APPLICATIONS SECURITY

Mr. MASSOUD, IT SECURITY EXPERT

MODULE 2: RISK ANALYSIS
Risk management encompasses an enormous amount of what we do as security
professionals.
Actually, risk management comes with just the act of living your life.
Every day you make decisions based on evaluating risk whether it’s deciding if the
milk for your cereal has spoiled or determining if you can make it through the traffic
light before it changes and a car comes through from another direction.
Whereas many people have to make some level of risk assessment in their jobs on a
daily basis, a security professional spends his or her life engaged in constant risk
assessment in order to determine what they can or should be doing. Risk management
can become a very complicated activity, and it is a critical part of an entire life cycle
of security program management.
Many factors feed into a risk assessment, including a variety of regulations that may
apply to your organization.
Once you have performed your risk assessment activities, you can then go about
doing all the work of writing policies and implementing processes and procedures
to handle incidents.
One component of a risk assessment should always be the possibility of a disaster,
whether it’s a natural disaster or a man-made one. Knowing how to effectively
respond in a situation that is unfolding very quickly can help control the situation
and ensure that your organization has a better shot at getting back on its feet
quickly and efficiently.
Having clearly defined processes in this area will remove a lot of the uncertainty
in an unplanned event or situation.
Risk Terminologies
Asset
An asset is an item of value to an institution, such as data, hardware, software, or physical
property. An asset is an item or collection of items that has a quantitative or qualitative value to
a company.
Risk
Risk is the probability or likelihood of the occurrence or realization of a threat.
Vulnerability
A vulnerability can be described as a weakness in hardware, software, or components that may
be exploited in order for a threat to destroy, damage, or compromise an asset.
Threat
A threat is any agent, condition, or circumstance that could potentially cause harm, loss,
damage, or compromise to an IT asset or data asset. The likelihood of the threat is the
probability of occurrence or the odds that the event will actually occur.
Motivation
Motivation is the driving force behind the activity. As an example, hackers can be motivated by
many different reasons. Some common reasons include prestige, money, fame, and challenge.
Risk Source
The source of a risk can be either internal or external. Internal risk can be anything from a
disgruntled employee to a failed hard drive. External risk includes natural disasters such as floods
and man-made events such as strikes and protests
As an example, the risk source might be that the lock on a server cabinet is
broken, whereas the threat is that someone can now steal the server hard drive.
From the standpoint of IT security, a threat is any situation that affects the
confidentiality, integrity, or availability of an IT asset (data, system, software, or
hardware)
some common examples of threats

Natural Disaster
Natural disasters are events over which we have no control, such as bad weather
(hurricanes, snowstorms, tornadoes), fires, floods, earthquakes, and tsunamis.

Malicious Code
Malicious code includes all forms of damaging programs, such as viruses, worms,
Trojans, keyloggers, and so forth. This software is distinguishable in that it is
developed to damage, alter, expose, or destroy a system or data. For example,
viruses are executable programs that replicate and attach to and infect other
executable objects. Some viruses also perform destructive or discreet activities
(payload) after replication and infection is accomplished.
some common examples of threats

Breach of Physical Security

A breach of physical security can be instigated by a trusted insider or an
untrusted outsider. Intruders, vandals, and thieves remove sensitive information,
destroy data, or physically damage or remove hardware such as hard drives and
laptops.

Hacker Attack
Hacker attacks generally result in stolen, lost, damaged, or modified data. Loss
or damage to an organization’s data can be a critical threat if there are no
backups or external archiving of the data as part of the organization’s data
recovery and business continuity plan. Also, if the compromised data is of a
confidential nature, this can also be a critical threat to the organization,
depending on the potential damage that can arise from this compromise.
some common examples of threats

Distributed Denial of Service

A distributed denial-of-service (DDoS) attack on a network or web-based system
is designed to bring down the network or prevent access to a particular device by
flooding it with useless traffic.
DDoS attacks can be launched in several ways. What was done manually with
simple tools before is now automated and coordinated, on a massive scale.
The attack might leverage networked devices, such as the famous Mirai malware-
driven botnet. Or, an attacker may also use more advanced DDoS tools such as
Tribal Flood Network, Shaft, or Low Orbit Ion Cannon. Currently, most DDoS
attacks are launched via botnets. Regardless of the technique, the result is that
the targeted system has a reduced or limited ability to communicate.
Identifying Vulnerabilities

One big task for a security professional is that of identifying vulnerabilities. A

vulnerability is a weakness in a system design, in the implementation of an
operational procedure, or in how software or code was developed (for example,
bugs, backdoors, vulnerabilities in code, and so forth). Vulnerabilities may be
eliminated or reduced by the correct implementation of safeguards and security
countermeasures.
When dealing with risk, software is one area with which the security professional
must be very concerned
Type of Softwares

Firmware
Firmware is software that is usually stored in ROM and loaded during system power-up. As
firmware is embedded, it can be used to hide malicious code such as firmware rootkits.
Operating System
Operating system software is loaded on workstations, servers, laptops, tablets, and smartphones.
Unpatched OSs can be a huge risk, especially for servers and Internet-connected systems.
Configuration Files
These files consist of the configuration file and configuration setup for devices. Configuration
files can be altered to run unauthorized programs or batch files.
Application Software
This software is made up of the application or executable file that is run on a laptop,
workstation, or smartphone. Unpatched applications are among the biggest targets of attackers
today. In earlier years, desktop applications such as Adobe Reader and Microsoft Office had been
the target of exploits. Today, applications intended for mobile devices are popular targets.
Activity I :Tracking Vulnerabilities in
Software
Software vulnerabilities are tracked by the US Computer Emergency Readiness Team
(US-CERT) in a publicly accessible database. Once a vulnerability is discovered, it’s
given a number and added to the database. Each vulnerability or exposure included
on the Common Vulnerabilities and Exposures (CVE) list has one common,
standardized CVE name.
It is important to understand how CVEs are structured.
1. Go to [Link]
2. Click the button labeled Vulnerabilities- CVE.
3. In the Keyword Search text box, enter CVE-2018-5347.
4. Identify the vulnerability associated with Seagate Media Server.
5. Now search for the most current vulnerability listed. How many vulnerabilities have
been posted this year?
Patching Vulnerabilities

Software vendors are well aware that there is no way to create perfect code, so
they must protect themselves from the risk and potential liability that may result
from a software vulnerability that could potentially be exploited by a hacker.
When vulnerabilities are discovered in code, the vendor can respond in several
ways. In one approach, the vendor may announce that the program or application
is no longer supported. For example, if someone finds a problem with Windows
ME, don’t expect Microsoft to address it. If a vendor still supports the product,
such as Microsoft and Windows 10, it will most likely offer an update or patch to
fix the discovered vulnerability.
Patching Vulnerabilities

The process from before a vulnerability is discovered to when it is patched

typically follows these stages:
1. Vendor releases software and code with unknown vulnerabilities to the general
public.
2. A vulnerability is discovered.
3. A countermeasure or patch is created by the vendor.
4. The patch is released and made available to the public.
5. The patch is downloaded and installed on the affected systems or devices.
Operational Risks

Risk isn’t just associated with software; it also is related to new products, new
technologies, and user behavior. Organizations face many types of risks.
Operational risk is risk that is associated with operations. Operational risk is
defined by a company’s internal and external practices.
Such risk can be brought about by the location in which a company does business,
or it can be defined by internal and external sources, such as government
agencies and regulatory requirements. We assume processes will work and
systems will perform as expected; however, this is not always the case. In the
real world, we are forced to deal with operational risk and the fact that
something may go wrong at any moment.
Real World Scenario : Operational Risks
in the Oil Industry
Organizations face many types of organizational risks. Though not specifically IT
related, the BP oil spill in the Gulf of Mexico in 2010 offers a good example of
the potential high cost of operational risk. The initial explosion killed 11 men
working on the platform and injured 17 others.
After the explosion, oil continued to spill from the well for three months. By
November
2010, BP stated that the cost of the oil spill had grown to $40 billion. The spill is
believed to have released about 5 million barrels of oil. The impact of the
released oil continued even after the well had been capped. This event was the
largest accidental marine oil spill in the history of the US petroleum industry.
Outsourcing

Organizations should go through a source strategy to determine what tasks should

be completed by employees, contractors, or third parties. Outsourcing is one
common approach.
Outsourcing can be defined as an arrangement in which one company provides
services for another company that may or may not have been provided in-house.
Outsourcing has become a much bigger issue in the emerging global economy,
and it is something security professionals need to review closely. There will
always be concerns when ensuring that third-party providers have the requisite
levels of information security.
Real World Scenario : Outsourcing of
MRIs Is on the Rise
In the new world of global outsourcing, you may go for an MRI to a facility in
Kansas and have the results sent over the Internet to a radiologist in India who
examines the results and makes a diagnosis.
This allows medical facilities to cut local staff or no longer to keep someone for
late night and early morning shifts locally.
Outsourcing has become much more common in the IT field throughout the
course of the last decade or so. In some cases, the entire information
management function of a company is outsourced, including planning and
business analysis as well as the installation, management, and servicing of the
network and workstations. The following services are commonly outsourced:
■ Application/web hosting
■ Check processing
■ Computer help desk
■ Credit card processing
■ Data entry
■ Payroll and check processing
Crucial to the outsourcing decision is determining whether a task is part of the
organization’s core competency or proficiency that defines the organization.
Security should play a large role in making the decision to outsource because
some tasks take on a much greater risk if performed by someone outside the
organization.
Any decision should pass a thorough business process review.
Activity II : Outsourcing Issues to Review

Outsourcing is common in today’s corporate environment. This exercise will provide

you with a basic checklist of items to review should your company decide to outsource
IT services.
1. Has your company decided to outsource?
2. If so, have you developed a service level agreement (SLA)?
3. Does the outsourcing partner have a business continuity plan?
4. Does the outsourcing partner operate in another country? If so, have they agreed to
adequate levels of protection of personally identifiable information (PII)?
5. Do you have references from other vendors with whom the outsourcing partner has
done business?
When outsourcing is to occur, issues related to IT will be an area of real concern.
As in the case of the outsourced MRI diagnosis, sensitive and personal data is
often involved with outsourced services. This creates regulatory concerns, most
commonly involving HIPAA or the Sarbanes-Oxley (SOX) Act. Many IT departments
have mission statements in which they publicly identify the level of service they
agree to provide to their customers.
This may be uptime for network services, availability of email, response to help
desk calls, or even server uptime. When any of these services are outsourced,
the level of service becomes a real concern. One way the outsourcing partner
can address this is by means of a service level agreement (SLA). SLAs define
performance targets for hardware and software.
Some types of SLAs

Help Desk and Caller Services

Help desk is a commonly outsourced service. One way an outsourcing partner
may measure the service being provided is by tracking the abandon rate (AR).
The AR is simply the number of callers who hang up while waiting for a service
representative to answer
Uptime and Availability Agreements
Another common SLA measurement is an uptime agreement (UA). UAs specify a
required amount of uptime for a given service. As an example, a web hosting
provider may guarantee 99.999 percent uptime. UAs are commonly found in the
area of network services, datacenters, and cloud computing.
Partnerships

Somewhat akin to outsourcing in terms of the security risks that they present are
partnerships.
A partnership can be best defined as a type of business model in which two or
more entities share potential profit and risk with each other, whereas with
outsourcing, the customer assigns the work to the contractor. Once the project
or service has been provided, the customer pays the contractor and the
relationship ends.
Partnerships are different; they are much more like a marriage. With marriage,
for example, you might want to execute a prenuptial agreement; likewise, in
partnerships, you need to be prepared should things go wrong and the
partnership ends
Risks related to partnerships

Loss of Competency
Once a partner begins providing a service, the other may lose the in-house ability to provide the same service.
Should the partnership end, the company is forced to deal with the fact that this service can no longer be
supported. Even worse, the partner may now become a competitor.
Broken Agreements
Partnerships don’t always work out. In situations where things go wrong, there are costs associated with
switching services back in house.
Service Deterioration
Although the partner may promise great things, can they actually deliver? Over time, do they deliver the same
level of service or does it deteriorate? Metrics must be in place to monitor overall quality. Depending on the
task, the level of complexity, or even issues such as a growing customer base, the partner may not be able to
deliver the product or service promised.
Poor Cultural Fit
Some partners may be in other regions of the country or another part of the world. Cultural differences can play
a big part in the success of a partnership. Once a partnership is formed, it may be discovered that incentives to
provide services and products don’t align or that top-level management of the two companies are quite
different.
Real World Scenario : Partnerships Don’t
Always Last
Microsoft and IBM developed a partnership in 1988 to deliver a new operating
system known as OS/2.
The partnership between these two tech giants was designed to replace the
existing DOS operating system with the new OS/2 operating system that could
run new software as well as being backward-compatible.
What IBM did not know was that Microsoft was also designing Windows NT on its
own, and it would eventually pull away from IBM and abandon the OS/2 platform
to move forward with its own operating system.
Microsoft introduced Windows NT in July 1993 and went on to become the
dominant player in operating systems and office application software.
OS/2 was not successful for IBM, and by 2004 IBM had also abandoned the PC
market and sold those assets to Lenovo.
Mergers and Acquisitions

Mergers and acquisitions are even closer relationships than partnerships. A

merger can be defined as the combination of two or more commercial companies
into a single surviving entity.
Businesses that have similar cultures, overlapping target audiences but
individually reaching those audiences differently, may work better as a merged
entity. To lean on a business buzzword, the merger creates a synergy that
potentially could benefit both companies.
Take the example from 2017 when Amazon, the online shopping giant, merged
with Whole Foods, the brick and mortar chain of organic grocery stores. Between
Amazon’s reach and delivery and Whole Food’s mass appeal to those wishing to
buy organic foods, the merger has been an overwhelming success for both
parties.
Regulatory
Sarbanes-Oxley : The Sarbanes-Oxley (SOX) Act of 2002 was passed to protect
investors from egregious accounting irregularities like those seen in the early 2000s.
PCI DSS : The Payment Card Industry Data Security Standards (PCI-DSS) is a set of
requirements regulating how credit card data is used, stored, and transmitted.
HIPAA : The Health Insurance Portability and Privacy Act was passed into law in 1996
and, among other things, required the establishment of national standards to protect
electronic health care transactions and records.
FISMA : The Federal Information Security Management Act was passed in 2002 and
requires federal agencies to develop, document, and implement information security
policies, practices, and infrastructure to protect the information the agency is
responsible for.
The Gramm-Leach-Bliley Act : The Gramm-Leach-Bliley Act was passed in 1999 and is
named for the three legislators who co-sponsored the legislation: Phil Gramm, Jim
Leach, and Thomas Bliley
FFIEC The Federal Financial Institutions Examination Council (FFIEC) is responsible for
developing principles and standards for the examination of financial institutions in
accordance with the Federal Institutions Regulatory and Interest Rate Control Act
(FIRIRCA) of 1978, as well as the Federal Institutions Reform, Recovery, and
Enforcement Act of 1989.
Enterprise Resilience

Enterprise resilience is an approach to risk management that anticipates disruptions,

better ensures recovery, and protects business profitability. Risk-intelligent
organizations elevate resiliency to a broad level of concern and bake it into the DNA
of their enterprise with powerful processes, well-trained employees, and robust
systems. The goal of such organizations is to be proactive and adaptive in response to
disruptions, whatever form they take. Resiliency goes beyond minimizing losses to
include preserving shareholder value, finding competitive advantage in the ability to
manage risk well, and growing the top line.

Enterprise resilience’s broad definition includes business continuity, emergency

management, and disaster recovery for the physical and logical infrastructure and for
workforce protection. Revenue continuity is at the heart of the organization in order
to remain open, or to get back up and running as soon as possible. The budget is the
result of the brain balancing necessity against luxury.
Risks with Data

Data is the lifeblood of many organizations. Although the doctor’s office of our
childhood had a mountain of files, folders, and documents behind the
receptionist’s desk, today a computer holds the same information in a digital
format. From the security professional’s standpoint, there are two key areas to
consider: data at rest and data in transit.
Data at rest can be stored in hard drives, external storage, CDs, DVDs, or even
thumb drives. What is data at rest? Well, security expert Bruce Schneier
describes data at rest as “a way for someone to communicate with himself
through time.”
Data at Rest

A wide variety of products are available to encrypt data in existing disk and
media drive products. Data-at-rest encryption options include software
encryption, such as encrypted file system (EFS) and VeraCrypt.
There is also the option of hardware encryption. Two well-known hardware
encryption options are the Hardware Security Module (HSM) and the Trusted
Platform Module (TPM).
Data in Transit

The second concern is when data is in transit. Anytime data is being processed or moved from one location to
another, it requires proper controls. The basic problem is that many protocols and applications send information
via clear text. Services such as email, web, and
FTP are not designed with security in mind and send information with few security controls and no encryption.
Here are some examples of insecure protocols:
FTP Clear text username and password
Telnet Clear text username and password
HTTP Clear text
SMTP Username and password, along with all data passed in the clear
For data in transit that is not being protected by some form of encryption, there are
many dangers including these:
■ Eavesdropping
■ Sniffing
■ Hijacking
■ Data alteration
Changing Network Boundaries

Another question that increasingly concerns security professionals is who has the
data. With the rise of cloud computing, network boundaries are harder to define.
A network boundary is the point at which your control ends. Cloud computing
does away with the typical network boundary.
This type of de-perimeterization and the constantly changing network boundary
create a huge impact, as historically this demarcation line was at the edge of the
physical network, a point at which the firewall is typically found. The concept of
cloud computing represents a shift in thought in that end users need not know
the details of a specific technology. The service is fully managed by the provider.
Users can consume the service at a rate that is set by their particular needs. This
on-demand service can be provided at any time.
Cloud-based service providers
Risks of Personal Devices on Corporate
Networks
The tech world has changed a great deal from just a decade ago. If you approach
individuals and ask if they have a smartphone or tablet computer, the answer is
very likely yes to one or both questions.
Barely over a decade ago, the same people would probably have had a cell
phone, but smartphones were not very common. Today, not only do these same
individuals all have smartphones, but most likely they bring these devices with
them to work.
And finally, they may or may not connect them to the company’s infrastructure.
Determining whether this is allowed is the responsibility of the organization, and
it will require the creation of a bring your own device (BYOD) or bring your own
technology (BYOT) policy.
Real World Scenario : What Happens
When You Ignore Smartphone Security?
With so many mobile devices in use today, it is imperative that organizations
have policies that control or restrict them.
While taking smartphone security seriously is the smart thing to do, there are
many whose roles require them to secure their phones. For example, the security
of the smartphones of world leaders is a very serious matter. White House policy
is to swap out the US president’s smartphone every month to help mitigate the
risk of device tampering or malware insertion.
The Risk Assessment Process

Once a company has an IT security architecture in place, a risk assessment is

needed to identify weaknesses and gaps in the deployment of controls and to
identify more accurately what areas require the highest level of protection.
All companies have only a limited amount of funds, and those funds must be
spent wisely. This means spending the funds in areas that need the most
protection. The purpose of the risk assessment is to evaluate risks in terms of the
likelihood and the magnitude of an impact, to determine a response strategy,
and to monitor progress in reducing the threat.
The risk assessment will also identify a baseline for their current level of
information security. This baseline will form the foundation for how that
organization needs to increase or enhance its current level of security based on
the criticality or exposure to risk that is identified during the risk assessment.
Asset Identification

Information and systems must have value to determine their worth.

Asset identification is the process of identifying all of the organization’s assets. A good inventory
management system can help greatly in identifying assets. Just keep in mind that assets can be
both tangible and intangible.
The following assets commonly are examined:
■ Tangible
✓ Documentation
✓ Data
✓ Hardware
✓ Software
■ Intangible
✓ Reputation (goodwill)
✓ Services
Once all assets are identified, the individuals assessing them must ask more than
just what the asset originally cost. They must also start to consider the return on
investment of any potential control that may be used. Other key considerations
are as follows:
■ What did the asset cost to acquire or create?
■ What is the liability if the asset is compromised?
■ What is the production cost if the asset is made unavailable?
■ What is the value of the asset to competitors and foreign governments?
Information Classification
Information classification strengthens the organization in many ways. Labeling
information secret or strictly confidential helps employees see the value of the
information and give it a higher standard of care. Information classification also
specifies how employees are to handle specific information. For example, company
policy might state, “All sensitive documents must be removed from the employee’s
desk when leaving work. We support a clean desk policy.”
There are two widely used information classification systems that have been adopted.
Each is focused on a different portion of the CIA security triad. These two approaches
are as follows:
■ Government Classification System This system focuses on confidentiality.
■ Commercial Classification System This system focuses on integrity.

The governmental information classification system is divided into the categories:

Unclassified, Confidential, Secret and Top Secret
The commercial information classification system is focused not just on
confidentiality but also on the integrity of information; therefore, it is categorized as
public, sensitive, private, and confidential
Governmental information classification
Commercial information classification
Real World Scenario : Does Reputation
have a value?
Although we typically think of assets as something tangible, an asset can also be
intangible. Reputation is one good example.
As businesses have grown larger and the Internet has increased the ability for
news stories to move quickly around the world, companies must work harder at
protecting their reputation. The experiences of global organizations such as BP,
Johnson & Johnson, and FEMA demonstrate how protecting corporate reputations
means moving beyond compliance to manage the corporate image.
Should customers decide that the company has poor practices or has failed to
provide effective security controls, billions of dollars could be lost.
Risk Assessment

With an organization’s assets inventoried, valued, and classified, the next step
can begin. This step, the risk assessment, is where potential risks and threats are
identified. These activities are typically carried out by a risk assessment team,
and the likelihood of the threat is determined. The team is tasked by top
management with identifying threats and examining the impact of the identified
threats.
This process can be based on real dollar amounts or on non-dollar values. When
non-dollar values are used, the team typically determines the minimum required
security controls based on an aggregate score. One common approach is to
determine the aggregate by combining the identified vulnerabilities as they apply
to confidentiality, integrity, and availability of the asset. Before we look at
qualitative and quantitative risk assessment, let’s briefly review some facts
about the team that will be carrying out this project.
The Risk Management Team

The risk management team is responsible for identifying and analyzing risks. Its
members should consist of managers and employees from across the company.
After the purpose of the team is established, the team can be assigned
responsibility for developing and implementing a risk management program
This team should be led by someone high enough up the corporate structure to
communicate easily with senior management and obtain the funding that will be
needed for the risk assessment process to be a success. A successful outcome can
be measured in many different ways. A success may mean that the team is able
to decrease insurance costs, reduce attacks against the company’s website, or
verify compliance with privacy laws.
Risk Assessment Types

■ Quantitative Risk Assessment : This method assigns a cost (monetary value) to

the elements of risk assessment and the assets and threats of a risk analysis.

■ Qualitative Risk Assessment : This method ranks threats by nonmonetary values

and is based on scenario, intuition, and experience.
Quantitative Analysis

Thus far, we have discussed building a risk management team that has the support of senior
management, identifying tangible and nontangible assets, and starting to identify potential
threats. The impact of these threats must be measured in some way. One approach is to assess
the threat in dollar terms. The team is simply asking the question, What would this cost?
A threat may not result in a loss. For a loss to occur, the threat must be coupled with a
vulnerability. The vulnerability could be the penetrability of a hollow-core server room door. Or,
maybe it’s the lack of a hardened backup facility elsewhere. It might even be the lack of video
surveillance in the reception area. The resulting loss could be any of the following:
■ Financial loss
■ Danger or injury to staff, clients, or customers
■ Breach of confidence or violation of law
■ Exposure of confidential information
■ Theft of equipment, hardware, or software
Calculating Loss
To start the calculation of loss, you would need to quantify all elements of the
process, including the value of the asset, the impact, and the threat frequency. Here
are the steps for doing this:
1. Determine the asset value (AV) for each information asset.
2. Identify threats to the asset.
3. Determine the exposure factor (EF) for each information asset in relation to each
threat.
4. Calculate the single loss expectancy (SLE).
5. Calculate the annualized rate of occurrence (ARO).
6. Calculate the annualized loss expectancy (ALE).

NB : Calculation of loss is a time-consuming process because it must be done for all

assets.
The six major elements of quantitative
risk analysis
The two most widely used quantitative risk assessment formulas are as follows:
SLE = AV × EF and ALE = ARO × SLE

The strength of a quantitative risk assessment is that it assigns dollar values.

Dollar values are easy to understand. If someone says that a potential threat
coupled with a vulnerability could result in a $1 million loss, this value is easy for
management to work with and conceptualize.
The primary disadvantage of quantitative risk assessment is that because it is
dollar-based, the team must attempt to compute a dollar value for all elements.
This is time-consuming, and some qualitative measures must be applied to
quantitative elements.
Because this is such a huge task, quantitative assessments are usually performed
with the help of automated software tools. These tools can help with trend
analysis and to look for patterns over time. Trend analysis examines historical
loss data to determine patterns in loss frequency or loss severity. As an example,
hurricanes along the Atlantic coast are becoming more destructive. Four out of
the five most costly Atlantic hurricanes in US history have occurred since 2012.
Activity III: Calculating Annualized Loss
Expectancy
A multinational corporation loses 300 laptops annually and these laptops are
valued at $850; would they take out an insurance policy to cover the costs of
replacement if the insurance premiums were $21,250 monthly?
Activity IV : Calculating Annualized Loss
Expectancy
As a security practitioner for a medium-sized firm, you have been asked to
determine the ALE for a file server. Your organization has installed a file server
with data valued at $25,000. The organization uses the file server to allow
remote offices to upload their daily records to be processed the following
morning. Currently, this server is not fully patched and does not have an antivirus
program installed. Your research indicates that there is a 95 percent chance that
the new file server will become infected within one year. If such an infection
were to occur, you estimate that 75 percent of the data value could be lost.
Without antivirus, there’s a good chance that recovering the missing files and
restoring the server could require up to four hours and divert the support team
from other duties. An approved vendor has offered to sell a site license for the
needed software for $175.
1. Examine the exposure factor.
2. Determine the SLE.
3. Evaluate the ARO.
4. Calculate the ALE.
Qualitative Analysis
The second method in which the risk assessment can be completed is by qualitative means.
Qualitative risk assessment is scenario-based and does not attempt to assign dollar values
to the components of the risk analysis. Part of this process requires the team to perform
extreme scenario planning and look at worst-case scenarios. As an example, what if a hurricane
hit your surfboard manufacturing facility on Galveston Island? How bad could it
be? It’s like playing a game of “what if?”
A qualitative assessment ranks the potential of a threat and sensitivity of assets by grade
or scale such as low, medium, or high. You can see an example of this in NIST 800-53
([Link] This document assigns the potential impact on confidentiality,
integrity, and availability (CIA) using the values low, medium, and high. You will
want the support of a team of individuals to help you assess potential risks, and you should
incorporate stakeholder input into impact-level decisions on the controls needed to protect
the CIA of identified assets.
Qualitative Analysis Scale

■ Low Minor inconvenience; can be tolerated for a short period of time but will
not result in financial loss
■ Medium Can result in damage to an organization, cost a moderate amount of
money to repair, and result in negative publicity
■ High Will result in a loss of goodwill between the company and client or
employee; may result in a large legal action or fine, or cause the company to
lose significant revenue or earnings
HANDLING RISKS

■ Avoid To avoid the risk means to eliminate the risk, to withdraw from the
practice, or to not become involved. this may be a viable option, there may also
be an opportunity cost associated with avoiding the activity.
■ Accept To accept the risk means that it is understood and has been evaluated.
Senior management has made the decision that the benefits of moving forward
outweigh the risk. If those in charge have not been provided with good data on
risk, or have made invalid assumptions, poor choices may be made. This can give
rise to disasters with global impact (BP, Fukushima, Chernobyl and so on).
■ Transfer To transfer the risk is to deflect it to a third party. For example,
insurance is obtained.
■ Mitigate To mitigate the risk means that a control is used to reduce the risk.
For example, installing a firewall is one method in which risk can be mitigated.
HANDLING RISKS

Just keep in mind that you can never eliminate all risk. There will always be
some remaining residual risk.
There is also inherent risk, defined as the risk of carrying out a specific activity.
As an example, the inherent risk of riding a motorcycle is that you might get hit
by a car.
A particular risk may be decidedly left unmitigated or controlled in a manner
that would normally be unacceptable. That risk would be an exemption to the
typical risk management process. Exemptions are handled on a case-by-case
basis, and as the name implies, they are strictly against the norm. An
organization is expected to have prepared for such an occurrence through an
exemption policy. The policy would dictate what management levels are required
to approve the exemption, how it’s documented, and how it will be monitored.
HANDLING RISKS

Finally, risk deterrence is having some process, policy, or system in place that
discourages others from exploiting a vulnerability that, if exploited, would
realize the risk. For example, what if despite all of the mitigating controls in
place, a server of top secret military plans is accessible from the Internet? A risk
deterrent is the law in place that, when enforced, would put an attacker in
prison for exploiting the server.
Regardless of what you decide, you should incorporate stakeholder input into
your decisions on how to deal with the identified risk. With so many risks to
consider, the best place to start is with those that have a high-risk score. These
items have the potential to cause great harm to the organization and should be
addressed first. There are sometimes exceptions, such as when loss of life is a
factor.
Business Continuity Planning

In general terms, business continuity planning is the formation of a plan on what

to do should the business suffer an interruption. The interruption does not
necessarily have to be a disaster or calamitous event, but the term often is
(mistakenly) interchanged with disaster recovery planning. Disaster recovery
planning is a subset of business continuity planning.
Business continuity planning is a broader term, and it includes the strategy to
resume a business whether it has been interrupted by a minor event or a major
disaster.
Business impact analysis concepts
Recovery Point Object (RPO): RPO is how much time a company can last without its data before it
affects operations. This is also known as acceptable downtime; if a company agrees that it can be
without data for three hours, then the RPO is three hours. If the IT systems in a company suffer a
loss of service at 13:00 hours, then the RPO would be 16:00 hours. Any repair beyond that time
would have an adverse impact on the business.
Recovery Time Object (RTO): RTO is the time that the company has been returned to an
operational state. In the RPO scenario, we would like the RTO to be before 16:00 hours. If the
RTO is beyond 16:00 hours, then once again it has an adverse impact on the business.
Mean Time to Repair (MTTR): MTTR is the average amount of time it takes to repair a system. If
my car broke down at 14:00 hours and it was repaired at 16:00 hours the MTTR would be two
hours.
Mean Time Between Failures (MTBF): MTBF shows the reliability of a system. If I purchase a new
car for $50,000 on January 1 then it breaks down on January 2, 4, 6, and 8, I would take it back
to the garage as the MTBF would be pretty high and for $50,000, I want a car that is more
reliable.
Mean Time to Failure (MTTF): MTTF is the predicted lifespan of a system. Normally, an IT system
is expected to last about five years, therefore its MTTF is five years. If I bought a car in 1960 and
I had to scrap it in 1992, the MTTF of the car would be 32 years.
NB : RPO is the acceptable downtime, whereas RTO is the return to an operational state.
Disaster Recovery

Disaster recovery is planning for not only how you would keep the business going
as best as possible in the case of a disaster, whether natural or man-made, but
how to fully restore operations.
There are many details to consider when developing a disaster recovery plan, but
typically three different sets of controls should be in place.
The first is preventive, trying to ensure that something bad doesn’t happen.
The second is detective, to be able to identify when something bad does happen.
And, finally, there is the corrective control, needed for recovery after disaster
strikes.
Disaster Recovery strategies
• Backups Backups to tape or other external media that can be sent off-site are critical in
ensuring you can get your systems back up and running. However, you may also consider local
backups to external disks to have something you can run the systems from quickly in case you
haven’t lost all operations locally.
• Replication Some systems may be replicated to other locations. This replication may be periodic
or live depending on the needs your data has and how often it changes. Replication allows you to
switch over to another system in case of failure in your primary location.
• Backup facilities You will likely need a place to run your operations out of if your facility is
significantly impacted.
• Local mirrors This might be done via RAID to ensure a catastrophic loss of data doesn’t happen.
• Surge protectors These can help protect your systems against catastrophic failure.
• Uninterruptible power supply (UPS) A UPS can give your systems the ability to gracefully shut
down and transfer control to another system or location in the event of a power outage.
• Generator Should a power outage occur, a generator can help keep your systems operational for
a period of time.
Review Questions
1. Which of the following best describes a partnership?
A. The combination of two or more corporations transferring the properties to one surviving corporation
B. Two or more persons or companies contractually associated as joint principals in a business
C. Obtaining goods or services from an outside supplier
D. A condition in which a business cannot meet its debt obligations

2. In what way is outsourcing different from a partnership?

A. Outsourcing only occurs when products come from third countries, whereas partnerships occur within the same country.
B. Both use in-house labor to create products for themselves.
C. One uses in-house labor, whereas the other contracts the labor from a partner.
D. One uses an outside supplier, whereas the other combines the two entities.

3. Which of the following is not an issue to consider with cloud computing?

A. Physical location of data
B. Sensitivity of data
C. Hiring practices
D. Disaster recovery plans
4. Which of the following is not an advantage of quantitative risk assessments?
A. Examination of real threats
B. Fast results
C. Real numbers
D. Dollar values

5. Which of the following is the formula for SLE?

A. SLE = AV × EF
B. SLE = AV / EF
C. SLE = ARO × EF
D. SLE = ARO × AV

6. Which of the following is not an advantage of qualitative risk assessments?

A. Speed
B. Use of numeric dollar values
C. Based on CIA
D. Performed by a team
7. Which of the following is the formula for ALE?
A. ALE = AV × ARO
B. ALE = ARO x SLE
C. ALE = SLE / ARO
D. ALE = AV / ARO

8. Which of the following is the approach for dealing with risk that incurs an ongoing continual cost from a third party?
A. Accept
B. Avoid
C. Mitigate
D. Transfer

9. Implementation of a firewall best maps to which of the following?

A. Accept
B. Avoid
C. Mitigate
D. Transfer

10. The government-based information classification model is based on which of the following?
A. Confidentiality
B. Availability
C. Integrity
D. Service level
THANKS