logo image

Chapter 4: Risk Management

Risk management
is the process of identifying and controlling risks facing an organization
Risk management involves three major undertaking:
Risk identification
Risk assessment
Risk control
Components of Risk Management
Risk identification: Identify and Inventory assets, Classify and prioritize assets, and Identify and prioritize threats.

Risk assessment: Identify vulnerabilities between assets and threats, and Identify and quantify asset exposure.

Risk control: Select strategy, justify controls, and Implement and monitor controls

Risk Identification
*A risk management strategy calls on us to “know ourselves” by identifying, classifying, and prioritizing the organization’s information assets.
*A threat assessment process identifies and quantifies the risks facing each asset
System Components of risk identification
1. People:
*Employees- Trusted employee
*Non employees- Other staff
2. Procedures:
*IT and business standard procedures
*IT and business sensitive procedures
3. Data:
* Information- Transmission, Processing, and Storage.
4. Software:: Applications, OS, and security components.
*system devices and peripherals-
*Networking components: Intranet components, Internet or DMZ components
Risk Identification section
Risk Identification process-
1. Plan and Organize the Process
* First step in the Risk Identification process is to follow your project management principles
* Begin by organizing a team with representation across all affected groups
* The process must then be planned out
–Periodic deliverables
—Presentations to management
*Tasks laid out, assignments made and timetables discussed
Risk Identification process-
step one through step six
1. Plan and organize the process
2. Categorize system components
3. Inventory and categorize assets
4. Classify and prioritize assets
5. Identify and prioritize threats
6. Specify asset vulnerabilities
Risk Identification section:
Asset Identification and Inventory
*Iterative process; begins with identification of assets, including all elements of an organization’s system (people, procedures, data and information, software, hardware, networking)?
*Assets are then classified and categorized
Risk Identification section:
People, Procedures, and Data Asset Identification
*Human resources, documentation, and data information assets are more difficult to identify
*Important asset attributes:
-People: position name/number/ID; supervisor; security clearance level; special skills
-Procedures: description; intended purpose; what elements it is tied to; storage location for reference; storage location for update
-Data: classification; owner/creator/ manager; data structure size; data structure used; online/offline; location; backup procedures employed
Risk Identification section:
Hardware, Software, and Network Asset Identification
*What information attributes to track depends on:
–Needs of organization/risk management efforts
–*Preferences/needs of the security and information technology communities

*Asset attributes to be considered are: name; IP address; MAC address; element type; serial number; manufacturer name; model/part number; software version; physical or logical location; controlling entity

*Automated tools can identify system elements for hardware, software, and network components

Risk Identification section:
Data Classification and Management
*Variety of classification schemes used by corporate and military organizations
Information owners responsible for classifying their information assets – reviewed periodically
*Most organizations do not need detailed level of classification used by military or federal agencies; however, organizations may need to classify data to provide protection
*Security clearance structure
–Each data user assigned a single level of authorization indicating classification level
–Before accessing specific set of data, employee must meet need-to-know requirement

( Data Classification and Management
A variety of classification schemes are used by corporate and military organizations.
Information owners are responsible for classifying the information assets for which they are responsible.
At least once a year, information owners must review information classifications to ensure the information is still classified correctly and the appropriate access controls are in place.
The U.S. Military Classification Scheme has a more complex categorization system than required by most corporations. For most information, the military uses a five-level classification scheme: Unclassified, Sensitive But Unclassified (i.e., For Official Use Only), Confidential, Secret, and Top Secret.
Most organizations do not need the detailed level of classification used by the military or federal agencies. A simple scheme will allow the organization to protect its sensitive information, such as: Public, For official use only, Sensitive, Classified. )

Risk Identification section:
Classifying and Prioritizing Information Assets
*Many organizations have data classification schemes (e.g., confidential, internal, public data)?
*Classification of components must be specific to allow determination of priority levels
*Categories must be comprehensive and mutually exclusive
Risk Identification section:
Information Asset Valuation
*Questions help develop criteria for asset valuation
* Which information asset:
–Is most critical to organization’s success?
–Generates the most revenue/profitability?
—Would be most expensive to replace or protect?
–Would be the most embarrassing or cause greatest liability if revealed?

*Information asset prioritization
—Create weighting for each category based on the answers to questions
—Calculate relative importance of each asset using weighted factor analysis
—List the assets in order of importance using a weighted factor analysis worksheet

Risk Identification section:
Identifying and Prioritizing Threats
*Realistic threats need investigation; unimportant threats are set aside
*Threat assessment:
—Which threats present danger to assets?
—Which threats represent the most danger to information?
—How much would it cost to recover from attack?
—Which threat requires greatest expenditure to prevent?

(Threats to Information Security)

Risk Identification section:
Vulnerability Identification
*Specific avenues threat agents can exploit to attack an information asset are called vulnerabilities
*Examine how each threat could be perpetrated and list organization’s assets and vulnerabilities
* Process works best when people with diverse backgrounds within organization work iteratively in a series of brainstorming sessions
* At end of risk identification process, list of assets and their vulnerabilities is achieved
Components of Risk Management
Risk Assessment
*Risk assessment evaluates the relative risk for each vulnerability

*Assigns a risk rating or score to each information asset

*The goal at this point: create a method for evaluating the relative risk of each listed vulnerability

Major Stages of Risk Assessment
1. Assign value to attack on assets
2. Assess likelihood of attack on vulnerabilities
3. Calculate relative risk factor for assets
4. Review possible controls
5. Document findings
Risk Assessment section:
*The probability that a specific vulnerability will be the object of a successful attack
*Assign numeric value: number between 0.1 (low) and 1.0 (high), or a number between 1 and 100
Zero not used since vulnerabilities with zero likelihood are removed from asset/vulnerability list
*Use selected rating model consistently
*Use external references for values that have been reviewed/adjusted for your circumstances
Risk Assessment section:
Risk Identification Estimate Factors
Risk is
The likelihood of the occurrence of a vulnerability
Multiplied by
The value of the information asset (or the impact)
The percentage of risk mitigated by current controls
The uncertainty of current knowledge of the vulnerability
Risk Assessment section:
Risk Determination Example-
Asset A has a value of 50 and one vulnerability, which has a likelihood of 1.0 with no current controls. Your assumptions and data are 90% accurate.
Asset B has a value of 100 and has two vulnerabilities: vulnerability #2 has a likelihood of 0.5 with a current control that addresses 50% of its risk; vulnerability # 3 has a likelihood of 0.1 with no current controls. Your assumptions and data are 80% accurate.
The resulting ranked list of risk ratings for the three vulnerabilities is as follows:
Asset A: Vulnerability 1 rated as 55 = (50 × 1.0) – ((50 × 1.0) × 0%) + ((50 × 1.0) × 10%)

Asset B: Vulnerability 2 rated as 35 = (100 × 0.5) – ((100 × 0.5) × 50%) + ((100 × 0.5) × 20%)
Asset B: Vulnerability 3 rated as 12 = (100 × 0.1) – ((100 × 0.1) × 0%) + ((100 × 0.1) × 20%)

Risk assessment section:
Identify Possible Controls
*For each threat and associated vulnerabilities that have residual risk, create preliminary list of control ideas
*Residual risk is risk that remains to information asset even after existing control has been applied
*There are three general categories of controls:
1. Policies
2. Programs
3. Technologies
Risk assessment section:
Documenting the Results of Risk Assessment
*Final summary comprised in ranked vulnerability risk worksheet
*Worksheet details asset, asset impact, vulnerability, vulnerability likelihood, and risk-rating factor
*Ranked vulnerability risk worksheet is initial working document for next step in risk management process: assessing and controlling risk
Risk control section:

Risk Control Strategies-

*Once ranked vulnerability risk worksheet complete, must choose one of five strategies to control each risk:
2. Transfer
3. Mitigate
4. Accept
5. Terminate
Risk control section:
*Attempts to prevent exploitation of the vulnerability
*Preferred approach
*Accomplished through countering threats, removing asset vulnerabilities, limiting asset access, and adding protective safeguards
*Three common methods of risk avoidance:
1. Application of policy
2. Training and education
3. Applying technology
Risk control section:
*Control approach that attempts to shift risk to other assets, processes, or organizations

*f lacking, organization should hire individuals/firms that provide security management and administration expertise

*Organization may then transfer risk associated with management of complex systems to another organization experienced in dealing with those risks

Risk control section:
*Attempts to reduce impact of vulnerability exploitation through planning and preparation
Approach includes three types of plans
Incident response plan (IRP): define the actions to take while incident is in progress

*Disaster recovery plan (DRP): most common mitigation procedure

* Business continuity plan (BCP): encompasses continuation of business activities if catastrophic event occurs

Risk control section:
*Doing nothing to protect a vulnerability and accepting the outcome of its exploitation
*Valid only when the particular function, service, information, or asset does not justify cost of protection
Risk control section:
*Directs the organization to avoid those business activities that introduce uncontrollable risks
*May seek an alternate mechanism to meet customer needs
Selecting a Risk Control Strategy
*Level of threat and value of asset play major role in selection of strategy
*Rules of thumb on strategy selection can be applied:
–When a vulnerability exists
–When a vulnerability can be exploited
—When attacker’s cost is less than potential gain
–When potential loss is substantial
Risk control section:
Feasibility Studies – Cost Benefit Analysis (CBA)?
*Cost Benefit Analysis (CBA)?
The approach most commonly considered for a project of information security controls and safeguards is the economic feasibility of implementation.
An organization begins by evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised by the specific vulnerability.
It is only common sense that an organization should not spend more to protect an asset than it is worth.
The formal process to document this is called a cost benefit analysis or an economic feasibility study.

*CBA: Factors
–Some of the items that impact the cost of a control or safeguard include:
–Cost of development or acquisition
–Training fees
–Cost of implementation
–Service costs
–Cost of maintenance

ROSI: Risk Assessment TIPS
Get a hold on what you have
Calculate Conservatively
If told probability of attack is 10-20% – CHOOSE 20%
If told the cost of an attack is between $50K – $100K – CHOOSE $100K
Know your audience – what Return On Security Investment (ROSI) is acceptable?
Do the MATH !
Evaluation, Assessment, and Maintenance of Risk Controls
*Selection and implementation of control strategy is not end of process
*Strategy and accompanying controls must be monitored/reevaluated on ongoing basis to determine effectiveness and to calculate more accurately the estimated residual risk
*Process continues as long as organization continues to function
Quantitative versus Qualitative Risk Control Practices
*Performing the previous steps using actual values or estimates is known as quantitative assessment
*Possible to complete steps using evaluation process based on characteristics using nonnumerical measures; called qualitative assessment
*Utilizing scales rather than specific estimates relieves organization from difficulty of determining exact values
Benchmarking and Best Practices
*An alternative approach to risk management
*Benchmarking: process of seeking out and studying practices in other organizations that one’s own organization desires to duplicate
*One of two measures typically used to compare practices:
–Metrics-based measures
–Process-based measures
*Standard of due care: when adopting levels of security for a legal defense, organization shows it has done what any prudent organization would do in similar circumstances
*Due diligence: demonstration that organization is diligent in ensuring that implemented standards continue to provide required level of protection
*Failure to support standard of due care or due diligence can leave organization open to legal liability

–Analysis of measures against established standards
–In information security, baselining is comparison of security activities and events against an organization’s future performance
–Useful during baselining to have a guide to the overall process

Recommended Risk Control Practices
Convince budget authorities to spend up to value of asset to protect from identified threat
Final control choice may be balance of controls providing greatest value to as many asset-threat pairs as possible
Organizations looking to implement controls that don’t involve such complex, inexact, and dynamic calculations

Need essay sample on "Chapter 4: Risk Management"? We will write a custom essay sample specifically for you for only $ 13.90/page

Can’t wait to take that assignment burden offyour shoulders?

Let us know what it is and we will show you how it can be done!
Sorry, but copying text is forbidden on this website. If you need this or any other sample, please register

Already on Businessays? Login here

No, thanks. I prefer suffering on my own
Sorry, but copying text is forbidden on this website. If you need this or any other sample register now and get a free access to all papers, carefully proofread and edited by our experts.
Sign in / Sign up
No, thanks. I prefer suffering on my own
Not quite the topic you need?
We would be happy to write it
Join and witness the magic
Service Open At All Times
Complete Buyer Protection
Plagiarism-Free Writing

Emily from Businessays

Hi there, would you like to get such a paper? How about receiving a customized one? Check it out https://goo.gl/chNgQy

We use cookies to give you the best experience possible. By continuing we’ll assume you’re on board with our cookie policy