SECURITY RISK

MANAGEMENT
ISACA Atlanta Chapter, Geek Week
August 20, 2013
Scott Ritchie, Manager, HA&W
Information Assurance Services
 Scott Ritchie
CISSP, CISA, PCI QSA, ISO 27001 Auditor
• Manager, HA&W Information Assurance Services
• Previous
– AT&T, Internal Audit (Technology audits)
– Scientific Research Corp., Information Systems
Security Officer
• Academics
– M.B.A.
– M.S. Information Assurance

[Link]@[Link]
(770) 353-2761

[Link]
[Link]/fvs
 HA&W Information Assurance
Services
Key Verticals: SME Domains: Key Services:
 Fraud &  Security • Risk and gap assessments
Analytics  Privacy: • Attest/Compliance Reporting:
 Healthcare IT o HIPAA / HITECH • SSAE 16 & SOC 2 Reporting
 Tech / Cloud o Safe Harbor • PCI Compliance
Service o State Regulations
Providers • ISO 27001 Certification
 Confidentiality
 FinTech / • FedRAMP Certification
 Processing Integrity
Payments • IT Internal Audit
 Data Management
• IT Governance
 Availability
• Due Diligence
 Financial Reporting

[Link]
 Focus of Today’s Presentation

• How to assess security risks

• Understand recognized security risk
management frameworks
• Introduce security risk management
practices

[Link]
[Link]/fvs
 Security Environment

• Explosive growth/ aggressive

use of technology
• Proliferation of data
• Sophistication of threats

[Link]
 Challenges

• Least privilege • Mobile computing

• Awareness and training • Cloud and virtualization
• Insider threat • Individual/device auth
• Advanced Persistent • Resiliency of Systems
Threats • Privacy
• Trustworthiness of • Supply chain
applications and systems

Can't cover everything - Risk management allows prioritization

[Link]
 Risk Assessment Illustrated

Licensed from [Link]

 Definitions:

• Risk: Extent to which an entity is threatened by a potential

event. (Note: Quantitative or Qualitative)
• Risk Assessment: Prioritization of risks based on
probability and impact of an event.
• Threat: Circumstance with potential to adversely impact
organizational operations, assets, individuals, and others.
• Vulnerability: Weakness in an information system,
procedures, controls, or implementation.
• Impact: Magnitude of harm expected to result from the
consequences of an event.
• Probability: Likelihood that a threat event will be initiated
or will occur.
• Predisposing conditions: Condition which affects the
probability that threat events, once initiated, result in
adverse impacts.

[Link]
 Risk Management (RM) Hierarchy

Reference: NIST 800-30

[Link]
 Risk Assessment Frameworks

[Link]
ISO 27005: IT Risk Management
Context Definition

Risk Identification

Risk Analysis
Communication
and consultation Monitoring and
review

Risk Evaluation

Risk Treatment

Risk Acceptance

[Link]
Understand the Organization
Governance

Contractual Organizational
relationships structure

Policies and
Standards
objectives
Organization

Organization's Resources and

culture knowledge

Relationships
Information
with
flows
stakeholders
 Management Commitment

Methods for
Rationale for Accountabilities resolving
managing risk for managing risk conflicting
interests

Risk management
Management
Commit resources performance
Review
metrics

Response to an Risk Management

Democratization of
event or change in Policy
Risk Management
circumstances. Communication
 Risk Management Approach

Nature and types How the level of

Likelihood and
of causes and risk is to be
impact Criteria
consequences determined

Risk Tolerance
Views of Level and Combinations of
stakeholders Acceptance multiple risks
Criteria

[Link]
 Objectives of Risk Assessment

Understand business risks

Identify improvement opportunities

Allocate resources effectively

Get support from the enterprise

Demonstrate due diligence

Meet compliance requirements

[Link]
 Information Asset Inventory

• Anything of value that requires protection

– People, Process, Technology
– Information
– Supporting Infrastructure
– Business processes
• Data Sources:
– Listings of Enterprise Applications
– Listings of Databases
– Software Inventory
– Hardware Inventory
– System Diagrams
– Technical Design Documents

[Link]
 Example Asset Register

Exposure
Asset Name/ Asset DR
Description Level
Description Class. Priority
(H,M,L)

Personnel High 1 Employees M

Personally Identifiable
Client PII High 1 L
Information

Production Company primary web

Medium 1 H
Web server site (no sensitive data)

[Link]
 Calculating Risk (perception)

Source: [Link]

[Link]
 Calculating Risk

Risk = Impact X Probability

[Link]
 Elements of Risk

Risk

Impact Probability

Asset Threat Vulnerability Mitigation

Initiation Success Predisposing

Threat Source Pervasiveness Severity Effectiveness
Probability Probability Conditions

[Link]
 Risk Identification

Licensed from [Link]

Risk Identification Sources

System
Threat
Catalogs Docs

Surveys and
Workshops
Interviews

Vulnerability Audits/ Gap

Assessments Assessments

Previous
Events
 Assess Threats

• Deliberate Attacks • Natural

– Intent – Fire
– Capabilities – Water
– Operational constraints – Earth
– Exploit characteristics – Air

• Unintentional Exposures
– Characteristics
– Work Environment
– Time constraints
 Likelihood Considerations

• Experience and statistics for threat likelihood

• Motivation and capabilities of the attacker
• Exposure to possible attackers
• Accident sources: geographical /weather
• Human errors and equipment malfunction
• Individual and aggregate vulnerabilities
• Effectiveness of existing controls

[Link]
 Vulnerabilities

• Organization
• Processes and procedures
• Management routines
• Personnel
• Physical environment
• Information system configuration
• Hardware, software or communications equipment
• Dependence on external parties

[Link]
 Impact criteria

• Asset classification
• Breaches of information security
• Impaired operations
• Loss of business and financial value
• Disruption of plans and deadlines
• Damage to reputation
• Breaches of requirements

[Link]
 Risk evaluation criteria

• Strategic value of the assets

• Criticality of the assets
• Legal, contractual, and regulatory requirements
• Operational and business importance of
confidentiality, integrity, and availability (CIA)
• Stakeholders expectations
• Damage to reputation

[Link]
 Example Risk Register

Availability (L,M,H)

Overall Risk Rating

Likelihood Success
Integrity (L,M,H)

Attack Initiation

Total Likelihood
Confidentiality

Overall Impact

Likelihood of
Control
Predisposing Effective-
Threat Conditions Vulnerable Entities ness
Lack of communication of
Business objectives are
Business and IT needs Business
not aligned with IT H H H H H H H H M
leads to unintended Operations
strategies.
exposure of data.

Accidental or intentional
Sensitive documents are
duplication and retention
retained beyond useful All data sources. H M M H H H H H L
of data leads to
life
unnecessary exposure.

Lost or stolen laptop leads All servers,

No encryption on
to exposure of sensitive network devices, H L H H H H H H M
almost all laptops
data. and laptops.
Improper handling of data No formal privacy
Employees,
by employees, contractors, awareness, data
contractors, and M M M M H H H M L
or vendors leads to handling, or information
vendors.
exposure of sensitive data. security training.

[Link]
 Risk Treatment

Transfer
/Share
Avoid

Mitigate

Accept
[Link]
 Risk acceptance criteria

• Multiple thresholds and provisions for senior

managers to accept risks
• Ratio of estimated benefit to the estimated risk
• Different acceptance criteria for different classes
of risk
• May include requirements for future additional
treatment

[Link]
 Report

• Executive Summary, Methodology, and Detailed Results

• Share results of assessment - present risk treatment plan
• Eliminates misunderstanding among decision makers and
stakeholders
• Supports decision-making
• Improve awareness and provides new knowledge
• Co-ordinate with other parties and plan responses
• Give decision makers and stakeholders a sense of
responsibility about risks

[Link]
 Re-Assess Risks

• Assessments are an on-going exercise

• Track mitigation strategies
• Re-test control design/effectiveness
• Document test results, corrective
actions, changes in business
needs/requirements.
[Link]
 Future

• Develop risk-aware mission and business processes

• Integrate into enterprise architecture development
• Acquire IT systems with high level of assurance
• Consider threats when deploying new technology
• Agile defense
• Implement robust continuous monitoring programs

[Link]
 Questions

[Link]
[Link]/fvs
THANK YOU!

[Link]/fvs