Risk Management Fundamentals

• CLO 1: Evaluate the issues and concerns indicative to protecting information, systems and users.

• The Shangri-La of Risk Management
• Applying Risk Management to cyber security
• Qualitative vs. Quantitative risk management

• Risk is a function of the likelihood of a given threat- source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization assets. NIST SP 800-30

• Asset - Something that is valued by the organization to accomplish its goals and objectives.
• Threat - Any potential danger to information or an information system.
• Attack: Any actual danger to information or an information system.

• Examples of threats include, but are not limited to:
  • Unauthorized access
    • Human errors
  • Hardware failure
    • Neighboring hazards
  • Utility failure
    • Tampering
  • Loss of key personnel ▪ Dissatisfied employees

• Threat Agent - Anything that has the potential of causing a threat.
• Attacker: Anything that has the actual cause of attack.
• Vulnerability: - Is any weakness that could be exploited. Vulnerabilities exist in every IT system, product and application.
• Exposure - An opportunity for a threat to cause loss.

• Organizations must design and create safe environments in which business processes and procedures can function
• Risk management is the process of identifying and controlling risks facing an organization
  • Risk identification is the process of examining an organization’s current information technology security situation
  • Risk Assessment is the process of evaluating the risks to find a suitable control.
  • Risk control is applying controls to reduce risks to an organization’s data and information systems

• Know yourself: identify, examine, and understand the information and systems currently in place
• Know the enemy: identify, examine, and understand threats facing the organization
• Responsibility of each community of interest within an organization to manage risks that are encountered

• The purpose of Risk Management is to identify potential cyber risks
  • Before they occur
  • Across the life of the product or project
  • So that risk-handling activities may be planned and invoked as needed

Figure 4-1 Components of Risk Management

• Step 2: Analyze the risk.
  • Once risks are identified you determine the likelihood and impact of each risk. You develop an understanding of the nature of risk and its potential to affect the business objectives. This information is also input to your Risk Register.

• Step 3: Evaluate & Rank the Risk.
  • You evaluate & rank the risk by determining the risk Score, which is the combination of likelihood and impact.
  • You make decisions about whether the risk is acceptable or whether it is serious enough to warrant treatment.
  • These risk rankings are also added to your Risk Register.

• Step 4: Risk Control.
  • This is also referred to as Risk Response Planning. During this step you assess your highest ranked risks and set out a plan to treat or modify these risks to achieve acceptable risk levels.
  • You create risk mitigation strategies, preventive plans and contingency plans in this step (DRP, BCP, IRP,...).
  • you add the risk treatment measures for the highest ranking or most serious risks to your Risk Register.

• Step 5: Monitor and Review the risk.
  • This is the step where you take your Risk Register and use it to monitor, track and review risks.

• Aims to minimize manual effort
• Can be time consuming to setup
• Perform calculations quickly

• Two types of Risk Analysis
  • Quantitative Risk Analysis
  • Qualitative Risk Analysis
• Both provide unique capabilities
• Both are often required to get a full picture

• Assign independently objective numeric monetary values
• Fully quantitative if all elements of the risk analysis are quantified
• Sometimes, Difficult to achieve
• Requires substantial time and personnel resources RISK = MONEY

• Delphi Technique
• SWIFT Analysis: “Structured What - If”
• Decision Tree Analysis
• Bow-tie Analysis
• Probability/Consequence Matrix

• Risk Acceptance :
  • if cost is higher than the expected loss
• Risk Reduction:
  • implement countermeasure to reduce the risk impact.
• Risk Transference:
  • outsource or transfer to third party.
• Risk Avoidance
  • Stop the activities that are having the risks.

• Vendor Trustworthiness
• Independence of Control and Subject
  • segregation of duties
• Universal Application
• Compartmentalization and Defense in Depth
• Isolation, Economy, and least Common Mechanism

• Acceptance and Tolerance by Personnel
• Minimum Human Intervention
• Sustainability
• Reaction and Recovery
• Override and Fail-safe Defaults
• Residuals and Reset

• Directive Controls. Often called administrative controls, these are intended to advise employees of the behavior expected of them during their interfaces with or use the organization’s information systems.
• Preventive Controls. Included in preventive controls are physical, administrative, and technical measures intended to prevent actions violating policy or increasing risk to system resources.
• Detective Controls. Detective controls involve the use of practices, processes, and tools that identify and possibly react to security violations.
• Corrective Controls. Corrective controls also involve physical, administrative, and technical measures designed to react to detection of an incident in order to reduce or eliminate the opportunity for the unwanted event to recur.
• Recovery Controls. Once an incident occurs that results in the compromise of integrity or availability, the implementation of recovery controls is necessary to restore the system or operation to a normal operating state.