Risk Management Flashcards
What is the order of tasks in the risk assessment process according to ISO 27005?
- Risk identification
- Risk estimation
- Risk evaluation
Which elements are identified in the process step of risk identification?
Vulnerabilities
Assets
Threats
Existing controls
Basis for assessing risk
Know the assets: identify and understand the value of information assets and systems.
Know the threats: identify and understand relevant threat scenarios which can harm information assets and systems.
Know the vulnerabilities which can be exploited by threats.
Know the potential impacts of incidents.
Know which stakeholders in the organisation are responsible for managing the identified risks.
Roles involved in risk management
- Management, users, and information technology must
all work together - Asset owners must participate in developing asset inventory
- Users and experts must assist in identifying threats and vulnerabilities, and in determining likelihoods of incidents
- Risk management experts must guide stakeholders through the risk assessment process
- Security experts must assist in selecting security controls
- Management must review the risk management process and approve risk management strategy (security controls)
Risk Management
Risk management is an essential element of ISMS
- Used to identify risks and their magnitude
- Basis for selecting security controls
- Tool for top management to understand organization’s risk exposure
Threat Modelling
- Threat modelling is the process of identifying, analysing and describing relevant threat scenarios.
- Unimportant/irrelevant threat scenarios can be ignored.
- Examine how each relevant threat scenario can be executed against the organization’s assets.
- The threat modelling process works best when people with diverse backgrounds within the organization work together in a series of brainstorming sessions.
- Threat modelling is important during system development
- Used to identify, remove and avoid vulnerabilities when developing software and systems.
- Multiple approaches/methods for threat modelling
Threat Modelling Methods
Attacker centric:
- Starts from attackers, evaluates their goals, and how they might achieve them through attack tree. Usually starts from entry points or attacker action.
System centric (aka. SW --, design --, architecture centric): - Starts from model of system, and attempts to follow model dynamics and logic, looking for types of attacks against each element of the model. This approach is e.g. used for threat modeling in Microsoft's Security Development Lifecycle.
Asset centric:
- Starts from assets entrusted to a system, such as a collection of sensitive personal information, and attempts to identify how security breaches of CIA properties can happen.
Vulnerability Identification
Vulnerabilities are specific opportunities that threat actors can exploit to attack systems and information assets.
Generic vulnerability identification:
- To identify a vulnerability is the same as to determine how to block a specific threat scenario.
- Removing a vulnerability is the same as blocking a threat.
- A vulnerability is the absence of barriers against a threat.
- Blocking a threat (i.e. removing a vulnerability) is done with a security control.
- Tool based and checklist based vulnerability identification
- Vulnerability scanners are automated tools to detect known vulnerabilities in networks and systems, e.g. Wireshark
- Check lists of vulnerabilities are used by teams when doing risk assessment and removing vulnerabilities, e.g. OWASP Top 10.
Feilbetegnelsen ROS analyse
- ROS analyse = «Risiko og sårbarhetsanalyse»
- Begrepet «sårbarhet» som del av ROS analyse betyr «kombinasjonen av sannsynlighet for en hendelse og dens konsekvens», som egentlig er det samme som risiko.
- Denne definisjonen av «sårbarhet» stammer fra rapportene til «Sårbarhetsutvalget» i 2000 og «Lysneutvalget» i 2015.
- Med denne definisjonen er sårbarhet = risiko, og «sårbarhetsanalyse» blir det samme som risikoanalyse.
- Begrepet ROS analyse brukes ofte på norsk, og er faktisk et særnorsk begrep.
- Begrepet ROS analyse og dens definisjon på «sårbarhet» kan skape forvirring, og bør unngås.
Estimating Risk levels
Qualitative:
Uses descriptive scales. Example:
Impact level: Minor, moderate, major, catastrophic
Likelihood: Rare, unlikely, possible, likely, almost certain
Relative:
Relative numerical values assigned to qualitative scales
Gives relatively good distribution of risk levels
Quantitative:
Use numerical values for both consequence (e.g. and likelihood (e.g. probability)
Exposure Factor (EF)
Percentage of asset loss caused by threat occurrence
A quantitative risk estimation
Single loss expectancy (SLE)
SLE = AV(asset value) of EF (Percentage of asset loss caused by threat occurrence)
(A quantitative risk estimation)
Annualized Rate of Occurrence (ARO)
Estimated frequency a threat will occur within a year.
A quantitative risk estimation
Annualised Loss Expectancy (ALE)
ALE = SLE ARO
A quantitative risk estimation
Asset value (AV)
Estimated total value of asset
A quantitative risk estimation
