Informationn Security And Risk Management Flashcards
Risk management
The process of minimising potential losses.
In the case a loss occurs, risk management practices determine how to reduce the costs.
Risk assessment techniques
Risk assessment techniques determine the level of risk and determine if the level of risk exceeds an organisation’s risk tolerance.
NIST
National Institute of Standards and Technology
4 Risk management processes
- framing
- assessing
- monitoring
- responding
Risk assessment
Activities that are carried out to discover, describe, analyse and evaluate risks. They can be quantitative, quantitative or both
Qualitative risk assessment
Collects descriptive information, including information that cannot be reduced to measurable values.
It will typically identify a number is characteristics about an asset or activity, including:
- classification
- vulnerabilities
- threats
- threat probability
- impact
- countermeasures
Classification
Assets may be classified according to risk level, business function of the sensitivity or criticality of data stored or processed by the asset.
Vulnerabilities
These are weaknesses in design, configuration, documentation, procedure or implementation
Threats
Potential activities that would exploit specific vulnerabilities and result in a security incident.
Threat probability
An expression of the likelihood that a specific threat will be carried out, usually expressed in Low/Medium/High or simple numeric scale.
Impact
An expression of the influence upon the organisation if a threat was carried out.
Countermeasures
These are actual or proposed measures that reduce the risk associated with vulnerabilities or threats.
Quantitative Risk Assessment
Quantitative assessments tata assessing and evaluating risks as discrete mathematical valuations.
It can be thought as an extension of qualitative risk assessment.
Asset value
This is a dollar figure that may represent the replacement cost of an asset but it could also represent income derived from the use of that asset.
Exposure Factor
The proportion of an asset’s value that is likely to be lost through a particular threat, usually expressed as a percentage.
Single Loss Expectancy
SLE is the cost of a single Loss through the single event relisation of a particular threat. This is the result of the calculation:
SLE = asset value ($) x exposure Factor (%)
ARO
Annualized Rate of Occurance
The probability that a loss will occur in a year’s time.
ALE
Annual Loss Expectancy
The yearly estimate of a loss of an asset, calculated as follows:
ALE = ARO X SLE
Costs of Countermeasures
Each countermeasure had a specific cost associated with it. This may be the first of additional protective equipment, software or Labour.
Changes in exposure Factor
A specific countermeasure may have an impact on a specific threat.
Changes in single Loss Expectancy
Specific countermeasures may influence the influence the probability that a loss will occur.
Risk Assessment Methodologies
OCTAVE
FRAP
Spanning Tree Analysis
NIST 800-30
Risk Treatment
Once a risk assessment is performed an organisation’s management can begin the process of determining what steps can be taken to manage the risk identified.
The fire general Autriche to risk management are:
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transfer
Risk Avoidance
The associated activity that introduced the risk is discontinued.
Risk Mitigation
This involves the use of countermeasure to reduce the risks initially identified in the risk analysis.
Risk Acceptance
The act of foregoing mitigation of low impact risks. Accepting the risks.
Risk transfer
Typically involves the use of insurance as a mean of mitigating risks.
Residual risk
In a given risk situation, generally only some of the risk can be avoided, reduced or transferred. They is always some remaining risk, called residual risk.
Security Management Concepts
Security control
CIA Triad
Defense in Depth
Single points of failure
Fail Open, Fail Closed, Fail Soft
privacy
ISO 27001 Standard
Is a top down process approach to security Management that requires continuous improvement in an organisation security Management system
Security Controls
The measures that are taken to reduce risks through the origination and enforcement of security policies.
The types of controls used are:
- Detective
- Deterrent
- Preventive
- Corrective
- Recovery
- Compensating
CIA Triad
The core principles of information security are:
- Confidentiality
- Integrity
- Availability
Confidentiality
The principle of Confidentiality asserts that only properly authorized parties can access information and functions.
Integrity
The principle of Integrity asserts that information and functions can be added, altered or removed only by authorized persons and means.
Availability
The principle of Availability asserts that systems, functions and data must be available when an authorized user needs to access them.
Different levels of Availability exist based upon predefined parameters regarding levels and types of service
Defense in Depth
Defense in Depth implies a layered defense consisting of two or more protective methods that protect some asset.
It defines a process balancing protection capability, cost, performance and operations considerations. Some characteristics of defense in Depth:
- heterogeneity
- holistic/comprehensive protection
The objectives of defense in Depth is to reduce the probability that a threat can act upon an asset. This occurs in three ways:
- single vulnerability
- single malfunction
- Fail open
Heterogeneity in defense in Depth
A good defense in Depth mechanism may contain different types of protective mechanisms
Comprehensive protection in defense in Depth
Each later of the defense fully protects an asset against the type of threat that the defense is designed to block
Single vulnerability
If one of the components of a Defense in Depth had an exploitable vulnerability, chances are that another layer in the defense still not have the same vulnerability.
Single malfunction
If one of the components of a Defense in Depth malfunctions, chances are that another layer in the defense will not malfunction.
Fail Open in Defense in Depth
If one of the components in a defense in depth fails open, the other components will continue to operate and protect the asset
