Security Management and Risk Assessment Flashcards
IT Security Management
A process used to achieve and maintain appropriate levels of confidentiality, integrity, availability, accountability, authenticity, and reliability.
IT Security Functions include
determining organization IT security objectives, strategies, and policies
Determining organizational IT security requirements
Identifying and analyzing security threats to IT assets within the organization
Identifying and analyzing risks
Specifying appropriate safeguards
Monitoring the implementation and operation of safeguards that are necessary in order to cost effectively protect the information and services within the organization
Developing and implementing a security awareness program
Detecting and reacting to incidents
Four approaches to identifying and mitigating risks
Baseline approach
Informal approach
Detailed risk analysis
Combined analysis
Baseline Approach to identifying and mitigating risks
Aims to implement a basic general level of security controls on systems using baseline documents, codes of practice, and industry best practice
Advantages:
- -does not require expenditure of additional resources in conducting a more formal risk assessment
- Same measurements can be replicated over a range of systems
Disadvantage:
no special consideration is given to variations in the organization’s risk exposure based on who they are and how their systems are used
Goal:
implement generally agreed controls to provide protection against the most common threats
Informal approach to identifying and mitigating risks
Involves conducting some form of informal, pragmatic risk analysis for organization’s IT systems. No formal structured process
Advantage:
- -individuals performing the analysis require no additional skills
- -assessment performed quickly and cheaply
- -judgments made about specific vulnerabilities and risks (unlike baseline approach)
Disadvantage:
- -risks may not be considered appropriately, leaving org vulnerable
- -insufficient justification for suggested controls
- -inconsistent results over time
Details risk analysis approach for identifying and mitigating risks
Most comprehensive approach
Greatest degree of assurance
Stages:
- -Establish the context or system characterization (define risk appetite)
- -Asset Identification
- -Identification of threats, risks, and vulnerabilities
- -Threat identificaiton
- -analyze likelihood of the risk
- -analyze existing controls
- -determine consequences
- determine resulting risk to org
Combined approach for identifying and mitigating risks
Aims to provide reasonable levels of protection as quickly as possible, and then examine and adjust protection controls deployed on key systems over time
Stages:
- Start with implementation of suitable baseline security recommendations
- systems either exposed to high risk levels or critical to business objectives are identified in the high level risk assessment.
- decision made to conduct informal risk assessment on key systems, with aim of relatively quickly tailoring controls to more accurately reflect their requirements
- ordered process of performing detailed risk analyses of these systems
Managing Security
Technical controls (authentication, access control etc.) are used to reduce the risk of attacks on valuable assets.
Legal and compliance drivers for cyber security
–Financial and health data
What technical controls should be deployed?
- -Must understand risks posed by threats
- -Costs and benefits of security measures
Key Challenges
What assets are under risk?
What are the threats and how serious is the risk posed by them?
Likelihood of successful attack and its impact
What technological solutions/controls exist to counter threats?
How can we address risk in a cost-effective manner?
–Cost is less than reduction in risk
How do we understand people and process aspects of cyber security management?
Management controls
focus on security policies, planning, guidelines, and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization’s mission.
Operational controls
Address the correct implementation and use of security policies and standards, ensuring consistency in security operations and correcting identified operational deficiencies.
These controls relate to mechanisms and procedures that are primarily implemented by people rather than systems
They are used to improve the security of the system or group of systems
Technical controls
involve the correct use of hardware and software security capabilities in systems
Control classes include
Supportive controls
Preventative controls
Detection and recovery controls
NIST06 suggests adjustments may be needed for these
Technology
Common controls
Public access system
Infrastructure controls
Scalability issues
Risk assessment
Security Planning: Controls
Identity and access management (IAM)
- -Credentialing, account creation and deletion
- -Password policies
Network and host defenses
- -Firewalls, IDS, IPS
- -Anti-virus
VPN and BYOD
Vulnerability patching
User awareness and education
–Phishing attack awareness (Phishme)
