1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK...
-
Upload
quentin-mcdaniel -
Category
Documents
-
view
223 -
download
0
Transcript of 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK...
![Page 1: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/1.jpg)
1
ITC358ICT Management and Information Security
Chapter 9RISK MANAGEMENT: CONTROLLING RISK
Weakness is a better teacher than strength. Weakness must be learned to understand the obstacles that strength brushes aside. – Mason Cooley, U.S. aphorist
![Page 2: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/2.jpg)
Objectives• Upon completion of this chapter, you should
be able to:– Recognise and select from the risk mitigation
strategy options to control risk– Evaluate risk controls and formulate a cost-
benefit analysis using existing conceptual frameworks
– Explain how to maintain and perpetuate risk controls
– Describe the OCTAVE Method and other approaches to managing risk
![Page 3: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/3.jpg)
Introduction• To keep up with the competition, organisations
must design and create a safe environment in which business processes and procedures can function– This environment must maintain confidentiality
and privacy and assure the integrity and availability of organisational data
– These objectives are met via the application of the principles of risk management
![Page 4: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/4.jpg)
Risk Control Strategies• An organisation must choose one of four basic
strategies to control risks – Avoidance
• Applying safeguards that (to) eliminate or reduce the remaining uncontrolled risks for the vulnerability
– Transference (insurance)
• Shifting the risk to other areas or to outside entities
– Mitigation• Reducing the impact if the vulnerability is exploited
– Acceptance• Understanding the consequences and accepting the risk
without control or mitigation
![Page 5: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/5.jpg)
Avoidance• The risk control strategy that attempts to
prevent the exploitation of the vulnerability• Avoidance is accomplished through:
– Application of policy– Application of training and education– Countering threats– Implementation of technical security controls
and safeguards
![Page 6: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/6.jpg)
Transference• The control approach that attempts to shift the
risk to other assets, other processes, or other organisations
• May be accomplished by rethinking how services are offered– Revising deployment models– Outsourcing to other organisations– Purchasing insurance– Implementing service contracts with providers
![Page 7: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/7.jpg)
Mitigation• The control approach that attempts to reduce
the damage caused by the exploitation of vulnerability– Using planning and preparation – Depends upon the ability to detect and respond
to an attack as quickly as possible • Types of mitigation plans
– Disaster recovery plan (DRP)– Incident response plan (IRP)– Business continuity plan (BCP)
![Page 8: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/8.jpg)
Mitigation (cont’d.)
Table 9-1 Summaries of mitigation plans Source: Course Technology/Cengage Learning
![Page 9: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/9.jpg)
Acceptance• The choice to do nothing to protect an
information asset – To accept the loss when it occurs
• This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure
![Page 10: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/10.jpg)
Acceptance (cont.)• Before using the acceptance strategy, the
organisation must:– Determine the level of risk to the information
asset– Assess the probability of attack and the
likelihood of a successful exploitation of a vulnerability
– Approximate the ARO (rate of occurrence) of the exploit– Estimate the potential loss from attacks– Perform a thorough cost benefit analysis
![Page 11: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/11.jpg)
Acceptance (cont.)• Before using the acceptance strategy, the
organisation must: (cont’d.)– Evaluate controls using each appropriate type
of feasibility– Decide that the particular asset did not justify
the cost of protection
![Page 12: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/12.jpg)
Managing Risk• Risk appetite (also known as risk tolerance)
– The quantity and nature of risk that organisations are willing to accept• As they evaluate the trade-offs between perfect
security and unlimited accessibility
• The reasoned approach to risk is one that balances the expense (in terms of finance and the usability of information assets) against the possible losses if exploited
![Page 13: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/13.jpg)
Managing Risk (cont’d.)• Residual risk
– When vulnerabilities have been controlled as much as possible, there is often remaining risk that has not been completely removed, shifted, or planned for
• Residual Risk is a combined function of:– Threats, vulnerabilities and assets, less the
effects of the safeguards in place
![Page 14: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/14.jpg)
Managing Risk (cont’d.)• The goal of information security is not to bring
residual risk to zero– Bring it in line with an organisation’s risk
appetite• If decision makers have been informed of
uncontrolled risks and the proper authority groups within the communities of interest decide to leave residual risk in place, then the information security program has accomplished its primary goal
![Page 15: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/15.jpg)
• Once a control strategy has been selected and implemented:– The effectiveness of controls should be
monitored and measured on an ongoing basis• To determine its effectiveness and the accuracy of
the estimate of the residual risk
Managing Risk (cont’d.)
![Page 16: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/16.jpg)
Managing Risk (cont’d.)
Source: Course Technology/Cengage LearningFigure 9-1 Residual risk
![Page 17: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/17.jpg)
• Risk control involves selecting one of the four risk control strategies – For the vulnerabilities present
• If the loss is within the range of losses the organisation can absorb, or if the attacker’s gain is less than expected costs of the attack, the organisation may choose to accept the risk– Otherwise, one of the other control strategies
will have to be selected
Managing Risk (cont’d.)
![Page 18: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/18.jpg)
Managing Risk (cont’d.)
Source: Course Technology/Cengage LearningFigure 9-2 Risk-handling action points
![Page 19: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/19.jpg)
• Guidelines for risk control strategy selection– When a vulnerability exists
• Implement security controls to reduce the likelihood of a vulnerability being exercised
– When a vulnerability can be exploited• Apply layered controls to minimise the risk or prevent
occurrence
– When the attacker’s potential gain is greater than the costs of attack• Apply technical or managerial controls to increase the
attacker’s cost, or reduce his gain
– When potential loss is substantial• Apply design controls to limit the extent of the attack, thereby
reducing the potential for loss
Managing Risk (cont’d.)
![Page 20: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/20.jpg)
Managing Risk (cont’d.)
Source: Course Technology/Cengage Learning
Figure 9-3 Risk control cycle
![Page 21: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/21.jpg)
Feasibility and Cost-Benefit Analysis
• Before deciding on the strategy for a specific vulnerability• All readily accessible information about the consequences
of the vulnerability must be explored• Ask “what are the advantages of implementing a control as
opposed to the disadvantages of implementing the control?”
• There are a number of ways to determine the advantage or disadvantage of a specific control
• The primary means are based on the value of the information assets that it is designed to protect
![Page 22: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/22.jpg)
Cost-Benefit Analysis• Economic feasibility
– The criterion most commonly used when evaluating a project that implements information security controls and safeguards
• Begin a cost-benefit analysis by:– Evaluating the worth of the information assets
to be protected and the loss in value if those information assets are compromised
• This decision-making process is called– Cost-benefit analysis or economic feasibility
study
![Page 23: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/23.jpg)
Cost-Benefit Analysis (cont’d.)• It is difficult to determine the value of
information– It is also difficult to determine the cost of
safeguarding it• Factors that affect the cost of a safeguard
– Cost of development or acquisition of hardware, software, and services
– Training fees – Cost of implementation – Service and maintenance costs
![Page 24: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/24.jpg)
Cost-Benefit Analysis (cont’d.)• Benefit
– The value to the organisation of using controls to prevent losses associated with a specific vulnerability
– Usually determined by valuing the information assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset
– This is expressed as the annualised loss expectancy (ALE)
![Page 25: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/25.jpg)
Cost-Benefit Analysis (cont’d.)• Asset valuation
– The process of assigning financial value or worth to each information asset
– The value of information differs within and between organisations• Based on the characteristics of information and the
perceived value of that information
– Involves estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against loss and litigation
![Page 26: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/26.jpg)
Cost-Benefit Analysis (cont’d.)• Asset valuation components
– Value retained from the cost of creating the information asset
– Value retained from past maintenance of the information asset
– Value implied by the cost of replacing the information
– Value from providing the information– Value acquired from the cost of protecting the
information
![Page 27: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/27.jpg)
Cost-Benefit Analysis (cont’d.)• Asset valuation components (cont’d.)
– Value to owners– Value of intellectual property– Value to adversaries– Loss of productivity while the information assets
are unavailable– Loss of revenue while information assets are
unavailable
![Page 28: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/28.jpg)
Cost-Benefit Analysis (cont’d.)• An organisation must be able to place a dollar
value on each information asset it owns, based on: – How much did it cost to create or acquire?– How much would it cost to recreate or recover?– How much does it cost to maintain?– How much is it worth to the organisation?– How much is it worth to the competition?
![Page 29: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/29.jpg)
Cost-Benefit Analysis (cont’d.)• Potential loss is that which could occur from
the exploitation of vulnerability or a threat occurrence
• Ask these questions:– What loss could occur, and what financial
impact would it have?– What would it cost to recover from the attack, in
addition to the financial impact of damage?– What is the single loss expectancy for each
risk?
![Page 30: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/30.jpg)
• A single loss expectancy (SLE)– The calculation of the value associated with the
most likely loss from an attack – SLE is based on the value of the asset and the
expected percentage of loss that would occur from a particular attack
– SLE = asset value (AV) x exposure factor (EF)• Where EF is the percentage loss that would occur
from a given vulnerability being exploited
– This information is usually estimated
Cost-Benefit Analysis (cont’d.)
![Page 31: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/31.jpg)
• In most cases, the probability of a threat occurring is the probability of loss from an attack within a given time frame
• This value is commonly referred to as the annualised rate of occurrence (ARO)
ALE = SLE * ARO
Cost-Benefit Analysis (cont’d.)
![Page 32: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/32.jpg)
Cost-Benefit Analysis (cont’d.)• CBA determines whether or not a control
alternative is worth its associated cost• CBAs may be calculated before a control or
safeguard is implemented– To determine if the control is worth
implementing• Or calculated after controls have been
implemented and have been functioning for a time
![Page 33: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/33.jpg)
Cost-Benefit Analysis (cont’d.)• Cost-benefit analysis formula
CBA = ALE(prior) – ALE(post) – ACS– ALE (prior to control) is the annualised loss
expectancy of the risk before the implementation of the control
– ALE (post-control) is the ALE examined after the control has been in place for a period of time
– ACS is the annual cost of the safeguard
![Page 34: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/34.jpg)
Other Methods of Establishing Feasibility
• Organisational feasibility analysis – Examines how well the proposed information security alternatives
will contribute to the operation of an organisation• Operational feasibility
– Addresses user and management acceptance and support– Addresses the overall requirements of the organisation’s
stakeholders• Technical feasibility
– Examines whether or not the organisation has or can acquire the technology to implement and support the alternatives
• Political feasibility– Defines what can and cannot occur based on the consensus and
relationships between the communities of interest
![Page 35: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/35.jpg)
Alternatives to Feasibility Analysis• Benchmarking• Due care and due diligence• Best business practices• Gold standard• Government recommendations• Baseline
![Page 36: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/36.jpg)
Recommended Risk Control Practices
• Organisations typically look for a more straightforward method of implementing controls
• This preference has prompted an ongoing search for ways to design security architectures that go beyond the direct application of specific controls for specific information asset vulnerability
![Page 37: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/37.jpg)
Qualitative and Hybrid Measures• Quantitative assessment
– Performs asset valuation with actual values or estimates
– May be difficult to assign specific values• Qualitative assessment
– Use scales instead of specific estimates• Hybrid assessment
– Tries to improve upon the ambiguity of qualitative measures without using an estimating process
![Page 38: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/38.jpg)
A Single Source Approach to Risk Management
• The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Method– Defines the essential components of a comprehensive,
systematic, context-driven, self-directed information security risk evaluation
– Allows an organisation to make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets
– The operational or business units and the IT department work together to address the information security needs of the organisation
![Page 39: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/39.jpg)
The OCTAVE Methods• Three variations of the OCTAVE method
– The original OCTAVE method, (forms the basis for the OCTAVE body of knowledge)• Was designed for larger organisations with 300 or
more users
– OCTAVE-S• For smaller organisations of about 100 users
– OCTAVE-Allegro• A streamlined approach for information security
assessment and assurance
• For more information: www.cert.org/octave/
![Page 40: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/40.jpg)
Microsoft Risk Management Approach
• Microsoft Corporation also promotes a risk management approach
• Four phases in the Microsoft InfoSec risk management process:– Assessing risk– Conducting decision support– Implementing controls– Measuring program effectiveness
![Page 41: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/41.jpg)
Microsoft Risk Management Approach (cont’d.)
• Assessing Risk: Identification and prioritisation of risks facing the organisation – Plan data gathering – discuss keys to success
and preparation guidance– Gather risk data – outline the data collection
process and analysis– Prioritise risks – outline prescriptive steps to
qualify and quantify risks
![Page 42: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/42.jpg)
Microsoft Risk Management Approach (cont’d.)
• Conducting Decision Support: Identify and evaluate available controls– Define functional requirements – create the
necessary requirements to mitigate risks– Select possible control solutions – outline
approach to identify mitigation solutions– Review solution – evaluate proposed controls
against functional requirements
![Page 43: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/43.jpg)
Microsoft Risk Management Approach (cont’d.)
• Identify and evaluate available controls (cont’d.)– Estimate risk reduction – endeavor to
understand reduced exposure or probability of risks
– Estimate solution cost – evaluate direct and indirect costs associated with mitigation solutions
– Select mitigation strategy – complete cost-benefit analysis to identify the most cost-effective mitigation solution
![Page 44: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/44.jpg)
• Implementing controls: deployment and operation of the controls selected from the cost-benefit analyses and other mitigating factors from the previous step– Seek holistic approach – incorporate people,
process, and technology in mitigation solution– Organise by defense-in-depth – arrange
mitigation solutions across the business
Microsoft Risk Management Approach (cont’d.)
![Page 45: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/45.jpg)
Microsoft Risk Management Approach (cont’d.)
• Measuring program effectiveness: ongoing assessment of the effectiveness of the risk management program– Develop risk scoreboard – understand risk
posture and progress– Measure program effectiveness – evaluate the
risk management program for opportunities to improve
![Page 46: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/46.jpg)
Figure A-1 Security Risk Management Guide
Microsoft Risk Management Approach (cont’d.)
Source: Course Technology/Cengage Learning
![Page 47: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/47.jpg)
Microsoft Risk Management Approach (cont’d.)
• Additional information is available at:www.microsoft.com/technet/security/topics/complianceandpolicies/secrisk/default.mspx
![Page 48: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/48.jpg)
FAIR• The Factor Analysis of Information Risk (FAIR)
framework includes:– A taxonomy for information risk– Standard nomenclature for information risk
terms– A framework for establishing data collection
criteria– Measurement scales for risk factors– A computational engine for calculating risk
![Page 49: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/49.jpg)
FAIR (cont’d.)• The Factor Analysis of Information Risk (FAIR)
framework includes: (cont’d.)– A modeling construct for analysing complex risk
scenarios• See http://fairwiki.riskmanagementinsight.com
![Page 50: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/50.jpg)
FAIR (cont’d.)• Basic FAIR analysis is comprised of ten steps
in four stages• Stage 1 - Identify scenario components
1. Identify the asset at risk
2. Identify the threat community under consideration
• Stage 2 - Evaluate loss event frequency3. Estimate the probable threat event frequency
4. Estimate the threat capability (TCap)
![Page 51: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/51.jpg)
FAIR (cont’d.)• Stage 2 - Evaluate loss event frequency
(cont’d.)5. Estimate Control strength (CS)
6. Derive Vulnerability (Vuln)
7. Derive Loss Event Frequency (LEF)• Stage 3 - Evaluate probable loss magnitude
(PLM)8. Estimate worst-case loss
9. Estimate probable loss
![Page 52: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/52.jpg)
FAIR (cont’d.)• Stage 4 - Derive and articulate Risk
10. Derive and articulate Risk• Unlike other risk management frameworks,
FAIR relies on the qualitative assessment of many risk components using scales with value ranges, for example very high to very low
![Page 53: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/53.jpg)
FAIR (cont’d.)
Figure 9-4 Factor analysis of information risk (FAIR)Source: Course Technology/Cengage Learning (Based on concepts from Jack A. Jones)
![Page 54: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/54.jpg)
ISO 27005 Standard for Information Security Risk Management
• The ISO 27000 series includes a standard for the performance of Risk Management– ISO 27005– See http://www.27000.org/iso-27005.htm
![Page 55: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/55.jpg)
ISO 27005 Standard for Information Security Risk Management (cont’d.)
• The 27005 document includes a five-stage risk management methodology– Information security risk assessment (ISRA)– Information security risk treatment– Information security risk acceptance– Information security risk communication– Information security risk monitoring and review
![Page 56: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/56.jpg)
Other Methods
Figure 9-5 ENISA ranking of risk management methodsSource: Course Technology/Cengage Learning
![Page 57: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/57.jpg)
Summary• Introduction• Risk control strategies• Risk control strategy selection• Categories of controls• Feasibility studies and cost-benefit analysis• Risk management discussion points• Recommended risk control practices• The OCTAVE method
![Page 58: 1 ITC358 ICT Management and Information Security Chapter 9 R ISK M ANAGEMENT : C ONTROLLING R ISK Weakness is a better teacher than strength. Weakness.](https://reader036.fdocuments.net/reader036/viewer/2022062804/5697bf9f1a28abf838c94d70/html5/thumbnails/58.jpg)
Summary (cont’d.)• The Microsoft risk management approach• FAIR• ISO 27005 Standard for Information Risk
Management