Security Risk Analysis and Management Risk

Transcript:Security Risk Analysis and Management Risk:
Security Risk Analysis and Management Risk Management: Controlling Risk In information Security The purpose of risk management Ensure overall business and business assets are safe Protect against competitive disadvantage Compliance with laws and best business practices Maintain a good public reputation Steps of a risk management plan Step 1: Identify Risk Step 2: Assess Risk Step 3: Control Risk Steps are similar regardless of context (InfoSec, Physical Security, Financial, etc.) This presentation will focus on controlling risk within an InfoSec context Risk Identification The steps to risk identification are: Identify your organization’s information assets Classify and categorize said assets into useful groups Rank assets necessity to the organization To the right is a simplified example of how a company may identify risks Risk Assessment The steps to risk assessment are: Identify threats and threat agents Prioritize threats and threat agents Assess vulnerabilities in current InfoSec plan Determine risk of each threat R = P * V – M + U R = Risk P = Probability of threat attack V = Value of Information Asset M = Mitigation by current controls U = Uncertainty of vulnerability The table to the right combines elements of all of these in a highly simplified format Risk control The steps to risk control are: Cost-Benefit Analysis (CBA) Single Loss Expectancy (SLE) Annualized Rate of Occurrence (ARO) Annual Loss Expectancy (ALE) Annual Cost of the Safeguard (ASG) Feasibility Analysis Organizational Feasibility Operational Feasibility Technical Feasibility Political Feasibility Risk Control Strategy Implementation Security+ Guide to Network Security Fundamentals, Fourth Edition Vulnerability Assessment (cont’d.) Single loss expectancy (SLE) Expected monetary loss each time a risk occurs Calculated by multiplying the asset value by exposure factor Exposure factor: percentage of asset value likely to be destroyed by a particular risk 8 Security+ Guide to Network Security Fundamentals, Fourth Edition Vulnerability Assessment (cont’d.) Annualized loss expectancy (ALE) Expected monetary loss over a one year period Multiply SLE by annualized rate of occurrence Annualized rate of occurrence (ARO) : probability that a risk will occur in a particular year It can be calculated by multiplying the annual rate of occurrence (ARO) by single loss expectancy (SLE). 9 Suppose that an asset is valued at $100,000, and the Exposure Factor (EF) for this asset is 25%. The single loss expectancy (SLE) then, is 25% * $100,000, or $25,000. For an annual rate of occurrence of one, the annualized loss expectancy is