Security Risk Analysis
Security Risk Analysis & Requirements Engineering
Introduction
Risk Analysis Framework
Assets
Threats
Risks
Vulnerabilities
Analysis
Security Risk Analysis & Management
Definitions 1
The meanings of terms in this area is not universally
agreed. We will use the following
Threat: Harm that can happen to an asset
Impact: A measure of the seriousness of a threat
Attack: A threatening event
Attacker: The agent causing an attack (not necessarily
human)
Vulnerability: a weakness in the system that makes an
attack more likely to succeed
Risk: a quantified measure of the likelihood of a threat
being realised
Security Risk Analysis & Management
Definitions 2
Risk Analysis involves the identification and
assessment of the levels of risk, calculated from the
Values of assets
Threats to the assets
Their vulnerabilities and likelihood of exploitation
Security Risk Analysis & Management
Goals of Risk Analysis
All assets have been identified
All threats have been identified
Their impact on assets has been valued
All vulnerabilities have been identified and assessed
Security Risk Analysis & Management
Problems of Measuring
Risk
Businesses normally wish to measure in money, but
Many of the entities do not allow this
Valuation of assets
Value of data and in-house software - no market value
Value of goodwill and customer confidence
Likelihood of threats
How relevant is past data to the calculation of future probabilities?
The nature of future attacks is unpredictable
The actions of future attackers are unpredictable
Measurement of benefit from security measures
Problems with the difference of two approximate quantities
How does an extra security measure affect a ~10-5 probability
of attack?
Security Risk Analysis & Management
Risk Levels
Precise monetary values give a false precision
Better to use levels, e.g.
High, Medium, Low
High: major impact on the organisation
Medium: noticeable impact (material in auditing terms)
Low: can be absorbed without difficulty
1 - 10
Express money values in levels, e.g.
For a large University Department a possibility is
1,000,000+
High
1,000+
Medium
Low
< 1,000
Security Risk Analysis & Management
Risk Analysis Steps
Identification of assets & business processes
Identification of threats
Identification and assessment of vulnerabilities to
threats
Risk assessment
Security Risk Analysis & Management
Risk Analysis Identification of Assets
Types of asset
Hardware
Software: purchased or developed programs
Data
People: who run the system
Documentation: manuals, administrative procedures, etc
Supplies: paper forms, magnetic media, printer liquid, etc
Money
Intangibles
Goodwill
Organisation confidence
Organisation image
Security Risk Analysis & Management
Risk Analysis
Identification of Threats
Identification of threats - for each group of assets
Identify threats, e.g. for stored data
Loss of confidentiality
Loss of integrity
Loss of completeness
Loss of availability (Denial of Service)
Security Risk Analysis & Management
10
Risk Analysis Process
Analysis
Every company or organisation has some processes
that are critical to its operation
The criticality of a process may increase the impact
valuation of one or more assets identified
So
Identify critical processes
Review assets needed for critical processes
Revise impact valuation of these assets
Security Risk Analysis & Management
11
Risk Analysis
Vulnerabilities 1
Identify vulnerabilities against a baseline system
For risk analysis of an existing system
Existing system with its known security measures and weaknesses
For development of a new system
Security facilities of the envisaged software, e.g. Windows NT
Standard good practice, e.g. BS 7799 recommendations of good
practice
Security Risk Analysis & Management
12
Risk Analysis
Vulnerabilities 2
For each threat
Identify vulnerabilities
Assess levels of likelihood - High, Medium, Low
How to exploit a threat successfully;
Of attempt
Expensive attacks are less likely (e.g. brute-force attacks on encryption
keys)
Successful exploitation of vulnerability;
Combine them
Vulne
ra
Likelihood
of Success
Likelihood of Attempt
bility
Low Med High
Low Low Low Med
Med Low Med High
High Low Med High
Security Risk Analysis & Management
13
Risk Assessment
Assess risk
If we had accurate probabilities and values, risk would
be
Impact valuation x probability of threat x probability of exploitation
Plus a correction factor for risk aversion
Since we haven't, we construct matrices such as
Risk
Impact valuation
Low Med High
Low Low Low Med
Vulnerability
Med Low Med High
High Low Med High
Security Risk Analysis & Management
14
Responses to Risk
Responses to risk
Avoid it completely by withdrawing from an activity
Accept it and do nothing
Reduce it with security measures
Security Risk Analysis & Management
15
