CYS403 · Annotated Slides · Chapter 6 — Performing a Risk Assessment

Exam weight Low

Prepare for RA

Before progressing with the RA, you need to complete three preliminary actions.
- Define the assessment.
- Review previous findings.
- Identifying the Management Structure

Exam weight Low

Prepare: define scope and boundaries, get management support, identify stakeholders and data sources.

Exam weight Low

Prepare for RA

Review Previous Findings
- Start from where the others end
- These reports can contain a lot of valuable information to make your job easier (assets, threats, vulnerabilities, recommendations, controls).
- Pay more attention to:
  - Recommendations — Previous recommendations give insight into several issues.
  - Current status of accepted recommendations —
    - Measure the effectiveness of recommendation in place.
    - Find justification of recommendation not in place.
  - Unapproved recommendations — The recommendations that were not approved can also give some insight into the business.
    - level of residual risk.
    - Receptiveness of organization to the control.

Exam weight Low

Prepare for RA

Identifying the Management Structure
- refers to how responsibilities are assigned. When you define the scope of the RA,
  - it’s helpful to keep the scope within the ownership of a single entity.
- Is IT controlled by one entity or multiple entities?
  - Network infrastructure
  - User and computer management
  - E-mail servers
  - Web servers
  - Database servers
  - Configuration and change management – systematic & consistent with proper documentation

Exam weight Low

RA plan (steps to do)

RA is not a one day project, it is a continuous process.
It takes time and planning.
a risk assessment involves the following steps:

Identify assets and activities to address.
Identify and evaluate relevant threats.
Identify and evaluate relevant vulnerabilities.
Identify and evaluate relevant countermeasures.
Assess threats, vulnerabilities, and exploits.
Evaluate risks.
Develop recommendations to mitigate risks.
Present recommendations to management.

Exam weight Low

RA plan: the step-by-step list of what will be assessed, by whom, how and when.

Identify assets and activities to address.

Asset valuation
- It is important that you evaluate only assets that are within the boundary of the RA.
- Scope creep occurs when you start evaluating assets outside the scope of the RA.
  - This results in wasted time and wasted resources.

Exam weight Low

Identify the assets and activities in scope (systems, data, processes) and who owns them.

Identify assets and activities to address.

Asset valuation
- When considering the value of an asset, you can look at it from different perspectives:
  - Replacement value — This is the cost to purchase a new asset in its place.
    - For example, if a laptop fails or is stolen, the price to purchase a new laptop with similar hardware and software may be $1,500.
  - Recovery value — This is the cost to get the asset operational after a failure.
    - For example, if the hard drive on a server fails, you wouldn’t replace the entire server. Instead, you’d replace the hard drive and take steps to recover the system. This may require you to reinstall the operating system and restore data from a backup.
    - You would also consider the time needed to perform the repair. For example, if a repair requires two hours, the system is not available for two hours. If it’s a Web server generating $10,000 an hour in revenue, you would include $20,000 as part of the recovery value.

Exam weight Low

Identify assets and activities to address.

There are several elements to consider when determining the value of different assets.
- System access and system availability: available 24/7 or during office hours.
- System functions: is the function automated or it requires an interactions.
- Hardware assets & Software assets
- Personnel assets: some organization are stable in retaining employee, while others are having high turnover. The second type has a higher cybersecurity issues.
- Data and information assets: Data classification to know the protection level of each.
- Facilities and supplies:
  - insurance
  - Redundancy: hot site, cold site, and warm site

Exam weight Low

Identifying and Evaluating Relevant Threats

You can use one of two primary methods to identify threats. They are:
- Review historical data: attacks, natural effects, equipment failure, Accidents
- Threat Modeling

Exam weight Low

Evaluate relevant threats: which threat sources could target each asset, and how likely they are.

Identifying and Evaluating Relevant Vulnerabilities

Vulnerability Assessments
- Information gathering and capturing:
  - Identify the used IP addresses: PING
  - Identify the domain names: WHOIS
  - Identify the running OS: fingerprint attack
  - Identify the weak password: Password Cracking
  - Identify the open ports: port scan
  - Capture data: NMAP, NESSUS, SATAN, SAINT
Exploit Assessment:
- Penetration Testing

Exam weight Low

Evaluate vulnerabilities: scans, audits, interviews, documentation reviews.

Identifying and Evaluating Countermeasures

When identifying and evaluating the countermeasures, you should consider:
- In-place controls — The controls that are currently installed in the operational system.
- Planned controls — The controls that have a specified implementation date.
- Control categories — Controls fall into three primary categories: administrative controls, technical controls, and physical controls.
When reviewing all of the controls, you should consider the purpose.

Exam weight Low

Evaluate existing countermeasures: what is in place and how effective it is.

Exam weight Low

Develop Mitigating Recommendations

Threat/vulnerability pairs
Estimate of cost and time to implement
Estimate of operational impact
Cost-benefit analysis

Exam weight Low

Recommend mitigations: controls ranked by the risk they reduce and their cost.

★ Past exam

Present Risk Assessment Results

Phase one
- The list of ranked risks submitted to Top management for approval.
Phase TWO
- POAM: Plan Of Actions and Milestones
  - How to implement the approved items according the given budget and time.

Exam weight High

Present the results to management, then track the agreed actions (implementation, monitoring, reassessment).

Asked in a real exam

★ Major exam · two steps after finishing the risk assessment

🎯 How this can come up · 1 question

Written

Name two steps to do after finishing a risk assessment.

Best Practices for Performing Risk Assessments

Ensure systems are fully described.
Review past audits
Review past risk assessments
Match the RA to the management structure (ownership & Responsibilities) – Don’t cross the management lines.
Identify assets within the RA boundaries
Identify and evaluate relevant threats
Identify and evaluate relevant vulnerabilities
Identify and evaluate countermeasures
Track the results: POAM

Exam weight Low

Best practices: involve stakeholders, use a consistent method, document everything, repeat regularly.

Exam weight Low