Information SECURITY Risk Assessment Turning

Transcript:Information SECURITY Risk Assessment Turning:
Information SECURITY Risk Assessment Turning Project in Process: Segmentation, Prioritization and Iteration Cornell University: Steve Schuster (sjs74@cornell.edu) Interim Executive Director for Cornell Information Technologies Illumant, LLC: Matija Siljak (siljak@illumant.com) Director, Advisory Services Why Risk Assessment? To answer these questions: What constitutes sensitive information? Where is it? How much of it is there? How effectively is it protected? What are the vulnerabilities that could lead to compromise? What is the likelihood of compromise? What is the potential impact? What is the most effective use of protection resources? Problems with risk assessment Traditional risk assessment: One-offs project not process = limited ongoing benefit Breach response reactive not proactive = skewed expectations Big endeavor expensive and effort-intensive = risky project Questionable value predictable results and imbalanced cost-benefit = dissatisfaction Solutions Modified risk assessment: One-offs segment into small, independent components and iterate Breach response minimize time to partial results Big endeavor segment into small, independent components and iterate start at a high level, drill down later based on interim results Questionable value minimize cost and effort and time to results, balance cost and benefit The formula remains the same: Risk = Threat x Vulnerability x Impact Change is to administration and expectations Divide up the data gathering into segments Use interim results to prioritize further tasks and where to drill down Tolerate incompleteness, omission – circle back Analogy: mainframe vs. linux cluster What is different? Risk assessment methodology overview Risk Assessment Process Summary Data Classification Data Types Exposure Analysis Assets (Apps, DBs, etc.) Departments and Units MAP TO MAP TO MAP TO = data classification Start with the data classification policy. Consider other potentially sensitive data, for example: Student Info SSN/ Financial Info Credit Card Info Driver’s License Protected Health Info Academic Records Employee / Faculty (HR) Info SSN Payroll Info Driver’s License Bank Account Info Protected Health Info Alumni and Donor Info SSN Credit Card Info Driver’s License Bank Account Info Financial Data University Finances Point-of-Sale Customer Credit Card Data Physical Plant Buildings, Facilities, Utilities Grounds Cyber Infrastructure Access Info, Logs, LDAP Other PII Human Subject Research Key Performance Indicators Protected Health Info (PHI) Info in Non-medical Systems Intellectual Property Courseware, Research, Papers, Books, Code Library Citation DB Digital Full Text Circulation data and asset inventory Map the assets to data types and locations and attempt to roughly quantify the data exposure analysis After completing the inventory exercise, identify the key assets and