Ch 13:
Risk Assessment & Mitigation
NhungVT-2020
Identifying Risk
Risk, Vulnerability, and
Threat
Vulnerability
◦ A weakness, security holes or misconfiguration
Threat
◦ Potential danger, activities that can cause harm
Risk
◦ The likelihood that a threat will exploit a vulnerability
Impact
◦ The magnitude of harm that can be caused
Threats and Threar Vectors
• Threat
• Potential danger
• Threar Vector
• Also called Attack Vector
• Method used to activate the threat
• Three primary sources
• External (outsiders)
• Internal (insiders)
• Supply chain (suppliers)
Threats
• Types of threats
• Natural threats
• Hurricanes, floods, etc.
• Malicious human threats: malware, phishing…
• Accidental human threats: mistakenly deleted all
files without backup
• Environmental threats
• Power failures, overheating, etc.
Malicious Insider Threat
• Abuse of legitimate access to harm the company
• Motivations include greed & revenge
• Countermeasures
• Least privilege : as least as possible, just enough to
perform their tasks.
• Job rotation: change job positions periodically
• Separation of duties: at least 2 people work together to
avoid fraud commitment
• Mandatory vacations: offers time for review
Threat Assessments
• Identify and categorize threats
• Identify controls to protect against most serious
threats
• Avoid wasting resources on low-priority threats
Vulnerabilities
• A flaw or weakness that could be
exploited, resulting in a security breach
• Lack of updates
• Default configuration
• Lack of malware protection
• No firewall
• Lack of organizational policies
Risk Management
• Risk cannot be reduced to zero
• Risk management
• Identifying, monitoring, and limiting risks to an
acceptable level
• Residual risk
• The risk remaining after risk management
Risk Management Methods
• Risk avoidance
• Removing any opportunity for the risk to cause a loss
event.
• Ie don’t buy cars to avoid car accidents
• Impractical
• Risk reduction: decrease risks
• Risk transference
• Transfer risks to Insurance companies
• Risk acceptance: remain since it is virtually impossible to
eliminate all risk
• Risk mitigation
• Implementing controls
• Risk deterrence
• Scares away some attackers ,i.e: announce there are
cameras…
Risk Assessment
• Identify assets and asset values
• Identify threats and vulnerabilities
• Prioritize them
• Recommend controls
Quantitative Risk
Assessment
• Estimate money lost per year to a risk
• Single Loss Expectancy (SLE)
• Cost of a single loss
• Annualized Rate of Occurrence (ARO)
• How many times per year the loss will occur
• Annualized Loss Expectancy (ALE)
• ALE = SLE x ARO
Example
• Risk: Employees lose laptops, which must
then be replaced
• A laptop costs $1000
• This is the SLE
• Employees lose a laptop each month
• This is the ARO
• Expected loss is $12,000 per year
• NOTE: This does not consider the risk of
the data on the laptops being exposed
Qualitative Risk Assessment
• Rate risks as "High", "Medium", or "Low"
• Or use a numerical scale, 1 to 10
• Compare risks of attack to a Web server
versus a library workstation with no
Internet access
• Web server: High likelihood, high impact
• Workstation: Low likelihood, low impact
Documenting the
Assessment
• Report identifies risks discovered and
recommended controls
• This report should be kept confidential
• It will help attackers
Risk Metrics
• Mean Time Between Failures (MTBF)
• Time duration between issues.
• Often used to rate disk drives
• Mean Time To Failure (MTTF)
• Like MTBF but for devices that cannot be
repaired
• Mean Time To Recover (MTTR)
• Time duration to recover disaster/problem
Checking for
Vulnerabilities
Methods
• Vulnerability assessments
• Vulnerability scans
• Penetration tests
Attack steps
• Identify IP addresses of targets
• Find open ports with a port scanner
• Fingerprint system to identify OS
• Banner grabbing finds software versions
• Identify vulnerabilities
• Attack
• Data leaks, pivot to other systems, erase logs
Vulnerability Assessment
• Find weaknesses in
• System
• Network
• Organization
• Weaknesses can be found in:
• Logs
• Security policies
• Interviews with personnel
• System testing
Vulnerability Assessment
Steps
• Identify assets and capabilities
• Prioritize assets based on value
• Identify vulnerabilities and prioritize them
based on severity
• Recommend controls to mitigate serious
vulnerabilities
Vulnerability Scanning
• Vulnerability scanner is able to :
• Identify vulnerability
• Identify misconfigurations
• Passively test security controls
• Identify lack of security controls
Results of a Vulnerability
Scan
Open ports
Weak passwords
Default accounts and passwords
Sensitive data
◦ Data Loss Prevention
Security and Configuration errors
Missing patches and other lacking security
controls
False Positives
• Vulnerability scanners often report issues that are
not real problems
• Manual review of the report is essential
Other Assessment
Techniques
• Attempt tailgating and social engineering
• Baseline reporting
• Compare current configuration to baseline
• Code review
• Detect vulnerabilities in source code
• Attack surface review
• Remove unnecessary exposures
Other Assessment
Techniques
• Architecture review
• Examine network segments and DMZ
• Design review
• Physical layout of building
• How applications interact with other applications or
systems
• As businesses grow, poor designs are often created
Credentialed v.
Noncredentialed
• Vulnerability scanners can run
• Credentialed: logged in as administrator
• Deeper level
• More accurate
• or
• Uncredentialed: not logged in
• Will see less of the network
Penetration Testing
• Find a vulnerability and exploit it
• May also show how employees respond to a
security incident
• Common elements
• Verify a threat exists
• Bypass security controls
• Actively test security controls
• Exploit vulnerabilities
Penetration Test
Considerations
• Scope of test must be determined in advance
• Get written authorization or signed contracts
• Unexpected results can occur
• Fuzzing a system may crash it
• Sometimes a test system is used instead of the live
system in use
White, Gray, and Black Box
Testing
• Black box testing
• Testers are given zero knowledge of internal systems
• Often use fuzzing
• White box testing
• Testers have full knowledge of the environment
• Gray box testing
• Testers have some knowledge of the system
Black Hat v. White Hat
• Black hat hackers
• Criminals, who conducted unwanted attacks
• White hat hackers
• Legitimate security professionals, conducting
penetration testing
• Gray hat hackers
• Break the law but have some justification for
it, such as political protest ("Hacktivists")
• "Every way of a man is right in his own
eyes…" –Proverbs 21:2
Hackers and Crackers
• Hackers
• Originally only someone very proficient with
technology
• Defined as a criminal under US Law and in the media
• Crackers
• A hacker who performs malicious acts
Obtaining Consent:
Rules of Engagement
• A written document explaining the
boundaries of a penetration test
Intrusive v. Nonintrusive
Testing
• Intrusive scan
• Attempts to exploit vulnerabilities
• Nonintrusive scan
• Attempts to detect vulnerabilities
• Does not try to exploit it
Passive v. Active Tools
• Passive tool
• Tests in a nonintrusive manner
• Little possibility of compromising a system
• Active tool
• Uses intrusive methods
• Can potentially affect the operations of a
system
Continuous Monitoring
• Monitoring all relevant security controls
• Periodic
• Threat assessments
• Vulnerability assessments
• Risk assessments
• Routine audits and reviews, such as
• User rights and permissions reviews
Identifying Security Tools
Protocol Analyzer (Sniffer)
• Examples
• Wireshark
• tcpdump
• Microsoft's Network Monitor
• Many others
• Unencrypted passwords are easy to see
with sniffers
Routine Audits
• Identify risks
• Verify that policies are being followed
• Are accounts for departing employees disabled
promptly?
• Do administrators have two accounts, one low-
privilege and one high-privilege?
• Are all systems patched?
• Many more questions…
User Rights and Permissions
Review
• A type of audit
• Identifies privileges (rights and permissions)
granted to users
• Checks to see if they are appropriate
• "Permission bloat"
• Users gain more and more privileges as jobs change
Monitoring Logs
• Operating System Logs
• Records basic events
• Windows Event Viewer
• Security – logon and logoff, etc.
• Also audited events
• Application – events recorded by applications
System – startup, shutdown, loading a driver,
etc.
Other Logs
• Firewall logs
• Antivirus logs
• Application logs
• SQL server, Oracle, etc.
• Performance logs
Reviewing Logs
• Tedious, painful process
• Automated log scanners help
• NetIQ
• AlienVault