1 / 79

Risk Management

Risk Management. October 1998. What is RISK MANAGEMENT? The process concerned with identification, measurement, control and minimization of security risks in information systems to a level commensurate with the value of the assets protected.

celestyn
Télécharger la présentation

Risk Management

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Risk Management October 1998

  2. What is RISK MANAGEMENT? • The process concerned with identification, measurement, control and minimization of security risks in information systems to a level commensurate with the value of the assets protected. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug.1997)

  3. Course Objective • The student will be able to DETERMINE a risk index.

  4. Introduction to Risk Management Identify the Risk Areas Re-evaluate the Risks Assess the Risks Risk Management Cycle Implement Risk Management Actions Develop Risk Management Plan Risk Assessment Risk Mitigation

  5. Balance of Risk Management • Risk Management Risk Ignorance • Risk Avoidance

  6. RISK - The likelihood that a particular threat using a specific attack, will exploit a particular vulnerability of a system that results in an undesirable consequence. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  7. THREAT -Any circumstance or event with the potential to cause harm to an information system in the form of destruction, disclosure, adverse modification of data, and/or the denial of service. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  8. Threat Example - Hackers

  9. Threat Example - Electrical Storms

  10. Definition of Likelihood • LIKELIHOOD of the threat occurring is the estimation of the probability that a threat will succeed in achieving an undesirable event.

  11. Considerations in Assessing the Likelihood of Threat • Presence of threats • Tenacity of threats • Strengths of threats • Effectiveness of safeguards

  12. Statistical Threat Data

  13. Two Schools of Thought on Likelihood Calculation Assume Don’t Assume

  14. ATTACK • An attempt to gain unauthorized access to an information system’s services, resources, or information, or the attempt to compromise an information system’s integrity, availability, or confidentiality, as applicable. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  15. VULNERABILITY -Weakness in an information system, cryptographic system, or other components (e.g... , system security procedures, hardware design, internal controls) that could be exploited by a threat. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  16. Vulnerability Example

  17. CONSEQUENCE • A consequence is that which logically or naturally follows an action or condition.

  18. RM/RA RISK MANAGEMENT RISK ASSESSMENT RISK MITIGATION

  19. RISK ASSESSMENT -A process of analyzing THREATS to and VULNERABILITIES of an information system and the POTENTIAL IMPACT the loss of information or capabilities of a system would have. The resulting analysis is used as a basis for identifying appropriate and cost-effective counter-measures. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  20. Why Risk Assessment?

  21. Benefits of Risk Assessment • Increased awareness • Assets, vulnerabilities, and controls • Improved basis for decisions • Justification of expenditures

  22. Risk Assessment Process • Identify assets • Determine vulnerabilities • Estimate likelihood of exploitation • Compute expected loss

  23. Identify Assets • People, documentation, supplies

  24. Properties of Value Analysis • -Confidentiality • -Integrity • -Availability • -Non-repudiation

  25. Definition • -Confidentiality: Assurance that information is • not disclosed to unauthorized persons, • processes, or devices. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  26. Definition • - Integrity: Quality of an information system reflecting • the logical correctness and reliability of the • operating system; the logical completeness of the • hardware and software implementing the protection • mechanisms; and the consistency of the data • structures and occurrence of the stored data. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  27. Definition • -Availability: Timely, reliable access to data and • information services for authorized users. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  28. Definition • -Non-repudiation: Assurance the sender of data is • provided with proof of delivery and the recipient is • provided with proof of the sender’s identity, so neither • can later deny having processed the data. (Definition from National Information Systems Security (INFOSEC) Glossary, NSTISSI No. 4009, Aug. 1997)

  29. Determine Vulnerabilities Open Communications Lines Open Network

  30. Likelihood

  31. Expected Loss

  32. Risk Measure • RISK MEASURE is a description of the kinds and degrees of risk to which the organization or system is exposed.

  33. Communicating Risk • To be useful, the measurement should reflect what is truly important to the organization.

  34. How do we calculate risk?

  35. Primary Risk Calculation Methodologies Quantitative & Qualitative

  36. The Quantitative Method

  37. The Qualitative Method

  38. Qualitative Example: • “The system is weak in this area and we know that our adversary has the capability and motivation to get to the data in the system so the likelihood of this event occurring is high.”

  39. Quantitative and Qualitative Merged

  40. Delphi Approach

  41. Probability Density Function

  42. Examples of documented risk assessment systems • Aggregated Countermeasures Effectiveness (ACE) Model • Risk Assessment Tool • Information Security Risk Assessment Model (ISRAM) • Dollar-based OPSEC Risk Analysis (DORA) • Analysis of Networked Systems Security Risks (ANSSR) • Profiles • NSA ISSO INFOSEC Risk Assessment Tool

  43. Formula for Risk mkt/40 = 9j*X dv + zqm/ {2a} bc = wxyz lm +op * dz = tgm\bvd 2b or n2b

  44. Threat and Vulnerability Revisited The capability or intention to exploit, or any circumstance or event with the potential to cause harm such as a hacker. A weakness in a system that can be exploited.

  45. Threat + Vulnerability

  46. Likelihood Vs. Consequence

  47. Likelihood • The Likelihood of a successful attack is the probability that an adversary would succeed in carrying out an attack.

  48. Factors influencing an attack • Level of threat • Vulnerabilities • Countermeasures applied

  49. Determine Level of Threat • Criteria for evaluating the level of threat: • History • Capability • Intention or motivation

  50. Determine Vulnerabilities

More Related