1 / 26

Lesson 1

Lesson 1. Overview and Risk Management Terminology. Course Overview. Risk Management Definition Risk Management Terminology Risk Management Issues Process and Methodology for Conducting Risk Management. ISSO Strategic Goals, Objectives, and Actions.

Mercy
Télécharger la présentation

Lesson 1

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Lesson 1 Overview and Risk Management Terminology

  2. Course Overview • Risk Management Definition • Risk Management Terminology • Risk Management Issues • Process and Methodology for Conducting Risk Management

  3. ISSO Strategic Goals, Objectives, and Actions • Defining and institutionalizing risk management for ISSO and their customers • Define the process • Get management support • Educate the workforce • Practice risk management

  4. Objective 1 • At the end of this part of Lesson 1, you will be able to describe what Risk Management is the elements of the Risk Management Process

  5. Security Management • Managing the risks to an organization’s mission

  6. Risk Defined • “The combination of events harmful to an entity’s desired state of affairs, the chance that the events will take place, and the consequences of their occurrence, as a function of time.” NSA Corporate Plan for INFOSEC Action, April 1996

  7. Management Defined • The art or manner of controlling the movement or behavior of something • To have charge of; direct; conduct; administer New World Dictionary of the American Language

  8. Risk Management • “The total process to identify, control, and manage the impact of uncertain harmful events, commensurate with the value of the protected assets.” National Information Systems Security Glossary, NSTISSI No. 4009 and AFR 205-16, AFR 700-10

  9. Risk Management -Simply Put • Determine what your risks are and then decide on a course of action to deal with those risks.

  10. Balance Sheet Countermeasure Costs Risk Costs Aim of Risk Management • To aid managers strike an economic balance between the costs associated with the risks and the costs of protective measures to lessen those risks

  11. Elements of the Risk Management Process • Risk Assessment • Mission/Impact Analysis • Identification of Critical Assets • Threat Analysis • Attack/Vulnerability Analysis • Risk Mitigation • Countermeasures Development • Risk Decision • Management’s Selection of Countermeasures for Implementation

  12. Objective 2 • At the end of this part of Lesson 1, you will be able to match risk management terms with their definitions.

  13. Risk Assessment • A study of threats and vulnerabilities, the theoretical effectiveness of present security mechanisms, and the potential impact of these factors on an organization’s ability to perform its mission

  14. Critical Asset • Something that when disclosed, modified, destroyed, or misused will cause harmful consequences to the organization or its goals and mission, or will provide an undesired and unintended benefit to someone

  15. Critical Asset Examples • Information • People • Software • Hardware • Facilities • etc.

  16. Threat • The capabilities and intentions of adversaries to exploit an information system; or any natural or unintentional event with the potential to cause harm to an information system, resulting in a degradation of an organization’s ability to fully perform its mission

  17. Adversarial Terrorists Foreign States Disgruntled Employees Criminals Recreational Hackers Commercial Competitors Non-Adversarial Nature Unintentional Human Acts Threat Examples

  18. Attack • A well-defined set of actions by the threat (an active agent) that, if successful, would damage a critical asset -- cause an undesirable state of affairs -- resulting in harm to an organization’s ability to perform its mission

  19. Vulnerability • A characteristic of an information system or its components that could be exploited by an adversary, or harmed by a natural act or an act unintentionally caused by human activity

  20. Vulnerability Examples • Inadequate password management • Easy access to a facility • Weak cryptography • Software flaw • Open port SECURITY

  21. Consequence • The harmful result of a successful attack, degrading an organization’s ability to perform its mission

  22. Consequence Examples • Harm to organization mission • Loss of information confidentiality • Loss of information integrity • Loss of availability of information or system functions • Inability to correctly authenticate sender of information • Inability to verify receipt of information by the intended recipient

  23. Risk Mitigation Actions or countermeasures we can take to lessen risk • Affect threat agent or their capabilities • Eliminate or limit our vulnerabilities

  24. Countermeasure Examples • Fix known exploitable software flaws • Enforce operational procedures • Provide encryption capability • Improve physical security • Disconnect unreliable networks • Train system administrators • Install virus scanning software

  25. Risk Management Decision • Determination by management or command to • take specific actions that will mitigate risk to mission, or • reject countermeasure recommendations and accept risk to mission

  26. Residual Risk • That portion of risk that remains • Management decides to accept risk • Unconsidered threat factors • Unconsidered vulnerabilities • Incorrect conclusions

More Related