-2007.pdf

Organization for Economic Cooperation and Development. (2005). Corporate governance. Retrieved from http://stats.oecd.org/glossary/detail.asp?ID=6778

Department of Justice. (2011, June 22). Department of Justice disrupts international cyber crime rings distributing scareware [Press release]. Retrieved from http://www.fbi.gov/news/pressrel/press-releases/department-of-justice-disrupts-international-cybercrime-rings-distributing-scareware

National Institute of Standards and Technology. (2004, February). Standards for security categorization of federal information and information systems (FIPS 199). Gaithersburg, MD: Author. Retrieved from http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf

National Institute of Standards and Technology. (2009, August). Recommended security controls for federal information systems and organizations (NIST Special Publication 800-53 Revision 3). Gaithersburg, MD: Author. Retrieved from http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

National Institute of Standards and Technology. (2010, February). Guide for applying the risk management framework to federal information systems: A security life cycle approach (NIST Special Publication 800-37 Revision 1). Gaithersburg, MD: Author. Retrieved from http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

National Institute of Standards and Technology. (2011, March). Managing information security risk: Organization, mission, and information system view (NIST Special Publication 800-39). Gaithersburg, MD: Author. Retrieved from http://csrc.nist.gov/publications/nistpubs/800-39/SP800-39-final.pdf