IS Security &
Risk Management
Organized By :
Tjahjo Adiprabowo Ir, M. Eng.
IV. Risk Management
1.
Risk Assessment
2.
Risk Mitigation
3.
9 Steps Methodology
Approach for Control Implementation
Control Categories
Cost Benefit Analysis
Residual Risk
Evaluation and Assessment
Good Security Practice
Keys for Success
4.2 Risk Mitigation
Risk mitigation, the second process of Risk
Management, involves :
(1 of 2)
Prioritizing
Evaluating
Implementing
The appropriate risk-reducing controls
Recommended from the risk assessment
process.
Risk Mitigation
1.
2.
Approach for Control Implementation
Control Categories
3.
4.
(2 of 2)
Technical Security Controls
Management Security Controls
Operational Security Controls
Cost-Benefit Analysis
Residual Risk
4.2.1 Approach for control
implementation
The rule :
Address the greatest risks
Strive for sufficient risk mitigation
at the lowest cost
with minimal impact on other mission capabilities.
The Risk Mitigation
Methodology
Step 1 : Prioritize Actions
Step 2 : Evaluate Recommended Control
Options
Step 3 : Conduct Cost-Benefit Analysis
Step 4 : Select Control
Step 5 : Assign Responsibility
Step 6 : Develop a Safeguard Implementation
Plan
Step 7 : Implement Selected Control(s)
Risk Mitigation Methodology Flowchart
Step 1 : Prioritize Actions
Based on the risk levels presented in the risk
assessment report, implementation actions are
prioritized.
In allocating resources, top priority should be given
to risk items with unacceptably high risk rankings.
Risks assigned a Very High or High risk level.
These vulnerability/threat pairs will require
immediate corrective actions to protect an
organizations interest and mission.
Output from Step 1
Actions ranking from High to Low
Step 2 : Evaluate Recommended
Control Options
Objective : select the most appropriate control
option for minimizing risk.
The controls recommended may not be the most
appropriate and feasible options for a specific
organization and IT system.
They are analyzed :
Feasibility
Compatibility
User acceptance
Effectiveness
Degree of protection
Level of risk mitigation
Output from Step 2
List of feasible controls
Step 3 : Conduct Cost-Benefit
Analysis
Objective :
to aid management in decision making
to identify cost effective controls
Section 4.2.3 details the objectives and method
of conducting the cost-benefit analysis.
Output from Step 3
Cost-benefit analysis describing
The cost
The benefits
of implementing or not implementing the
controls.
Step 4 : Select Control
Management determines :
The most cost-effective control(s)
For reducing risk to the organizations mission
Based on the results of the cost-benefit analysis.
The controls selected should combine :
Technical control elements
Operational control elements
Management control elements
To ensure adequate security for the IT System and
organization
Output from Step 4
Selected control(s)
Step 5 : Assign Responsibility
Identify :
Appropriate persons who have :
The appropriate expertise
The appropriate skill-sets
To implement the selected controls.
Assign :
responsibility
Output from Step 5
List of responsible persons
Step 6 : Develop a Safeguard
Implementation Plan
The plan should, at a minimum, contain the following information :
Risks (vulnerability/threat pairs) and associated risk levels
(output from risk assessment report).
Recommended controls (output from risk assessment report).
Prioritized actions (with priority given to items with Very High and
High risk level).
Selected planned controls (determined in the basis of feasibility,
effectiveness, benefits to the organization and cost).
Required resources for implementing the selected planned
controls.
List of responsible teams and staff.
Start date for implementation.
Target completion date for the implementation.
Maintenance requirements.
Output from Step 6
Safeguard implementation plan
Step 7 : Implement Selected
Control(s)
Depending on individual situations, the
implemented controls may lower the risk level
but not eliminate the risk.
Output from Step 7
Residual Risk
4.2.2 Control Categories
Introduction (1 of 2)
In implementing recommended controls to mitigate risk, an
organization should consider :
Technical security control
Management security control
Operational security control
Combination of such controls
To maximize the effectiveness of controls for their IT
system and organization.
Trade-offs that an organization will have to consider are
illustrated by viewing the decisions involved in enforcing
use of complex user password to minimize password
guessing and cracking.
Comparison
Introduction (2 of 2)
A technical control requiring add-on security software
may be more complex and expensive than a procedural
control,
But the technical control is likely to be more effective
because the enforcement is automated by the system.
A procedural control might be implemented simply by
means of a memorandum to all concerned individuals and
an amendment to the security guidelines for the
organization,
But ensuring that users consistently follow the
memorandum and guideline will be difficult and will require
security awareness training and user acceptance.
Technical Security Controls
Range : simple to complex
Items involved :
System Architectures
Engineering Disciplines
Security Packages
Mix of :
Hardware
Software
Firmware
All of these measures should work together to secure critical and
sensitive :
Data
Information
IT system functions
Group of Technical Controls
Support
Prevent
Supporting controls are generic and underlie most IT
security capabilities.
These controls must be in place in order to implement
other controls.
Preventive controls focus on preventing security breaches
from occurring in the first place.
Detect and Recover
These controls focus on detecting and recovering from a
security breach.
Technical Security Controls Relationship
Supporting Technical Controls
(1 of 2)
Identification
This control provides the ability to uniquely identify :
Users
Processes
Information resources
To implement other security controls e.g. :
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Accountability
It is mandatory that both subjects and objects be identifiable.
Cryptographic Key Management
Cryptographic keys must be securely managed when cryptographic
functions are implemented in various other controls.
Cryptographic key management includes :
Key generation
Key distribution
Key storage
Key maintenance
Supporting Technical Controls
(2 of 2)
Security Administration
The security features of an IT system must be configured :
System security can be built into :
To meet the needs of a specific installation
To account for changes in the operational environment
Operating system security
The application
System protections
Underlying a systems various security functional capabilities is a base of confidence
in the technical implementation.
This represents the quality of the implementation from the perspective both of :
The design processes used
The manner in which the implementation was accomplished.
Some examples of system protections are :
Residual information protection
Least privilege
Process separation
Modularity
Layering
Minimization of what needs to be trusted
Preventive Technical Controls
(1 of 5)
Authentication
This control provides the means of verifying the identity of a subject
to ensure that a claimed identity is valid.
Authentication mechanism includes :
Passwords
Personal Identification Numbers (PINs)
Emerging authentication technology that provides strong
authentication, e.g. :
Token
Smart card
Digital certificate
Authorization
The authorization control enables
Specification
Subsequent management
Of the allowed actions for a given system, e.g. :
The information owner or the database administrator determines who can
update a shared file accessed by a group of online users.
Preventive Technical Controls
(2 of 5)
Access Control Enforcement
Data integrity and confidentiality are enforced by access controls.
When the subject requesting for access has been authorized to
access particular processes, it is necessary to enforce the
defined security policy.
These policy-based controls are enforced via access control
mechanism distributed throughout the system, e.g. :
MAC sensitivity labels
DAC file permission sets
Access control lists
Roles
User profiles
The effectiveness and the strength of access control depend on :
The access control decisions, e.g. :
How the security rules are configured
The strength of access control enforcement, e.g. :
The design of software or hardware security
Preventive Technical Controls
(3 of 5)
Nonrepudiation
System accountability depends on the ability to ensure that :
Nonrepudiation spans both :
prevention
detection.
It has been placed in the prevention category in this guide
because the mechanisms implemented prevent the successful
repudiation of an action, e.g. :
senders cannot deny sending information
receivers cannot deny receiving it
The digital certificate that contains the owners private key is
known only to the owner.
As a result, this control is typically applied at the point of
transmission or reception.
Preventive Technical Controls
(4 of 5)
Protected Communications
In a distributed system, the ability to accomplish security objectives is
highly dependent on trustworthy communications.
The protected communications control ensures :
integrity
availability
confidentiality
of sensitive and critical information while it is in transit.
Protected communications use :
Data encryption methods
Deployment of cryptographic technologies
To minimize network threats, such as :
Replay
Interception
Packet sniffing
Wiretapping
eavesdropping
Preventive Technical Controls
(5 of 5)
Transaction Privacy
Both government and private sector systems are
increasingly required to maintain the privacy of individuals.
Transaction Privacy Controls protect against loss of privacy
with respect to transactions performed by individual.
Detection and Recovery
Technical Controls (DRTC) (1 of 4)
Detection Controls warn of violations or attempted violations
of security policy.
Recovery Controls can be used to restore lost computing
resources.
They are needed as a complement to the supporting and
preventive measures, because none of the measures in these
other areas is perfect.
DRTC includes :
Audit
Intrusion Detection and Containment
Proof of wholeness
Restore secure state
Virus detection and Eradication
Detection and Recovery
Technical Controls (2 of 4)
Audit
Key elements in the after-the-fact
Detection of
Recovery from
Security breaches are :
The auditing of security-relevant events
The monitoring of system abnormalities
The tracking of system abnormalities
Intrusion detection and Containment
Detect security breaches so that a response can occur in
a timely manner.
Detect a security breach so that an effective response
can be initiated.
Detection and Recovery
Technical Controls (3 of 4)
Proof of wholeness
Analyzes system integrity
Analyzes system irregularities
Identifies exposure threats
Identifies potential threats
Does not prevent violation of security policy but:
Detects violation
Helps determine the type of correction action needed.
Restore Secure State
Enables a system to return to a state that is known to be
secure, after a security breach occurs.
Detection and Recovery
Technical Controls (4 of 4)
Virus detection and Eradication
VDE software installed in a server or user
workstation :
Detects
Identifies
Removes
Software viruses
To ensure system and data integrity
Management Security Controls
(1 of 5)
Management controls focus on the stipulation
of :
Information protection policy
Information protection guidelines
Information protection standards
Which are carried out through operational
procedures
To fulfill the organizations goals and
missions.
Management Security Controls
(2 of 5)
Preventive
Detection
Recovery
Management Security Controls
(3 of 5)
Preventive Management Security Controls :
Assign security responsibility to ensure that adequate
security is provided for the mission-critical IT systems.
Develop and maintain system security plans to document
current controls and address planned controls for IT
systems in support of the organizations mission.
Implement personnel security controls, including :
separation of duties
least privilege
user computer access registration and termination
Conduct security awareness and technical training to
ensure that end users and system users are aware of the
rules of behavior and their responsibilities in protecting the
organizations mission.
Management Security Controls
(4 of 5)
Detection Management Security Controls :
Implement personnel security controls, including
personnel clearance
background investigations
rotation of duties
Conduct periodic review of security controls to ensure that
the controls are effective.
Perform periodic system audits.
Conduct ongoing risk management to assess and mitigate
risk.
Authorize IT systems to address and accept residual risk.
Management Security Controls
(5 of 5)
Recovery Management Security Controls
Provide continuity of support
Develop, test, and maintain the continuity of
operations plan to provide for business
resumption
Ensure continuity of operations during
emergencies or disasters.
Establish an incident response capability to
prepare for, recognize, report, and respond to the
incident and return the IT system to operational
status.
Operational Security Controls
(1 of 4)
Operational controls, implemented in accordance with
a base set of requirements (e.g., technical controls)
good industry practices,
are used to correct operational deficiencies that could be
exercised by potential threat-sources.
To ensure consistency and uniformity in security operations,
step-by-step procedures and methods for implementing
operational controls must be clearly
defined
documented
maintained.
These operational controls includes :
Preventive Operational Security Controls
Detection Operational Security Controls
Operational Security Controls
(2 of 4)
Preventive Operational Controls :
Control data media access and disposal (e.g., physical
access control, degaussing method)
Limit external data distribution (e.g., use of labeling)
Control software viruses
Safeguard computing facility, e.g. :
security guards
site procedures for visitors
electronic badge system
biometrics access control
management and distribution of locks and keys
barriers and fences
Secure wiring closets that house hubs and cables
Operational Security Controls
(3 of 4)
Preventive Operational Controls :
Provide backup capability e.g. :
procedures for regular data and system backups
archive logs that save all database changes to be used in various recovery
scenarios
Establish off-site storage procedures and security
Protect laptops, personal computers (PC), workstations
Protect IT assets from fire damage :
requirements and procedures for the use of :
Provide emergency power source
fire extinguishers
tarpaulins
dry sprinkler systems
halon fire suppression system
requirements for uninterruptible power supplies
on-site power generators
Control the humidity and temperature of the computing facility
operation of air conditioners
operation of heat dispersal
Operational Security Controls
(4 of 4)
Detection Operational Controls :
Provide physical security :
use of motion detectors
closed-circuit television monitoring
sensors and alarms
Ensure environmental security :
use of smoke and fire detectors
sensors and alarms
4.2.3 Cost Benefit Analysis
(1 of 8)
To allocate resources and implement cost-effective
controls, organizations should conduct a cost-benefit
analysis for each proposed control to determine which
controls are required and appropriate for their
circumstances.
The cost-benefit analysis can be :
qualitative
quantitative
Its purpose is to demonstrate that the costs of
implementing the controls can be justified by the
reduction in the level of risk.
For example, the organization may not want to spend
$1,000 on a control to reduce a $200 risk.
Cost Benefit Analysis (2 of 8)
A cost-benefit analysis for proposed new controls or enhanced controls
encompasses the following :
Determining the impact of implementing the new or enhanced controls
Determining the impact of not implementing the new or enhanced controls
Estimating the costs of the implementation. These may include, but are not
limited to, the following:
Hardware and software purchases
Reduced operational effectiveness if system performance or functionality is
reduced for increased security
Cost of implementing additional policies and procedures
Cost of hiring additional personnel to implement proposed policies,
procedures, or services
Training costs
Maintenance costs
Assessing the implementation costs and benefits against system and data
criticality to determine the importance to the organization of implementing
the new controls, given their costs and relative impact.
Cost Benefit Analysis (3 of 8)
The organization will need to assess the benefits of
the controls in terms of maintaining an acceptable
mission posture for the organization.
Just as there is a cost for implementing a needed
control, there is a cost for not implementing it.
By relating the result of not implementing the control
to the mission, organizations can determine whether
it is feasible to forgo its implementation.
Cost Benefit Analysis (4 of 8)
Cost-Benefit Analysis Example:
System X stores and processes mission-critical
and sensitive employee privacy information;
however, auditing has not been enabled for the
system.
A cost benefit analysis is conducted to determine
whether the audit feature should be enabled for
System X
Cost Benefit Analysis (5 of 8)
1)
Impact of enabling system audit feature:
2)
The system audit feature allows the system security
administrator to monitor users system activities
but will slow down system performance
therefore affect user productivity.
Also the implementation will require additional resources.
Impact of not enabling system audit feature:
User system activities and violations cannot be monitored
and tracked if the system audit function is disabled,
and security cannot be maximized to protect the
organizations confidential data and mission.
Cost Benefit Analysis (6 of 8)
3)
Cost estimation for enabling the system audit feature:
Cost for enabling system audit featureNo cost, built-in feature $ 0
Additional staff to perform audit review and archive, per year
$ XX,XXX
Training (e.g., system audit configuration, report generation)
$ X,XXX
Add-on audit reporting software
$ X,XXX
Audit data maintenance (e.g., storage, archiving), per year
$ X,XXX
Total Estimated Costs
$ XX,XXX
Cost Benefit Analysis (7 of 8)
Next Steps :
The organizations managers must determine
what constitutes an acceptable level of mission
risk.
The impact of a control may then be assessed.
The control either included or excluded, after the
organization determines a range of feasible risk
levels.
This range will vary among organizations.
Cost Benefit Analysis (8 of 8)
The following rules apply in determining the use of
new controls:
If control would reduce risk more than needed, then see
whether a less expensive alternative exists.
If control would cost more than the risk reduction provided,
then find something else.
If control does not reduce risk sufficiently, then look for
more controls or a different control.
If control provides enough risk reduction and is costeffective, then use it.
4.2.4 Residual Risk
Implementation of new or enhanced controls can mitigate risk by :
Eliminating some of the systems vulnerabilities (flaws and weakness),
thereby reducing the number of possible threat-source/vulnerability
pairs.
Adding a targeted control to reduce the capacity and motivation of a
threat-source.
For example, a department determines that the cost for installing and
maintaining add-on security software for the stand-alone PC that stores its
sensitive files is not justifiable, but that administrative and physical controls
should be implemented to make physical access to that PC more difficult
(e.g., store the PC in a locked room with the key kept by the manager).
Reducing the magnitude of the adverse impact
For example, limiting the extent of a vulnerability or modifying the nature of
the relationship between the IT system and the organizations mission.
Implemented Controls and
Residual Risk
Explanation (1 of 2)
The risk remaining after the implementation of new or
enhanced controls is the residual risk.
Practically no IT system is risk free, and not all
implemented controls can eliminate the risk they are
intended to address or reduce the risk level to zero.
An organizations senior management, who are
responsible for protecting the organizations IT asset
and mission, must authorize (or accredit) the IT
system to begin or continue to operate.
This authorization or accreditation must occur
at least every 3 years or
whenever major changes are made to the IT system.
Explanation (2 of 2)
The intent of this process is
After the appropriate controls have been put in place
for the identified risks, the senior management will
sign a statement
to identify risks that are not fully addressed and
to determine whether additional controls are needed to
mitigate the risks identified in the IT system.
accepting any residual risk and
authorizing the operation of the new IT system or the
continued processing of the existing IT system.
If the residual risk has not been reduced to an
acceptable level, the risk management cycle must be
repeated to identify a way of lowering the residual risk
to an acceptable level.
4.3 Evaluation & Assessment
In most organizations :
These changes mean that
the network itself will continually be expanded and updated
its components changed
its software applications replaced or updated with newer
versions
personnel changes will occur
security policies are likely to change over time
new risks will surface
risks previously mitigated may again become a concern
Thus, the risk management process is ongoing and
evolving.
4.3.1 Good Security Practice
The risk assessment process is usually repeated at least every 3
years.
Risk management should be conducted and integrated in the
SDLC for IT systems, not because it is required by law or
regulation, but because it is a good practice and supports the
organizations business objectives or mission.
There should be a specific schedule for assessing and mitigating
mission risks.
The periodically performed process should also be flexible
enough to allow changes where warranted,
such as major changes to the IT system and processing
environment due to changes resulting from policies and new
technologies.
4.3.2 Keys for Success
A successful risk management program will rely on :
senior managements commitment;
the full support and participation of the IT team
the competence of the risk assessment team, which must
have the expertise to
apply the risk assessment methodology to a specific site and system,
identify mission risks,
provide cost-effective safeguards that meet the needs of the organization,
the awareness and cooperation of members of the user
community, who must
follow procedures
comply with the implemented controls to safeguard the mission of
their organization,
an ongoing evaluation and assessment of the IT-related mission
risks.
Good Luck
