A complete Information Risk Management solution …...October 2013 A complete Information Risk...
Transcript of A complete Information Risk Management solution …...October 2013 A complete Information Risk...
![Page 1: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/1.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 1 of 7
Jason Creasey Certified STREAM Consultant
A complete Information Risk Management
solution for ISF Members using IRAM and STREAM
Simon Marvell Partner
Abstract IRAM is a business-led information risk analysis methodology used widely by ISF members. IRAM
provides tools for business impact assessment, threat and vulnerability assessment and control
selection. However, it is not an integrated web-based solution and does not provide tools for on-
going monitoring and reporting of risk status or workflow for managing the treatment of
unacceptable risks. This paper describes how IRAM can be used easily with Acuity’s STREAM GRC
software to provide a complete information risk management solution for ISF members.
Overview of IRAM IRAM provides a three – stage approach as illustrated in Figure 1. The comprehensive Business
Impact Assessment is widely used and is ideal to provide a ‘front-end’ to STREAM, where the
summary detail can be entered and copies of the supporting BIA spreadsheets stored centrally. The
Threat and Vulnerability Assessment is useful, particularly in conjunction with the ISF Healthcheck,
both of which are compatible with STREAM. The control selection tool gives food for thought but at
present is less widely used than the other two stages.
Figure 1: Three-stage IRAM Process
Note. The two assessment tools in IRAM are based on spreadsheets, which can be co-ordinated
using the web-based Risk Analyst Workbench (RAW). For simplicity we just use the term IRAM in
this paper.
![Page 2: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/2.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 2 of 7
The roles of IRAM and STREAM in managing Information Risk IRAM provides a strong business driven articulation of the requirements for information security
through its business impact analysis (BIA). The BIA provides an essential understanding of the
requirements for Confidentiality, Integrity and Availability (CIA) of information which can be
informed and refined by an understanding of the likelihood of a loss event or incident occurring by
the IRAM Threat & Vulnerability Analysis.
Clearly, information with high requirements for CIA needs a high degree of protection and without
that protection there would be a significant risk (probably an expectation) of serious damage, even
more so when there is a genuine likelihood of loss or attack.
But the assumption of no protection is theoretical and the risk information of most value to business
managers is an understanding of the residual risk, taking account of the existence and performance
of controls deployed to mitigate this risk.
The IRAM Control Selection stage allows a range of controls to be considered and, where required,
helps to select additional controls to reduce the likelihood of serious incidents occurring. However,
IRAM it is not designed to quantify residual risk as part of the risk analysis or to monitor residual risk
as contributory factors change. This means that while, following an IRAM risk analysis, the business
can be confident that it has a good understanding of the requirements for information security it
may not fully understand the residual risk. Furthermore, any understanding of residual risk that it
does have will deteriorate over time if the performance of controls changes in a way that is not
visible to the risk analyst.
The following table summarises the main factors that influence residual risk and their frequency of
change:
Factor Frequency of Change Influence on Residual Risk
Supported by IRAM?
Supported by STREAM?
Business Impact Analysis
Relatively static - once determined, the potential business impacts from a loss of CIA tend not to change much
1.
A broad statement of information security requirements
Yes - Detailed Yes - Summary
Threat Likelihood
Variable by risk type. Can change significantly at short notice, e.g. if targeted by attackers
Refines the BIA defined requirements
Yes Yes
Vulnerabilities Weaknesses in control2 – variable
by control type. Can change significantly at short notice, e.g. zero-day vulnerabilities
Increases the likelihood that an attack, if mounted would be successful
Yes Yes
Control Selection
Variable as BIA, Threat Likelihood and Vulnerabilities change
The design for reducing residual risk to an acceptable level
Yes, but not as a compliance tool
Yes
1 The BIA can change as information goes through different phases in its lifecycle, e.g. data which is embargoed
before publication. However this can be modelled and the BIA at each lifecycle stage tends to be relatively static. 2 Most vulnerabilities are weaknesses in control. However, organisations may also be inherently vulnerable to
an incident, e.g. if there is a single-point of failure. Inherent vulnerabilities result in higher requirements for security whereas control vulnerabilities require improvement in control performance.
![Page 3: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/3.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 3 of 7
Factor Frequency of Change Influence on Residual Risk
Supported by IRAM?
Supported by STREAM?
Control Performance
Variable, perhaps due to staffing levels, budget constraints, competing priorities, people making mistakes
Very important factor in maintaining residual risk at an acceptable level
Yes Yes
Incidents and Near-misses
Variable by incident type Feedback on the performance of the above factors allowing refinement and improvement
No Yes
Handling of Improvement Actions
Variable depending on the volume and frequency of improvement actions
Reduces residual risk as improvement actions are completed
No Yes
Figure 2: The contributory factors in understanding residual risk
The above table illustrates that all residual risk factors are variable (less so for BIA), sometimes to
quite an extent.
This means that to be effective and provide meaningful management information an information
risk management solution must:
Integrate all the different components of information risk
Calculate residual risk – it is impossible for a risk analyst to manually evaluate all of the
above factors, even where they have visibility of them
Update the calculation every time one of the factors changes, which could, in some cases, be
daily.
IRAM does not calculate residual risk or support the complete range of residual risk factors, as
illustrated in the table above. However, a combination of IRAM with STREAM provides a
complete, easy to use and powerful solution for information risk management.
A complete information risk management solution for ISF Members
using IRAM and STREAM Figure 3 overleaf illustrates the recommended combined solution, allowing ISF members to take advantage of the powerful graphical displays and aggregation facilities available in STREAM without losing the benefits of the ISF IRAM tool which comes as a standard part of ISF membership. STREAM’s asset management and risk modelling, which are straightforward and easy-to use, are important so that risk boards, committees or equivalent can view and discuss the risks to an application before it goes live or if it changes significantly.
Although knowledge of how STREAM can be used with ISF tools will be very useful, STREAM can be configured easily without the need for extensive support, saving time and money. Furthermore, once it has been set up, many risk assessments can become semi-automatic.
![Page 4: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/4.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 4 of 7
Figure 3: A combined IRAM / STREAM Risk Management Solution
Business Impact Analysis IRAM provides a comprehensive BIA designed specifically for the needs of ISF members. Members
can use the IRAM BIA to capture BIA information and then enter the BIA Summary information to
STREAM. Since BIA data is typically fairly static an automated interface is not required and the
summary information can be entered to STREAM manually. STREAM can be configured with the
same A – E scale used by IRAM for recording impacts.
Threat and Vulnerability Assessment Stage 2 of IRAM (Threat and Vulnerability Assessment) is not as widely used by Members as Stage 1
(BIA) and so Members may prefer to add this information directly into STREAM as it simplifies the
process and is more flexible. Since this information is variable, it will be easy to manage in STREAM
which automatically keeps a history of previous assessments and re-calculates the residual risk each
time it is updated. Members that prefer to keep their Threat and Vulnerability Assessments in IRAM
can transpose or import the data to STREAM.
STREAM can be configured with the ISF Threat list and / or other Threat lists as required and the
same A-E scale used by IRAM for recording threat likelihood.
Control Selection As with Stage 2, Stage 3 of IRAM (Control Selection) is not as widely used by Members as Stage 1
(BIA) and so Members may prefer to add this information directly into STREAM, particularly for
![Page 5: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/5.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 5 of 7
compliance monitoring. STREAM also has the advantage in that its Framework mappings allow
Controls to be mapped to Asset Classes and Threats. So each time an Asset is added to an Asset
Class, STREAM will automatically map all relevant Controls and Threats to the Asset.
STREAM can be configured with ISF Controls Content, such as the Standard of Good Practice (SoGP),
Security Healthcheck, Benchmark controls or any other set of control standards, such as ISO 27001,
PCI-DSS, COBIT 5 or internal policies and control standards.
If Members prefer to use IRAM for control selection they can do so and transpose or import the data
to STREAM.
Control Compliance and Performance of Key Control Indicators (KCIs) Since control compliance and, in particular, the performance of key control indicators is such an
important factor in residual risk, and varies over time, it is recommended that this information is
recorded in STREAM. A history of control assessments is maintained and residual risk is recalculated
every time a change is made.
As indicated above, STREAM can be configured with ISF Controls content or any other set of control
standards. Multiple controls assessment schemes can be defined for different control sets, including
the ISF benchmarking scheme.
An optional Control Approvals scheme can be configured to provide independent approval of control
assessments.
Incidents and Near-misses IRAM does not provide a facility for recording and tracking incidents and near-misses but they can
be captured in STREAM and linked to Assets, Controls and Threats. STREAM can be configured with
the ISF’s Threat / Incident types.
The impact of incidents can be recorded in STREAM (if required using the ISF’s A-E scale) and
reporting provides information on frequency and average impact of events which can be used to
refine and continually improve the risk assessment and residual risk calculation.
Action Management IRAM provides only limited options for recording and tracking actions but they can be raised (and
easily tracked) in STREAM against controls, risks, incidents and near-misses.
As actions are completed, the status of controls and risks can be updated in STREAM and the
residual risk re-calculated.
Alerting and Workflow As a single-user system IRAM does not support alerting and workflow. In STREAM risks, controls,
incidents, near-misses and actions can be allocated to owners who will receive an email alert. Dates
of next assessment, approval, acceptance and target completion dates for actions can be recorded
with alerts and reminders sent to users.
Workflow can be established to handle exceptions and waivers.
![Page 6: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/6.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 6 of 7
Asset Management and Risk Modelling A strength of STREAM is its configurable ‘asset-based’ approach to risk management. ‘Asset’ is a
term used in STREAM to denote a component of the target scope for risk management. IRAM takes
a ‘system – based’ approach to risk assessment and this can be configured in STREAM.
However, Members also have a range of preferred primary points of focus – some prefer a business
process led approach, others segment into ‘business as usual’ and ‘project’ views, while others
structure geographically and /or by technology components (critical business applications, networks,
computer installations etc.). STREAM is configurable to support all of these approaches and they can
be ‘mixed and matched’ with different risk assessment and control assessment schemes as required.
An unlimited Asset Class tree structure can be configured in STREAM allowing organisations to
configure assets down to their required level of detail. As Assets are then added to the scope of the
risk assessment, threats and controls will be automatically mapped to the Assets providing
important assurance that a consistent approach is being taken to common Assets across the
Enterprise.
STREAM’s flexibility in this area allows multiple risk types to be managed in the same database so,
for example, information risk management can be integrated with: supply chain risk management;
business continuity; privacy, and; enterprise risk management.
Residual Risk Calculation As any contributory factor to residual risk assessment is changed, STREAM automatically re-
calculates residual risk and compares it against risk thresholds. Risk appetites can optionally be set
in STREAM allowing residual risk to be reported in relation to risk appetite.
STREAM automatically logs previous assessments so users can view history and trends.
For frequently changing factors, such as patch or anti-virus status, key control indicators for these
factors can be defined and the data imported automatically from third party applications (such as
scanners and anti-virus systems) allowing the residual risk status to be updated in real time.
Monitoring and Reporting STREAM provides an extensive set of graphical dashboards and reports providing easy, on-demand,
visibility of risk and compliance status. Subject to user management permissions, users can
aggregate up for summary views or drill down for more information.
Reports draw real-time views from the database which is continually updated as factors change,
ensuring that the user can always see the current status. Historical reports also allow the user to
review progress and perform trend analysis.
Conclusion ISF Members have long-recognised the importance of information risk management and the value of
accurate information on risk and compliance status.
IRAM is an excellent tool for risk analysis with a particularly strong BIA component which identifies
information security requirements. However, to provide important information on residual risk
![Page 7: A complete Information Risk Management solution …...October 2013 A complete Information Risk Management solution For ISF Members using IRAM and STREAM Page 5 of 7 compliance monitoring.](https://reader034.fdocuments.net/reader034/viewer/2022042116/5e940257e3e232593f62be64/html5/thumbnails/7.jpg)
October 2013
A complete Information Risk Management solution For ISF Members using IRAM and STREAM
Page 7 of 7
status in a centralised, aggregated manner, it needs to be combined with a tool that can calculate
residual risk status and provide strong risk monitoring and reporting capabilities.
STREAM provides these capabilities and also additional features not provided with IRAM such as
Incident / Near-misses and Action Management. STREAM is configurable with ISF content and will
therefore integrate seamlessly with IRAM.
Finally, STREAM’s multi-user capability with workflow and alerting will allow Members to extend
controlled information risk management processes out from specialised, trained risk analysts to the
wider user-base, including control owners, incident owners, action owners and auditors.
Business managers can use STREAM’s dashboards and reports to see ‘at a glance’ real-time views of
their residual risk and compliance status, identifying areas of concern for investigation.
Contact Information
Jason Creasey Director
[email protected] www.jerakano.com +44 (0) 1483 838098 +44 (0) 7713 257282
Simon Marvell Partner
[email protected] www.acuityrm.com +44 (0) 20 7297 2086 +44 (0) 7900 246371
Relationship between Acuity and Jerakano
www.acuityrm.com
STREAM Integrated Risk Manager from Acuity Risk Management provides flexible, easy to use and cost effective automation for managing risk and compliance to both ISF members and non-members alike. As a Certified Consulting Partner, Jerakano can help you automate the ISF Standard of Good Practice and other ISF deliverables such as IRAM, Security Healthcheck, Benchmarking and Securing the Supply Chain using – STREAM Integrated Risk Manager.