Risk Assessment Richard Newman

Six Phases of Security Process 1. Identify assets 2. Analyze risk of attack 3. Establish security policy 4. Implement defenses 5. Monitor defenses 6. Recover from attacks Continuous Improvement Model – use 5 and 6 to update, revise, improve all phases

Systems Engineering Process 1. Planning – – requirements, resources, expectations 2. Trade-off analysis - – Solution development – Solution analysis – Solution comparisons – Solution selection 3. Development and implementation – Realize selected solution 4. Verification – Formal verification, validation, testing 5. Iteration – Use feedback from each stage and from deployment to improve

Deming Cycle (PDCA) 1. Plan – – Objectives, processes 2. Do - – Implement process 3. Check - – Measure results vs. expected results 4. Act - – Analyze differences, find causes, revise processes ISO 27002, used with ISO for IT A.k.a. Shewhart Cycle (father of statistical quality control) Motorola “Six Sigma” Boyd's OODA Cycle (Observe, Orient, Decide, Act) - Military

Threats Potential source of harm – Knowledge – Resources – Motive Threat classes – Script kiddies/ankle biters – Cracker – Phone phreak – Hacker – Black hat/white hat – Organized crime – Corporate crime – Government group

Risk Level Risk level changes over time – Asset visibility – Asset owner visibility – Resource availability – Access to assets – Motivation changes – Knowledge of vulnerabilities Requires continuous re-evaluation Must also consider consequences of breach

Identifying Assets 1. Hardware – Off-the shelf replacement cost/customization 2. Purchased software – Cost/installation/customization 4. Developed software 5. Statutorily protected data – Health/Financial/Academic/ Organizational data – Work products (designs/analyses/reports/...) – Planning (marketing/engineering/financial/...) – Contacts (customers/vendors/associates/etc.) 7. Activities – Production/communication/...

Implementing Protection Controls - – Hardware – Software – Processes Costs - – Up front cost to buy/develop/train/install/configure – On-going operational costs – inconvenience/monitoring/reconfiguration – Performance costs – CPU slowdown/human delay Cost vs. Effectiveness

Risk Assessment Identify Risks - – Identify assets – Identify threat agents – Identify attacks Prioritize Risks - – Estimate likelihood of attacks – Estimate impact of attacks – Calculate relative significance of attacks

Threat agents revisited Outsiders – Property thieves – Vandals – Identity thieves – Botnet operators – Con artists – Competitors Insiders – Embezzlers – Housemates/coworkers – Malicious acquaintances – Maintenance crews – Administrators “Natural” threats – Hurricane/tornado/earthquake/hail/rain/flooding/terrorism/war/...

Security Properties/Goals Confidentiality – All disclosures only reveal information to authorized recipients in accordance with policy Integrity – All changes are are performed by authorized entities, and are consistent with integrity policy Availability – Assets available to authorized users when needed with performance required

Security Services Confidentiality – Restrict access to information to authorized recipients in accordance with policy Integrity – Only allow changes that are are performed by authorized entities, and are consistent with integrity policy Availability – Ensure assets are available to authorized users when needed with performance required Authentication – Establish that entity that sent message/made access is correctly identified Non-repudiation – Ensure that an entity that performs action/makes statement cannot deny it later

Information Attacks Physical theft – Computing resource physically removed Denial of Service – Use of computing resource is lost Subversion/Modification – Asset modified to act on behalf of attacker (trojan horse) – Authentic artifact modified to suit attacker Masquerade/spoofing – Attacker takes on identity of another when accessing resources Disclosure – Information revealed contrary to policy (passive attack) Forgery/Replay – Attacker produces artifact that appears authentic – Attacker repeats authentic message

NIST Recommendations 1. System Characterization 2. Threat Identification 3. Vulnerability Identification 4. Control Analysis 5. Likelihood Determination 6. Impact Analysis 7. Risk Determination 8. Control Recommendations 9. Documentation

SEI OCTAVE Process Phase 1 – Build Asset-based Threat Profiles – Identify assets, threats, organizational risks Phase 2 – Identify Infrastructure Vulnerabilities – Analyze infrastructure resources for vulnerabilities Phase 3 – Develop Security Strategy and Plans – Recommend and implement controls

OCTAVE Allegro 1. Establish risk measurement criteria 2. Develop information asset profile 3. Identify information asset containers 4. Identify areas of concern 5. Identify threat scenarios 6. Identify risks 7. Analyze risks 8. Select mitigation approach