Information Security Risk Management A Systematic View to Approaches

Content Concept Management Principles Framework Process Approaches Samples

What is an IT Risk? Risk = ƒ (Threat x Vulnerability x Impact) Vulnerability: weakness in the system or situation Threat: probability of occurrence of an event exploiting the vulnerability Impact: consequence Example – Information leakage Vulnerability: Unprotected sensitive traffic, unnecessary services enabled Threat: Eavesdropping, illegal processing of data Impact: Loss of business

How to manage IT Risks? Information Security Risk Management Identify organizational needs on info security in a systematic approach Create an effective information security management system (ISMS) Align with overall enterprise risk management Address risks in an effective and timely manner as needed Be an integral part of all information security management activities Apply both to implementation and ongoing operation of ISMS It is a continual process Organization as a whole, any discrete part of organization, or any IT system Principles apply

What are the Principles? Creates value Integral part of organizational processes Part of decision making Explicitly addresses uncertainty Systematic, structured and timely Based on the best available information Tailored Takes human and cultural factors into account Transparent and inclusive Dynamic, iterative and responsive to change Facilitates continual improvement and enhancement of the organization

How to apply the Principles? Risk Management Framework Provide foundations and arrangements to be embedded at all levels Assist in managing risks effectively through application of risk management process at varying levels within specific contexts of the organization Ensure risk information is adequately reported to the management Ensure risk based decision making and accountability The key to success Effectiveness of framework

How does the Framework work? Mandate & Commitment The framework components interrelate in an iterative manner Organization should adapt the components to their specific needs Implemented by Risk Management Process Existing general RM process should be critically reviewed and assessed against IT Security requirements Design framework for managing risk Continually improve the framework Implement risk management Monitor and review the framework Basic Risk Management Framework recommended by ISO 31000:2009

How does the RM Process work? Context Establishment The process components interrelate in an iterative manner provide a good balance between time and effort spent in identifying controls Ensure high risks are appropriately assessed Embedded in the culture and practices Tailored to the business processes of enterprise Risk assessment Risk Identification Risk Analysis Risk Communicate and Consultation Risk Monitoring and Review Risk Evaluation N Y Risk Treatment N Y Risk Acceptance Illustration of an Information Security Risk Management Process by ISO 31000:2009

Why always iterative approach? A systematic approach is necessary for Infor Sec Risk Management Risk Management is a continual process Iterative approach provides good balance between time and effort Information security protection efforts will vary over time Why again? Ultimately, CHANGES! from internal and external parties Including but not limited to technology changes and enemy changes

Sample 1 - Hardware Vulnerability Threat Impact Mitigating control Unprotected storage Threat Theft of media of documents Impact Loss of business information Mitigating control Lock the storage in rooms under video surveillance

Sample 2 - Software Vulnerability Threat Impact Mitigating control Unclear or incomplete specification for developers Threat Software malfunction Impact System shutdown, critical public relationship or project delay, depending on specific business type Mitigating control Peer review and confirm on all specification documents before development

Samples 3 - Network Vulnerability Threat Impact Mitigating control Transfer of passwords in clear Threat Remote spying, illegal access to internal system Impact Damage of reputation or loss of business, depending on specific business type Mitigating control Encrypt password Send password hash code instead of password