Risk Management Issues in Information Security Amanda Kershishnik COSC April 2007

Information Security “The protection of information and the systems and hardware that use, store, and transmit that information,” (Whitman et al. 2004).

InfoSec components: Confidentiality Integrity Availability Privacy Identification Authentication Authorization Accountability

Confidentiality Confidentiality is the capability to ensure the proper subjects (people and other processes or systems) have the necessary access when needed.

Integrity “the quality or state of being whole, complete, and uncorrupted,” (Whitman 2004). Information is free of corruption both physically as well as logically Corruption can take place while information is being entered, stored, or transmitted.

Availability “Availability is the characteristic of information that enables user access to information without interference or obstruction and in a useable format,” (Whitman 2004). A user within this definition is either a person or another computer system

Privacy “information that is collected, used, and stored by an organization is to be used only for the purposes stated to data owner at the time it was collected,” (Whitman, 2004).

Identification Identification is a system that is able to recognize individual users. 1 st step in gaining information

Authentication “proof that a user is indeed the person or entity requesting authorized access to a system or facility,” (Whitman 2004). Authentication is dependent upon one of three things: what a person knows, what a person has, or what a person is.

Authorization provides assurance that the entity attempting to access information has been exclusively and clearly authorized by proper authority to access, delete, or modify information

Accountability systematic process of tracking and recording the operations and activities taking place by individuals or accounts while they are active in a system or working environment

Risk Management risk assessment risk mitigation risk evaluation managers are able to balance operation and economic costs or protective measures enables managers to achieve an increase in mission capability by protecting the assets that support their organizational objective

Risk Managers “The risk manager has overall responsibility for the success of the whole process and is responsible, ultimately, for the level of recommended risk the business accepts and is mitigated in one way or another,” (Jones et al. 2005) handle risk to a level that is acceptable assigned to handle the overall conformity with not only their corporation’s requirements but also state and federal requirements

Risk Manager roles/duties Developing risk management environment The whole risk management process Communications Coordination Facilitation

Assets anything or anyone that requires protection people, procedures, data, software, hardware, and networking.

Asset subcategories People: inside, outside Procedures: standard, sensitive Data: all states (transmission, processing, storage) Software: applications, OS, security Hardware: systems/peripherals, security Networking: intranet, internet/extranet

keep this in mind… *********************

Classifying/Categorizing Assets Data classification scheme –unclassified data, sensitive but unclassified data, confidential data, secret data, and top secret data Personnel classification scheme –confidential clearance, secret clearance, or top secret clearance

Asset Value Assessment organize the assets in a most important to least important questions that help create an effective weighted factor analysis worksheet assets then ranked by the weighted score

Threat Identification assessing potential weaknesses for each information asset Environmental –tornados, hurricanes, floods, severe winter storms, drought, earthquakes, electrical storms, and fire Human –terrorism, sabotage, war, theft, arson, and labor disputes

Threat Value Assessment each threat is examined more thoroughly to determine its potential ability to affect information assets and must be done prior to risk assessment ☺It is a good idea to ask questions (and possibly answer questions) based on an organization’s policy and guidelines.

Vulnerability Assessment “A vulnerability is defined as a flaw or weakness in system security procedures, design, implementation, or internal controls that, if exercised… would result in a security breach or a violation of the system’s security policy,” (Rittinghouse, 2005). when you evaluate each information asset for each threat

Risk Assessment PCMag.com (2006) defines risk assessment as, “A report that shows assets, vulnerabilities, likelihood of damage, estimates of the costs of recovery, summaries of possible defensive measures and their costs and estimated probable savings from better protection.”

Likelihood Analysis Statement gives the exact threats and the estimated exposure, the unforeseen event and mitigation actions required, and the benefit arising out of covering the risk 3 components: – threat-source motivation and capability – nature of the vulnerability – existence and effectiveness of current controls.

Each scenario should be examined for its possibility of occurrence along with the severity it would have on an organization. If a vulnerability is already completely managed by an existing control, it can be set aside. If the vulnerability is only partially controlled, an estimate needs to be calculated as to what percentage of the vulnerability is controlled There is error when calculating to which degree a current control can reduce risk

Risk Determination

References Jones, Andy & Ashenden, Debi Risk Management for Computer Security: Protecting Your Network and Information Assets. Boston, Massachusetts: Elsevier Inc. Leto, Thomas. (2006). CIA Triangle. Retrieved April 21, 2007, from 20Triangle.html 20Triangle.html McCumber, John Assessing and Managing Security Risk in IT Systems. Boca Raton, Florida: Auerbach Publications. PCMag.com. (2006). Definition of: Risk Assessment. Retrieved April 23, 2007 from ment&i=50556,00.asp ment&i=50556,00.asp Powers, Rod About: Us Military: Security Clearance Secrets. Retrieved April 22, 2007, from Rittinghouse, John W. & Ransome, James F Business Continuity and Disaster Recovery and InfoSec Managers. Burlington, Massachusetts: Elsevier Digital Press. Whitman, Dr. Michael E. & Mattord, Herbert J Management of Information Security. Canada: Thomson Learning, Inc.