Risk Management Lifecycle

• CLO 2: Synthesize the principles of cyber security risk management and a framework of components: identification, protection, detection, response and recovery.
• CLO 3: Develop a working knowledge of types of policy, how policy is created, how to implement and manage policy, measurement practices, and audit of policy

• Overview on the Risk management lifecycle
• Asset Valuation

• Risk management: identification, assessment, and prioritization of risks.
• Managing risk is one of the key responsibilities of every manager within the organization
• In any well-developed risk management program, two formal processes are at work
  • Risk identification and assessment
  • Risk control

Communities of interest must work together

• Cyber Security – leadership role in addressing risk
• Information Technology – role involves building and maintaining secure systems
• Management – role involves resource allocation and prioritization of security concerns
• Users – crucial role in (early) detection, and proper response to threats

• Identifying risks: (Threat vulnerability matrix, Asset impact)
• Assessing risks: quantitative vs. qualitative
• Evaluating the risk controls (CBA model)
  • Determining which control options are cost-effective
• Acquiring or installing the appropriate controls
• Overseeing processes to ensure that the controls remain effective
• Summarizing the findings

• Asset Identification: Asset inventory
  • Identify information assets
    • Includes people, procedures, data and information, software, hardware, and networking elements
    • This step should be done without pre-judging the value of each asset
      • Values will be assigned later in the process
  • Determine which attributes of each information asset should be tracked

• Potential asset attributes (for physical Devices)
  • Name
  • Asset tag
  • IP address
  • MAC address
  • asset type
  • Serial number
  • manufacturer name
  • Manufacturer’s model or part number
  • Software version, update revision, or FCO number
  • Physical location/ logical location
  • Controlling entity

• Sample attributes for people
  • Position name/number/ID
  • Supervisor name/number/ID
  • Security clearance level
  • Special skills

• Sample attributes for procedures,
  • Description
  • Intended purpose Software/hardware/networking elements to which it is tied
  • Location where it is stored for reference
  • Location where it is stored for update purposes

• Sample attributes for data assets:
  • Classification (Sensitive, confidential, private, public)
  • Owner/creator/manager
  • Size of data structure
  • Data structure used
  • Online or offline
  • Location
  • Backup procedures

• Some tools to be used in asset inventory
  • Network asset tracker
  • Asset management

• Determine/refine an asset classification scheme
• A classification scheme categorizes information assets based on their sensitivity, security needs
• Each category designates the level of protection needed for a particular information asset
• Some asset types, such as personnel, may require an alternative classification scheme
• Classification categories must be comprehensive and mutually exclusive

Figure 8-2 Sample asset classification worksheet

• Determine the values of assets
• Assign a relative value.
  • Comparative judgments made to ensure that the most valuable information assets are given the highest priority.
  • Some factors should be considered in asset valuation
    • Asset cost
    • Asset impact on profitability
    • Asset impact on revenue
    • Asset impact on public image

1. Which asset is the most critical to the success of the organization?
2. Which asset generates the most revenue?
3. Which asset generates the highest profitability?
4. Which asset is the most expensive to replace?
5. Which asset is the most expensive to protect?
6. Which asset’s loss or compromise would be the most embarrassing or cause the greatest liability?

1.

Asset: email servers

,

• vulnerability: antivirus software not updated,
• threat: virus attack

1. Asset: router ,
   • vulnerability: incorrect router configuration,
   • threat: network susceptible to reduction or loss of connectivity

• At the end of the risk identification process, a list of assets and their vulnerabilities has been developed
• Another list prioritizes threats facing the organization based on the weighted table discussed earlier
• These lists can be combined into a single worksheet called (Threat Vulnerability Asset (TVA worksheet)

• Risk assessment: Quantitative OR Qualitative