04. Risk Assessment Analysis Flashcards
Risk Assessment
A process intended to discover and identify threats that, if realised, could resul tin some unwanted event or incident
Risk Assessment
144
Risk Assessment
2 principle portions of risk assessment
- Vulnerability identification
- Threat identification
145
Threat Identification
Defined as an event that, if realised, would bring harm to an asset and the organisation
Threat
- A threat is not a vulnerability, it is the actual action that would cause harm
- A threat actor is the person carrying out the action
- A threat is not an actual weakness, this is the vulnerability
145
Threat identification
Threats are typically classied in 3 ways
- Internal or external
- Intentional or unintentional
- Human-made or natural
145
Internal Threats
A wide range of events can take place that constitute internal threats
Well-Meaning Personnell making errors…:
1. In judgement
2. In haste
3. Because of insufficient knowledge or training
A disgruntled personnel…:
1. Being purposfully negligent
2. Bringing harm to an asset
Also..:
1. Threat actor acting on behalf of a forgien party posing as an internal employee
2. A trusted individual in a trusted third party doing any of the above
External Threats
Threats that originate outside of the organisation can unclude both deliberate and accidental actions. Threats can be…
Human made or associated with naturally occurring events
148
Advanced Persistent Threats
The advanced persistent threat…
- Pursues its objectives repeatedly over an extended period of time
- Adapts to defenders efforst to resist it
- Is determined to maintain the levl of interaction needed to execute its objectives
149
Emerging Threats
Emerging threats will always represents the..
cutting edge of attack techniques and will be difficult to detect
150
Emerging Threats
Security managers need to understand that attack techniques will..
Continuously improve their ability to evade detection
150
Risk Identification
Several considerations are applied in th identification of each risk…
- Threats
- Threat actors
- Vulnerabilities
- Asset Value
- Impact
151
Risk Identification
Impact is considered separately from…
Asset Value
Some threat scenarios have minimal correlation with asset value but relate instead to reputation damage
151
Risk Likelihood and IMpact
Risk = Threats x Vulnerabilities
Risk = Threats x Vulnerabilities x Asset Value
Risk = Threats x Vulnerabilities x Probabilities
151
Likelihood
Likelihood of a serious security incident has less to do with the technical details and more to do with the…
thought process of an adversary
152
Likelihood
Considerations related to risk likelihood include..
- Hygiene
- Visibility
- Velocity
- Motivation
- Skill
- Organisations that do a poor job in areas such as vulnerability management or patching are likely to suffer incidents more than an organisation that does a good job
- How visibility the organisation is within the public eye, its standing
- Relates to timing of threat scenarios - is there any warning or foreknowledge
- Understand the drivers that motivate an adversary to attack an organisation
- If higher skills are required, this doesnt mean an attack is less likely, but the scope of who and why i.e. motivation, comes into play.
152
Impact
The actual or expected result of some action, such as a threat or disaster, being realised
Impact
152
Impact
If a risk manager fails to understand the impact of different scenarios, they are unable to determine..
the level of importance and urgency for risk mitigation from one threat to another
152
Impact
Used to identify the most critical business processes, together with their supporting IT systems and dependencies
Business Impact Analysis
(BIA)
153
Impact
The value that a BIA brings to a risk assessment is the understanding of…
which business processes and IT systems are the most important to the organisation
153
Gathering information
A security manager needs to gather information to ensure that the risk analysis/assessment are valuable and complete. Sources include…
Interviews with:
1. Process owners
2. Application developers
3. Security personnel
4. Security experts
As well as..
1. Analysis of incidents from other organisations
2. Prior risk assessments
154
Qualitative Risk Analysis
The process to understand each risk relative to other risks so that higher risks can be distinguished from lower risks - achieved by way of example of assigning levels such as high, medium, or low
Qualitative Risk Analysis
The process of applying simple qualities to the risk i.e. its high or medium or low
154
Semiquantitative Risk Analysis
A process by which a simple value, by way of example, can be applied to a risk by multiplying the impact by probability
Semi-quantitative Analysis
- This does not calculate financial values but takes the simple qualtitative metrics and uses them to provide some form of quantitative analysis
- Where a score is higher, this does not mean it is more likely to happen, it is just a value that should reflect something as potentially being a higher priority as the risk is larger than the other
154
Quantitiative Risk Analysis
A process in which risk managers attempt to determine teh actual costs and probabilities of events
Quantitative Risk Analysis
Quantitiative Risk Analysis
2 aspects of quantitative risk analysis that provide to be a challenge
- Event probability
- Event cost
- Some factors of probability factors are hard to quantify
- Incidents can be complex and is therefore hard to put any exact cost on a given scenario
155
Quantitiative Risk Analysis
Standard quantitative risk analysis involves the development of several figures
Asset Value (AV)
Typically the assets replacement value
Exposure Factor (EF)
Financial loss that results from the realisation of a threat expressed as a percentage of the assets total value
Single Loss Expectancy (SLE)
The financial loss when a threat scenario occurs one time
SLE = AV x EF
Annualised Rate of Occurrence (ARO)
Estimate of the number of times that a threat will occur per year
1 change in 50 years = 1/50 = 0.02%
Annualised Loss Expectancy (ALE)
Expected annualised loss of asset value due to threat realisation
ALE = SLE x ARO
155
Quantitiative Risk Analysis
Sources of infomration that may be used for calculating estimates for an ARO
- History of event losses in the organisation
- History of similar losses in other organisations
- History of dissimilar losses
- Best estimates based on available data
156
OCTAVE
OCTAVE
Operationally Critical Threat, Asset, and Vulnerability Evaluation
156
OCTAVE
OCTAVE Allegro methodology uses 8 steps
Step 1: Establish risk measurement criteria
Step 2: Develop an information asset profile
Step 3: Identify information asset containers
Step 4: Identify areas of concern
Step 5: Identify threat scenarios
Step 6: Identify risks
Step 7: Analyse risks
Step 8: Select mitigation approach
- Organisation identifies the most important impact areas i.e. reputation/customer confidence, financial, productivity etc..
- Organisation identifies in-scope information assets and develops profiles
- Organisation identifies all internal and external information systems
- Identifies threats that could cause harm - brainstorming activities
- Threat tree may be developed to expand on step 4
- Consequences of each threat identified
- Simple quantitative measurements used
- Risks with higher scores analysed to determine risk mitigation/reduction methods
156
Bow-Tie Analysis
A risk analysis method that uses diagrams to analys and explain relationship between risk elements and events to impacts
Bow-Tie Analysis
Risk Analysis Methodologies
5 other more complex methods of risk analysis
Delphi Method
* Questionnairs 1-2 rounds
* Experts converge on most important risks and mitigation strategies
Bayesian Analysis
* Uses data distribution and statistical inference to determine risk proability
Fault Tree Analysis (FTA)
* Diagram all consequences for a given event scenario
* Starts with one scenario, forwards in time with all possible consequences considered
Event Tree Analysis (ETA)
* A logic modeling technique
* Analyses success and failure outcomes of a given event scenario
Monte Carlo Analysis
* Simulation based, computational algorithms
157
Risk Ownership
Organisations need to assign individual risks to individual people. Typically, this would be…
Middle to Upper Management Business Leaders
These leaders should have ownership of controls, budget, staff within their domain of business operations
158
Controls
Measures put in place to ensure a desired outcome and a commong outcome of risk treatment measures
Controls
159
Risk Register
A risk register serves as the focal point of evidence that an organisation is attempting to manage risk and can be stored in…
- Spreadsheet
- Database
- Governance Risk Compliance (GRC) tool
159
Risk Register
Potential sources of information that could lead to the creation of a risk register entry
- Risk assessment
- Vulnerability assessment
- Internal audit
- Security incident
- Threat intelligence
- Industry developement
- New laws and regulations
- Consultants
161
Strategic vs Tactical Risks
Strategic risks belong in a risk register
Tactical risks do not typically reside in a risk register
Strategic risk
* Vulnerability scans identifying a common pattern indicating a systemic problem in the business in relation to attitudes of patch management
* This would belong in the risk register
Tactical Risk
* The hundreds of thousands of entries identified within regular vulnerability scanning
* These would not belong in the risk register
161
Integration of Risk Management
Risk should be integrated into serveral other IT and business processes within the organisation
- Architecture
- Software Development
- Change Management
- Configuration Management
- Incident and Problem Management
- Physical Security
- Information risk and enterprise risk management
- Human resource management
- Project Management
163
Integration of Risk Management
Organisations need to introduce several security related steps into their software development process
- Threat modeling
- Coding standards
- Code reviews
- Code scanning
- Application scanning
- Application penetration testing
- Anticipate potential threats. Incorporate design features to block them
- Specify allowed and disallowed coding techniques
- Peer review
- Integrated Development Environment
- Scan web applications to discover exploits
- Performed by internal or exteral appropriately skilled testers
164
Change Management
An IT function used to control changes made within the environment
Change Management
164
Change Management
The purpose of change management is to…
reduce the likelihood changes will introduce unexpected risk
164
Configuration Management
The IT function by which the configuration of components in an IT environment are recorded
Configuration Management
165
Configuration Management
A repository of configuration changes within the organisation
Configuration Management Database
(CMDB)
165
Incident and Problem Management
4 security and risk related principles and considerations in incident management
- Security or Risk component associated with an incident
- Security or Risk implication associated with actions to restore service
- Security or Risk implications associated with root cause analysis
- Security or Risk implications associated with correction action
166
Configuration Management
Where configuration of a component or system slowly diverges from its intiial or intended state - often occuring in organisations that lack automation
Configuration Drift
165
Human Resource Management
There are several practices in HR that contribute to the support of information protection
- Background checks
- Legal agreements
- Training
- Development and Management of roles
- Management of the human resources information systems (HRIS)
- Background checks on an employee before hiring them, checking credibility
- Directing employees to agree to and sign legal documents that protect the business i.e. NDA or user agreement policy
- Delivering training to workers, including security awareness training
- Incorporating security related responsibilities into job descriptions
- Integration of HRIS with IAM services to ensure access management information is kept up to date i.e. when a user leaves, immediately being able to revoke access across the estate.
Information Risk and ERM
Organisations with an ERM and Information Risk function may choose to merge them together. Organisations that blend these risks together in a register have a more…
complete view of all business risks
168
