Risk Management Flashcards
What is the order of tasks in the risk assessment process according to ISO 27005?
- Risk identification
- Risk estimation
- Risk evaluation
Which elements are identified in the process step of risk identification?
Vulnerabilities
Assets
Threats
Existing controls
Basis for assessing risk
Know the assets: identify and understand the value of information assets and systems.
Know the threats: identify and understand relevant threat scenarios which can harm information assets and systems.
Know the vulnerabilities which can be exploited by threats.
Know the potential impacts of incidents.
Know which stakeholders in the organisation are responsible for managing the identified risks.
Roles involved in risk management
- Management, users, and information technology must
all work together - Asset owners must participate in developing asset inventory
- Users and experts must assist in identifying threats and vulnerabilities, and in determining likelihoods of incidents
- Risk management experts must guide stakeholders through the risk assessment process
- Security experts must assist in selecting security controls
- Management must review the risk management process and approve risk management strategy (security controls)
Risk Management
Risk management is an essential element of ISMS
- Used to identify risks and their magnitude
- Basis for selecting security controls
- Tool for top management to understand organization’s risk exposure
Threat Modelling
- Threat modelling is the process of identifying, analysing and describing relevant threat scenarios.
- Unimportant/irrelevant threat scenarios can be ignored.
- Examine how each relevant threat scenario can be executed against the organization’s assets.
- The threat modelling process works best when people with diverse backgrounds within the organization work together in a series of brainstorming sessions.
- Threat modelling is important during system development
- Used to identify, remove and avoid vulnerabilities when developing software and systems.
- Multiple approaches/methods for threat modelling
Threat Modelling Methods
Attacker centric:
- Starts from attackers, evaluates their goals, and how they might achieve them through attack tree. Usually starts from entry points or attacker action.
System centric (aka. SW --, design --, architecture centric): - Starts from model of system, and attempts to follow model dynamics and logic, looking for types of attacks against each element of the model. This approach is e.g. used for threat modeling in Microsoft's Security Development Lifecycle.
Asset centric:
- Starts from assets entrusted to a system, such as a collection of sensitive personal information, and attempts to identify how security breaches of CIA properties can happen.
Vulnerability Identification
Vulnerabilities are specific opportunities that threat actors can exploit to attack systems and information assets.
Generic vulnerability identification:
- To identify a vulnerability is the same as to determine how to block a specific threat scenario.
- Removing a vulnerability is the same as blocking a threat.
- A vulnerability is the absence of barriers against a threat.
- Blocking a threat (i.e. removing a vulnerability) is done with a security control.
- Tool based and checklist based vulnerability identification
- Vulnerability scanners are automated tools to detect known vulnerabilities in networks and systems, e.g. Wireshark
- Check lists of vulnerabilities are used by teams when doing risk assessment and removing vulnerabilities, e.g. OWASP Top 10.
Feilbetegnelsen ROS analyse
- ROS analyse = «Risiko og sårbarhetsanalyse»
- Begrepet «sårbarhet» som del av ROS analyse betyr «kombinasjonen av sannsynlighet for en hendelse og dens konsekvens», som egentlig er det samme som risiko.
- Denne definisjonen av «sårbarhet» stammer fra rapportene til «Sårbarhetsutvalget» i 2000 og «Lysneutvalget» i 2015.
- Med denne definisjonen er sårbarhet = risiko, og «sårbarhetsanalyse» blir det samme som risikoanalyse.
- Begrepet ROS analyse brukes ofte på norsk, og er faktisk et særnorsk begrep.
- Begrepet ROS analyse og dens definisjon på «sårbarhet» kan skape forvirring, og bør unngås.
Estimating Risk levels
Qualitative:
Uses descriptive scales. Example:
Impact level: Minor, moderate, major, catastrophic
Likelihood: Rare, unlikely, possible, likely, almost certain
Relative:
Relative numerical values assigned to qualitative scales
Gives relatively good distribution of risk levels
Quantitative:
Use numerical values for both consequence (e.g. and likelihood (e.g. probability)
Exposure Factor (EF)
Percentage of asset loss caused by threat occurrence
A quantitative risk estimation
Single loss expectancy (SLE)
SLE = AV(asset value) of EF (Percentage of asset loss caused by threat occurrence)
(A quantitative risk estimation)
Annualized Rate of Occurrence (ARO)
Estimated frequency a threat will occur within a year.
A quantitative risk estimation
Annualised Loss Expectancy (ALE)
ALE = SLE ARO
A quantitative risk estimation
Asset value (AV)
Estimated total value of asset
A quantitative risk estimation
Problems of measuring risk
Businesses normally wish to measure risk in money, but it is almost impossible to do this.
Valuation of assets:
- Value of data, hard to assess
- Value of goodwill and customer confidence, very vague
Likelihood of incidents:
- Past events not always relevant for future probabilities
- The nature of future attacks is unpredictable
- The actions of future attackers are unpredictable
- Measurement of benefit from security control
- Problems with the difference of two approximate quantities
- Estimation of past and present risk
Risk control strategies
After completing the risk assessment, the security team must choose one of four strategies to control each risk:
- Reduce risk by implementing security controls
- Share/transfer risk (outsource activity that causes risk, or buy insurance)
- Retain risk (understand and tolerate potential consequences)
- Avoid risk (stop activity that causes risk)
Business Continuity Management
Procedures for the recovery of an organization’s facilities in case of major incidents and disasters, so that the organization will be able to either maintain or quickly resume mission critical functions.
BCM standards:
- ISO 27031 Guidelines for ICT readiness for business continuity
- NISTSP800 34 Contingency Planning Guide for Federal Information Systems
The range of incidents to be considered in the BCM standard
Acts of nature, for example:
- Excessive weather conditions
- Earthquake
- Flood
- Fire
Human acts (inadvertent or deliberate), for example:
- Hacker activity
- Mistakes by operating staff
- Theft
- Fraud
- Vandalism
- Terrorism
The business continuity plan describes:
A sequence of actions and the parties responsible for carrying them out in response to disasters in order to restore normal business operations as quickly as possible
BCP terminology
Business Continuity Plan:
- Plan for restoring normal business functions after disruption
Business Contingency Plan:
- Same as Business Continuity Plan
- Contingency means something unpredictable that can happen
Disaster Recovery:
- Reestablishment of business functions after a disaster, possibly in temporary facilities
- Requires a BCP
Business Continuity Management:
- Denotes the management of Business Continuity
- Includes the establishment of a BCP
- ICT Readiness for Business Continuity (IRBC) (term used in ISO 27031)
Security Strategies
…..
Ask What, Why, How, Who, Where, When ?
Contextual, conceptual, logical, physical, component, operational.
(CISSP, s.28)
ISO/IEC 2700 series
ISO/IEC 2700 series; International standards on how to develop and maintain an ISMS developed by ISO and IEC. (CISSP, s.15)
A Security Program
Is a framework made up of many entities; logical, administrative and physical protection mechanisms; procedures; business processes and people that all work together to provide a protection level for the environment.
Because a security program is a framework, organization are free to plug in different types of technologies, methods and procedures to accomplish the necessary protection level for their environment.
Threat
A scenario of steps or procedures, controlled or triggered by a threat actor, which can negatively affect the victim’s information assets.
Vulnerability
The absence of security controls to stop a threat scenario
CIA
Often referred to as AIC triad.
We refer to the CIA properties of an asset, and that refers to the security objectives for that data, protected by information security; Confidentiality, Integrity, Availability
?
Determining the level of a specific risk
- Likelihood/frequency of each type of incident.
- Impact on assets (loss) resulting from each type of incident.
Each specific risk results from a threat scenario that can affect specific assets. Motivation, capacity, vulnerabilities, and impact determine the risk level for that specific risk.
Risk defined by ISO 31000, ISO 27005
“Risk management consists of coordinated activities to direct and control and organization with regard to risk” - ISO 31000
“IS management analyses what can happen and what the possible consequences can be, before deciding what should be done and when, to reduce the risk an acceptable level” - ISO 27005
BIA: Business Impact Analysis
A Business Impact Analysis (BIA) is performed as part of the BCP development to identify the functions that in the event of a disaster or disruption, would cause the greatest financial or operational loss.
Consider e.g.:
- IT network support
- Data processing
- Accounting
- Software development
- Payroll
- Customer support
- Order entry
- Production scheduling
- Purchasing
- Communications
MTD: Maximum tolerable downtimes
Non essential = 30 days Normal = 7 days Important = 72 hours Urgent = 24 hours Critical = minutes to hours
BCP testing
Checklist test:
- Copies of the BCP distributed to departments for review
Structured walk through test:
- Representatives from each department come together to go through the plan
Simulation test:
- All staff in operational and support functions come together to practice executing the BCP
Parallel test:
- Business functions tested at alternative site
Full interruption test:
- Business functions at primary site halted, and migrated to alternative site in accordance with the BCP
