Conducting Cyber Risk Assessments

Question 1

Identify Threats

Answer 1

Requeriment
A list of the threats that could affect the assets contained within the zone or conduit shall be developed

Include
* A description of the threat source
* A description of the capability or skill-level of the threat source
* A description of possible threat vectors
* Identfication of the potentially affected asset(s)

Question 2

Threat Source

Answer 2

The threat source is the entity that can manifest a threat.

• Unauthorized internal personnel
• Authorized internal personnel
• Unauthorized external person (hacker)
• Authorized 3rd party
• Malware
• Equipment
• Environment

Question 3

Threat Vector

Answer 3

The Threat Vector is the means the threat source may utilize to compromise the zone or conduit

Question 4

Identify Vulnerabilities

Answer 4

Requirement
The zone or conduit shall be analized in order to identify and document the known vulnerabilities in the zone or conduit assets contained within the zone or conduit including the access points.

Question 5

Vulnerability

Answer 5

A vulnerability is any flaw or wakness in a system’s design, implementation or operation that could be exploited to compromise the system

Question 6

Determine Consequence & Impact

Answer 6

Each thrat identified in 5.1 and 5.2 shall be evaluated to determine the consequence and the impact of the consequence should the threat be realized. Document impact in terms of the worst case impact on risk areas such as personnel safety, financial loss, business interruption, and environment.

Question 7

Determine Consequence & Impact

Answer 7

Each thrat identified in 5.1 and 5.2 shall be evaluated to determine the consequence and the impact of the consequence should the threat be realized. Document impact in terms of the worst case impact on risk areas such as personnel safety, financial loss, business interruption, and environment.

Question 8

Determine Likelihood

Answer 8

Factors:
* Frequency
- Target attractiveness
- Attack sufrace
* Probability
- Capability of the threat actor
- Known vulnerabilites
- Motivation/intent of the threat actor

Question 9

Determine Likelihood

Answer 9

Factors:
Frequency
- Target attractiveness
- Attack sufrace
Probability
- Capability of the threat actor
- Known vulnerabilites
- Motivation/intent of the threat actor

Question 10

Likelihood Scale

Answer 10

Question 11

Unmitigated Threat Likelihood (UTL)

Answer 11

Is the likelihood of the threat occurring and leading to the final consequence without any cybersecurity countermeasures in place.

Question 12

Calculate Risk

Answer 12

Requirement
The initial risk for each threat shall be calculated by combining the unmitigated likelihood measure and the impact measure.

Question 13

Determine Security Level Target

Answer 13

Requirement
A SL-T shall be established for each security zone or conduit. The SL-T is related to the Cyber Risk Reduction Factor (CRRF) which is a measure of the degree of risk reduction required to achieve tolarable risk.

CRRF = Unimitagated Risk / Tolarable Risk

Question 14

Types of Security Levels (SLs)

Answer 14

Target
SL-T: are the desired level of security for a particular system. This is usually determined by performing a risk assessment on a system and determining that it needs a particular level of security to ensure correct operation.

Achieved
SL-A: are the actual level of security for a particular system. These are measured after a syhstem design is available or when a system is in place. They are used to establish that a security system is meeting goals that were originally set out in the target SLs.

Capability
SL-C: are the security levels that componentes or systems can provide when properly configured. These levels state that a particular component or system is capable of meeting the target SLs natively, without additional compensating countermeasures when properly configured and integrated.

Question 15

Security Levels Defined

Answer 15

Question 16

SL-T Example

Answer 16

Question 17

Consider Existing Countermeasures

Answer 17

Requirement
Identify and evaluate the effectiveness of existing countermeasures to reduce the likelihood of threats or to mitigate vulnerabilities.

Question 18

Mitigated Threat Likelihood (MTL)

Answer 18

The MTL is the likelihood of the threat scenario occurring and leading to the final consequence. It takes into account all protection measures and cybersecurity countermeasures in place.

Question 19

Calculate the Residual Risk

Answer 19

Requirement
The residual risk for each threat shall be determined by combining the mitigated likelihood and impact measures.

Calculating residual risk provides a measure of the effectiveness of existing countermeasures. It is an essential step in determining whether the level of unmitigated risk is at or below the tolerable risk.

Question 20

Compare Residual Risk with Tolarable Risk

Answer 20

The residual risk calculated for each threat shall be compared to the organization’s tolerable risk. The organization must determine if the residual risk will be mitigated, transferred or accepted based upon the organization’s policy.

Question 21

Apply additional Security Countermeasures

Answer 21

Requirement
Appropiate security countermeasures shall be applied to mitigate the risk where the residual risk exceeds the organization’s tolerable risk unless the organization has accepted or transferred the risk.

Question 22

Document and Communicate Results

Answer 22

Requirement
The results of the cyber risk assessment shall be documented and shall include the date each session was conducted as well as the names and titles of the participants. Documentation that was instrumental in performing the cyber risk assessment (e.g. system architecture diagrams, PHAs, vulnerability assessments, gap assessments, sources of threat information, etc.) shall be recorded and archived along with the cyver risk assessment.

Question 23

Which Security Level is defined as “Protection against intentional violation using simple means with low resources, generic skills and low motivation”?

Answer 23

SL-2

Question 24

Which of the following is the term for the undesirable result of an inicident?

Answer 24

Consequence

Question 25

What is known as any flaw or weakness in a system’s design, implementation or operation that could be exploited to compromise the system?

Answer 25

Vulnerability

Question 26

Which type of Security Level is the desired level of security for a particular system?

Answer 26

Target (SL-T)

Question 27

What is the measure of the degree of risk reduction required to achieve tolerable risk?

Answer 27

CRRF