1. Risk Management - Security
Lecture 3 SD3043
Management of Information Security, Whitman & Mattord

2. Outline Define risk management and its role in the organization
Risk management techniques to identify and prioritize risk factors for information assets
Assess risk based on the likelihood of adverse events and the effects on information assets when events occur
Document the results of risk identification
Risk mitigation strategy options to control risk
Risk control classification categories
OCTAVE approach to managing risk
Learning Objectives
Upon completion of this chapter you should be able to:
Recognize the importance of information technology and understand who is responsible for protecting an organization’s information assets
Know and understand the definition and key characteristics of information security
Know and understand the definition and key characteristics of leadership and management
Recognize the characteristics that differentiate information security management from general management
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 2 2

3. Introduction
Managing risk is one of the key responsibilities of every manager within the organization
In any well-developed risk management program, two formal processes are at work:
Risk identification and assessment
Risk control
Introduction
Information security departments are created primarily to manage IT risk.
Managing risk is one of the key responsibilities of every manager within the organization.
In any well-developed risk management program, two formal processes are at work:
risk identification and assessment
risk control
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 3 3

4. Figure 7-1 Risk Identification Process
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 4 4

5. Risk Identification
Risk identification begins with the process of self-examination
Managers identify the organization’s information assets, classify them into useful groups, and prioritize them by their overall importance
Risk Identification
Risk identification begins with the process of self-examination.
At this stage, managers identify the organization’s information assets, classify them into useful groups, and prioritize them by their overall importance.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 5 5

6. Creating an Inventory of Information Assets
Identify information assets, including people, procedures, data and information, software, hardware, and networking elements
This step should be done without pre-judging the value of each asset; values will be assigned later in the process
Creating an Inventory of Information Assets
The risk identification process begins with the identification of information assets, including people, procedures, data and information, software, hardware, and networking elements.
This step should be done without pre-judging the value of each asset; values will be assigned later in the process.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 6 6

7. Table 7-1 Organizational Assets Used in Systems
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 7 7

8. Classifying and Categorizing Assets
Once the initial inventory is assembled, determine whether its asset categories are meaningful
Inventory should also reflect sensitivity and security priority assigned to each information asset
A classification scheme categorizes these information assets based on their sensitivity and security needs
Classifying and Categorizing Assets
Once the initial inventory is assembled, you must determine whether its asset categories are meaningful to the organization’s risk management program.
The inventory should also reflect the sensitivity and security priority assigned to each information asset.
A classification scheme should be developed that categorizes these information assets based on their sensitivity and security needs, i.e. confidential, internal, and public.
Each of these classification categories designates the level of protection needed for a particular information asset.
Some asset types, such as personnel, may require an alternative classification scheme that would identify the information security processes used by the asset type.
Classification categories must be comprehensive and mutually exclusive.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 8 8

9. Classifying and Categorizing Assets (continued)
Each of these categories designates the level of protection needed for a particular information asset
Some asset types, such as personnel, may require an alternative classification scheme that would identify the clearance needed to use the asset type
Classification categories must be comprehensive and mutually exclusive
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 9

10. Assessing Values for Information Assets
As each information asset is identified, categorized, and classified, assign a relative value
Relative values are comparative judgments made to ensure that the most valuable information assets are given the highest priority, for example:
Which information asset is the most critical to the success of the organization?
Which information asset generates the most revenue?
Which information asset generates the highest profitability?
Which information asset is the most expensive to replace?
Which information asset is the most expensive to protect?
Which information asset’s loss or compromise would be the most embarrassing or cause the greatest liability?
Assessing Values for Information Assets
As each information asset is identified, categorized, and classified, a relative value must also be assigned to it.
Relative values are comparative judgments made to ensure that the most valuable information assets are given the highest priority when managing risk.
Which information asset is the most critical to the success of the organization?
Which information asset generates the most revenue?
Which information asset generates the highest profitability?
Which information asset is the most expensive to replace?
Which information asset is the most expensive to protect?
Which information asset’s loss or compromise would be the most embarrassing or cause the greatest liability?
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 10 10

11. Figure 7-2 Sample Asset Classification Worksheet
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 11 11

12. Listing Assets in Order of Importance
The final step in the risk identification process is to list the assets in order of importance
This goal can be achieved by using a weighted factor analysis worksheet
Listing Assets in Order of Importance
The final step in the risk identification process is to list the assets in order of importance.
This goal can be achieved by using a weighted factor analysis worksheet.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 12 12

13. Table 7-2 Weighted Factor Analysis Worksheet
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 13 13

14. Data Classification Model
Data owners must classify the information assets for which they are responsible and review the classifications periodically
Example
Public
For official use only
Sensitive
Classified
Data Classification Model
Corporate and military organizations use a variety of classification schemes.
Data owners must classify the information assets for which they are responsible.
Data owners must review these classifications periodically to ensure that the data are still classified correctly and the access controls are in place.
For Example:
Public:
For official use only:
Sensitive:
Classified:
As you might expect, the U.S. military classification scheme relies on a more complex categorization system than the schemes of most corporations.
For most information, the U.S. military uses a five-level classification scheme as defined in Executive Order 12958:
Unclassified Data:
Sensitive But Unclassified (SBU) Data:
Confidential Data:
Secret Data:
Top Secret Data:
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 14 14

15. Data Classification Model (continued)
The U.S. military classification scheme relies on a more complex five-level classification scheme as defined in Executive Order 12958
Unclassified data
Sensitive but unclassified (SBU) data
Confidential data
Secret data
Top Secret data
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 15

16. Security Clearances
In a security clearance structure, each user of an information asset is assigned an authorization level that indicates the level of information classification they may access
Most organizations have developed roles and corresponding security clearances, so individuals are assigned into groups that correlate with the classifications of the information assets they need for their work
In the need-to-know principle, regardless of one’s security clearance, an individual is not allowed to view data simply because it falls within that individual’s level of clearance
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 16 16

17. Management of Classified Information Assets
Managing an information asset includes considering the storage, distribution, portability, and destruction of that information asset
An information asset that has a classification designation other than unclassified or public must be clearly marked as such and must be available only to authorized individuals
To maintain the confidentiality of classified documents, managers can implement a clean desk policy
When copies of classified information are no longer valuable or too many copies exist, care should be taken to destroy them properly to discourage dumpster diving
Management of the Classified Information Asset
Managing an information asset includes considering the storage, distribution, portability, and destruction of that information asset.
An information asset that has a classification designation other than unclassified or public must be clearly marked as such.
Classified documents must be available only to authorized individuals - locking cabinets, safes, etc.
To maintain the confidentiality of classified documents, managers can implement a clean desk policy.
When copies of classified information are no longer valuable or too many copies exist, care should be taken to destroy them properly to discourage dumpster diving.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 17 17

18. Threat Identification
Any organization typically faces a wide variety of threats
If you assume that every threat can and will attack every information asset, then the project scope becomes too complex
To make the process less unwieldy, each step in the threat identification and vulnerability identification process is managed separately and then coordinated at the end
Threat Identification
Any organization typically faces a wide variety of threats.
If you assume that every threat can and will attack every information asset, then the project scope becomes too complex.
To make the process less unwieldy, each step in the threat identification and vulnerability identification processes is managed separately and then coordinated at the end.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 18 18

19. Identify and Prioritize Threats and Threat Agents
Each threat presents a unique challenge to information security and must be handled with specific controls that directly address the particular threat and the threat agent’s attack strategy
Before threats can be assessed in the risk identification process, however, each threat must be further examined to determine its potential to affect the targeted information asset
In general, this process is referred to as a threat assessment
Identify And Prioritize Threats and Threat Agents
Each of these threats presents a unique challenge to information security and must be handled with specific controls that directly address the particular threat and the threat agent’s attack strategy.
Before threats can be assessed in the risk identification process, however, each threat must be further examined to determine its potential to affect the targeted information asset.
In general, this process is referred to as a threat assessment.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 19 19

20. Table 7-3 Threats to Information Security
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 20 20

21. Vulnerability Assessment
Once you have identified the information assets of the organization and documented some threat assessment criteria, you can begin to review every information asset for each threat
This review leads to the creation of a list of vulnerabilities that remain potential risks to the organization
Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset
At the end of the risk identification process, a list of assets and their vulnerabilities has been developed
This list serves as the starting point for the next step in the risk management process: risk assessment
Vulnerability Assessment
Once you have identified the information assets of the organization and documented some threat assessment criteria, you can begin to review every information asset for each threat.
This review leads to the creation of a list of vulnerabilities that remain potential risks to the organization.
Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset.
At the end of the risk identification process, a list of assets and their vulnerabilities has been developed.
This list serves as the starting point for the next step in the risk management process—risk assessment.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 21 21

22. The TVA Worksheet
At the end of the risk identification process, a list of assets and their vulnerabilities has been developed
Another list prioritizes threats facing the organization based on the weighted table discussed earlier
These lists can be combined into a single worksheet
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 22 22

23. Table 7-5 Sample TVA Spreadsheet
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 23 23

24. Risk Identification Estimate Factors
Risk is
The likelihood of the occurrence of a vulnerability
Multiplied by
The value of the information asset
Minus
The percentage of risk mitigated by current controls
Plus
The uncertainty of current knowledge of the vulnerability
Risk Identification Estimate Factors
Risk is
The likelihood of the occurrence of a vulnerability
Multiplied by
The value of the information asset
Minus
The percentage of risk mitigated by current controls
Plus
The uncertainty of current knowledge of the vulnerability
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 24 24

25. Likelihood
Likelihood is the overall rating—often a numerical value on a defined scale (such as 0.1 – 1.0)—of the probability that a specific vulnerability will be exploited
Using the information documented during the risk identification process, you can assign weighted scores based on the value of each information asset, i.e , low-med-high, etc.
Likelihood
Likelihood is the overall rating—a numerical value on a defined scale (.1 – 1.0)—of the probability that a specific vulnerability will be exploited.
Using the information documented during the risk identification process, you can assign weighted scores based on the value of each information asset, i.e , low-med-high, etc.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 25 25

26. Assessing Potential Loss
To be effective, the likelihood values must be assigned by asking:
Which threats present a danger to this organization’s assets in the given environment?
Which threats represent the most danger to the organization’s information?
How much would it cost to recover from a successful attack?
Which threats would require the greatest expenditure to prevent?
Which of the aforementioned questions is the most important to the protection of information from threats within this organization?
Assessing Potential Loss
To be effective, the values must be assigned by asking:
Which threats present a danger to this organization’s assets in the given environment?
Which threats represent the most danger to the organization’s information?
How much would it cost to recover from a successful attack?
Which threats would require the greatest expenditure to prevent?
Which of the aforementioned questions is the most important to the protection of information from threats within this organization?
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 26 26

27. Percentage of Risk Mitigated by Current Controls
If a vulnerability is fully managed by an existing control, it can be set aside
If it is partially controlled, estimate what percentage of the vulnerability has been controlled
Percentage of Risk Mitigated by Current Controls
If a vulnerability is fully managed by an existing control, it can be set aside.
If it is partially controlled, estimate what percentage of the vulnerability has been controlled.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 27 27

28. Uncertainty
It is not possible to know everything about every vulnerability
The degree to which a current control can reduce risk is also subject to estimation error
Uncertainty is an estimate made by the manager using judgment and experience
Uncertainty
It is not possible to know everything about every vulnerability.
The degree to which a current control can reduce risk is also subject to estimation error. A factor that accounts for uncertainty must always be added to the equations; it consists of an estimate made by the manager using good judgment and experience.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 28 28

29. Risk Determination Example
Asset A has a value of 50 and one vulnerability, which has a likelihood of 1.0 with no current controls. Your assumptions and data are 90% accurate.
Asset B has a value of 100 and has two vulnerabilities: vulnerability #2 has a likelihood of 0.5 with a current control that addresses 50% of its risk; vulnerability # 3 has a likelihood of 0.1 with no current controls. Your assumptions and data are 80% accurate.
Risk Determination Example
Asset A has a value of 50 and has one vulnerability, which has a likelihood of 1.0 with no current controls. Your assumptions/data are 90% accurate.
Asset B has a value of 100 and has two vulnerabilities: Vul #2 has a likelihood of 0.5 with a current control that addresses 50% of its risk; vul # 3 has a likelihood of 0.1 with no current controls. Your assumptions and data are 80% accurate.
The resulting ranked list of risk ratings for the three vulnerabilities is as follows:
Asset A: Vulnerability 1 rated as 55 = (50 × 1.0) – 0% + 10%.
Asset B: Vulnerability 2 rated as 35 = (100 × 0.5) – 50% + 20%.
Asset B: Vulnerability 3 rated as 12 = (100 × 0.1) – 0 % + 20%.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 29 29

30. Risk Determination Example (continued)
The resulting ranked list of risk ratings for the three vulnerabilities is as follows:
Asset A: Vulnerability 1 rated as 55 = (50 × 1.0) – 0% + 10%
Asset B: Vulnerability 2 rated as 35 = (100 × 0.5) – 50% + 20%
Asset B: Vulnerability 3 rated as 12 = (100 × 0.1) – 0 % + 20%
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 30

31. Identify Possible Controls
For each threat and its associated vulnerabilities that have residual risk, create a preliminary list of control ideas
Three general categories of controls exist:
Policies
Programs
Technical controls
Identify Possible Controls
For each threat and its associated vulnerabilities that have residual risk, create a preliminary list of control ideas.
Three general categories of controls exist: policies, programs, and technical controls.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 31 31

32. Access Controls
Access controls specifically address admission of a user into a trusted area of the organization
These areas can include information systems, physically restricted areas such as computer rooms, and even the organization in its entirety
Access controls usually consist of a combination of policies, programs, and technologies
Access Controls
Access controls specifically address admission of a user into a trusted area of the organization.
These areas can include information systems, physically restricted areas such as computer rooms, and even the organization in its entirety.
Access controls usually consist of a combination of policies, programs, and technologies.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 32 32

33. Documenting the Results of Risk Assessment
The goal of the risk management process so far has been to identify information assets and their vulnerabilities and to rank them according to the need for protection
In preparing this list, a wealth of factual information about the assets and the threats they face is collected
Also, information about the controls that are already in place is collected
The final summarized document is the ranked vulnerability risk worksheet
Documenting the Results of Risk Assessment
The goal of the risk management process so far has been to identify information assets and their vulnerabilities and to rank them according to the need for protection.
In preparing this list, a wealth of factual information about the assets and the threats they face is collected.
Also, information about the controls that are already in place is collected.
The final summarized document is the ranked vulnerability risk worksheet.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 33 33

34. Table 7-7 Risk Identification and Assessment Deliverables
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 7
Slide 34 34

35. Risk Control Strategies
An organization must choose one of four basic strategies to control risks
Avoidance: applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
Transference: shifting the risk to other areas or to outside entities
Mitigation: reducing the impact should the vulnerability be exploited
Acceptance: understanding the consequences and accepting the risk without control or mitigation
Risk Control Strategies
An organization must choose one of four basic strategies to control risks :
Avoidance: applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
Transference: shifting the risk to other areas or to outside entities
Mitigation: reducing the impact should the vulnerability be exploited
Acceptance: understanding the consequences and accept the risk without control or mitigation
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 35 35

36. Avoidance
Avoidance is the risk control strategy that attempts to prevent the exploitation of the vulnerability
Avoidance is accomplished through:
Application of policy
Application of training and education
Countering threats
Implementation of technical security controls and safeguards
Avoidance
Avoidance is the risk control strategy that attempts to prevent the exploitation of the vulnerability.
Avoidance is accomplished through:
Application of policy
Application of training and education
Countering threats
Implementation of technical security controls and safeguards
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 36 36

37. Transference
Transference is the control approach that attempts to shift the risk to other assets, other processes, or other organizations
This may be accomplished by rethinking how services are offered, revising deployment models, outsourcing to other organizations, purchasing insurance, or by implementing service contracts with providers
Transference
Transference is the control approach that attempts to shift the risk to other assets, other processes, or other organizations.
This may be accomplished by rethinking how services are offered, revising deployment models, outsourcing to other organizations, purchasing insurance, or by implementing service contracts with providers.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 37 37

38. Mitigation
Mitigation is the control approach that attempts to reduce, by means of planning and preparation, the damage caused by the exploitation of vulnerability
This approach includes three types of plans:
Disaster recovery plan (DRP)
Incident response plan (IRP)
Business continuity plan (BCP)
Mitigation depends upon the ability to detect and respond to an attack as quickly as possible
Mitigation
Mitigation is the control approach that attempts to reduce, by means of planning and preparation, the damage caused by the exploitation of vulnerability.
This approach includes three types of plans:
the disaster recovery plan (DRP),
incident response plan (IRP), and
business continuity plan (BCP).
Mitigation depends upon the ability to detect and respond to an attack as quickly as possible.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 38 38

39. Acceptance
The choice to do nothing to protect an information asset and to accept the loss when it occurs
This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure
Acceptance
As described above, mitigation is a control approach that attempts to reduce the impact of an exploited vulnerability.
In contrast, acceptance of risk is the choice to do nothing to protect an information asset and to accept the outcome from any resulting exploitation.
This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure.
The only valid use of the acceptance strategy occurs when the organization has:
Determined the level of risk to the information asset
Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability
Approximated the ARO of the exploit
Estimated the potential loss from attacks
Performed a thorough cost benefit analysis
Evaluated controls using each appropriate type of feasibility
Decided that the particular asset did not justify the cost of protection
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 39 39

40. Acceptance (continued)
The only valid use of the acceptance strategy occurs when the organization has:
Determined the level of risk to the information asset
Assessed the probability of attack and the likelihood of a successful exploitation of a vulnerability
Approximated the ARO (annualized rate of occurrence) of the exploit
Estimated the potential loss from attacks
Performed a thorough cost benefit analysis
Evaluated controls using each appropriate type of feasibility
Decided that the particular asset did not justify the cost of protection
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 40

41. Managing Risk
Risk appetite (also known as risk tolerance) defines the quantity and nature of risk that organizations are willing to accept, as they evaluate the trade-offs between perfect security and unlimited accessibility
The reasoned approach to risk is one that balances the expense (in terms of finance and the usability of information assets) against the possible losses if exploited
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 41

42. Managing Risk (continued)
When vulnerabilities have been controlled as much as possible, there is often remaining risk that has not been completely removed, shifted, or planned for; in other words, residual risk
“Residual Risk is a combined function of (1) a threat less the effect of threat-reducing safeguards; (2) a vulnerability less the effect of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-reducing safeguards.”
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 42

43. Managing Risk (continued)
The goal of information security is not to bring residual risk to zero, but to bring it in line with an organization’s risk tolerance
If decision makers have been informed of uncontrolled risks and the proper authority groups within the communities of interest decide to leave residual risk in place, then the information security program has accomplished its primary goal
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 43

44. Evaluation, Assessment, and Maintenance of Risk Controls
Once a control strategy has been selected and implemented, the effectiveness of controls should be monitored and measured on an ongoing basis to determine its effectiveness and the accuracy of the estimate of the risk that will remain after all planned controls are in place
Evaluation, Assessment, And Maintenance Of Risk Controls
Once a control strategy has been selected and implemented, the effectiveness of controls should be monitored and measured on an ongoing basis to determine its effectiveness and the accuracy of the estimate of the risk that will remain after all planned controls are in place.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 44 44

45. Risk Control Strategy Selection
Risk control involves selecting one of the four risk control strategies for the vulnerabilities present within the organization
If the loss is within the range of losses the organization can absorb, or if the attacker’s gain is less than expected costs of the attack, the organization may choose to accept the risk
Otherwise, one of the other control strategies will have to be selected
Risk Control Strategy Selection
Risk control involves selecting one of the four risk control strategies for the vulnerabilities present within the organization.
If the loss is within the range of losses the organization can absorb, or if the attacker’s gain is less than expected costs of the attack, the organization may choose to accept the risk.
Otherwise, one of the other control strategies will have to be selected.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 45 45

46. Risk Control Strategy Selection
Some rules of thumb:
When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exercised
When a vulnerability can be exploited: Apply layered controls to minimize the risk or prevent occurrence
When the attacker’s potential gain is greater than the costs of attack: Apply protections to increase the attacker’s cost, or reduce the attacker’s gain, using technical or managerial controls
When potential loss is substantial: Apply design controls to limit the extent of the attack, thereby reducing the potential for loss
Risk Control Strategy Selection
Some rules of thumb on strategy selection are:
When a vulnerability exists: Implement security controls to reduce the likelihood of a vulnerability being exercised.
When a vulnerability can be exploited: Apply layered controls to minimize the risk or prevent occurrence.
When the attacker’s potential gain is greater than the costs of attack: Apply protections to increase the attacker’s cost, or reduce the attacker’s gain, using technical or managerial controls.
When potential loss is substantial: Apply design controls to limit the extent of the attack, thereby reducing the potential for loss.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 46 46

47. Feasibility Studies and Cost Benefit Analysis
Before deciding on the strategy for a specific vulnerability, all readily accessible information about the consequences of the vulnerability must be explored
“What are the advantages of implementing a control as opposed to the disadvantages of implementing the control?”
There are a number of ways to determine the advantage or disadvantage of a specific control
The primary means are based on the value of the information assets that it is designed to protect
Feasibility Studies and Cost Benefit Analysis
Before deciding on the strategy for a specific vulnerability, all readily accessible information about the consequences of the vulnerability must be explored.
“What are the advantages of implementing a control as opposed to the disadvantages of implementing the control?”
There are a number of ways to determine the advantage or disadvantage of a specific control.
The primary means is to determine the value of the information assets that it is designed to protect.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 47 47

48. Cost Benefit Analysis (CBA)
The criterion most commonly used when evaluating a project that implements information security controls and safeguards is economic feasibility
Organizations are urged to begin a cost benefit analysis by evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised
This decision-making process is called a cost benefit analysis or an economic feasibility study
Cost Benefit Analysis (CBA)
The criterion most commonly used when evaluating a project that implements information security controls and safeguards is economic feasibility.
Organizations are urged to begin a cost benefit analysis by evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised by the exploitation of a specific vulnerability.
This decision-making process is called a cost benefit analysis or an economic feasibility study.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 48 48

49. Cost
Just as it is difficult to determine the value of information, it is difficult to determine the cost of safeguarding it
Some of the items that affect the cost of a control or safeguard include:
Cost of development or acquisition of hardware, software, and services
Training fees
Cost of implementation
Service costs
Cost of maintenance
Cost
Just as it is difficult to determine the value of information, it is difficult to determine the cost of safeguarding it.
Some of the items that affect the cost of a control or safeguard include:
Cost of development or acquisition of hardware, software, and services
Training fees
Cost of implementation
Service costs
Cost of maintenance
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 49 49

50. Benefit
Benefit is the value to the organization of using controls to prevent losses associated with a specific vulnerability
The benefit is usually determined by valuing the information asset or assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset
This is expressed as the annualized loss expectancy (ALE)
Benefit
Benefit is the value to the organization of using controls to prevent losses associated with a specific vulnerability.
The benefit is usually determined by valuing the information asset or assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset.
This is expressed as the annualized loss expectancy (ALE).
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 50 50

51. Asset Valuation
Asset valuation is the process of assigning financial value or worth to each information asset
The value of information differs within organizations and between organizations, based on the characteristics of information and the perceived value of that information
The valuation of assets involves estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against loss and litigation
Asset Valuation
Asset valuation is the process of assigning financial value or worth to each information asset.
The value of information differs within organizations and between organizations, based on the characteristics of information and the perceived value of that information.
The valuation of assets involves estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against loss and litigation.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 51 51

52. Asset Valuation Techniques
A single loss expectancy, or SLE, is the calculation of the value associated with the most likely loss from an attack
SLE is a calculation based on the value of the asset and the expected percentage of loss that would occur from a particular attack:
SLE = asset value (AV) x exposure factor (EF)
Where EF = the percentage loss that would occur from a given vulnerability being exploited
This information is usually estimated
Asset Valuation Techniques
A single loss expectancy, or SLE, is the calculation of the value associated with the most likely loss from an attack.
It is a calculation based on the value of the asset and the expected percentage of loss that would occur from a particular attack:
SLE = asset value (AV) x exposure factor (EF)
Where EF = the percentage loss that would occur from a given vulnerability being exploited.
This information is usually estimated.
In most cases, the probability of a threat occurring is usually a loosely derived table indicating the probability of an attack from each threat type within a given time frame.
This value is commonly referred to as the ARO, or annualized rate of occurrence.
In order to standardize calculations, you convert the rate to a yearly (annualized) value.
This is expressed as the probability of a threat occurrence.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 52 52

53. Asset Valuation Techniques (continued)
In most cases, the probability of a threat occurring is the probability of loss from an attack within a given time frame
This value is commonly referred to as the ARO, or annualized rate of occurrence
ALE = SLE * ARO
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 53

54. The Cost Benefit Analysis (CBA) Formula
CBA determines whether or not a control alternative is worth its associated cost
CBAs may be calculated before a control or safeguard is implemented, to determine if the control is worth implementing, or calculated after controls have been implemented and have been functioning for a time:
CBA = ALE(prior) – ALE(post) – ACS
ALE (prior to control) is the annualized loss expectancy of the risk before the implementation of the control
ALE (post-control) is the ALE examined after the control has been in place for a period of time
ACS is the annual cost of the safeguard
The Cost Benefit Analysis (CBA) Formula
CBA determines whether or not a control alternative is worth its associated cost.
CBAs may be calculated before a control or safeguard is implemented, to determine if the control is worth implementing, or calculated after controls have been implemented and have been functioning for a time.
CBA = ALE(prior) – ALE(post) – ACS
ALE(prior to control) is the annualized loss expectancy of the risk before the implementation of the control.
ALE(post control) is the ALE examined after the control has been in place for a period of time.
ACS is the annual cost of the safeguard.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 54 54

55. Other Feasibility Approaches
Organizational feasibility analysis examines how well the proposed information security alternatives will contribute to the operation of an organization
Operational feasibility addresses
user acceptance and support
management acceptance and support
the overall requirements of the organization’s stakeholders
Other Feasibility Approaches
Organizational feasibility analysis examines how well the proposed information security alternatives will contribute to the operation of an organization.
Operational feasibility addresses user acceptance and support, management acceptance and support, and the overall requirements of the organization’s stakeholders.
Technical feasibility examines whether or not the organization has or can acquire the technology to implement and support the alternatives.
Political feasibility defines what can and cannot occur based on the consensus and relationships between the communities of interest.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 55 55

56. Other Feasibility Approaches (continued)
Technical feasibility examines whether or not the organization has or can acquire the technology to implement and support the alternatives
Political feasibility defines what can and cannot occur based on the consensus and relationships between the communities of interest
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 56

57. Alternatives to Feasibility Analysis
Benchmarking
Due care and due diligence
Best business practices
Gold standard
Government recommendations
Baseline
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 57

58. Benchmarking
Benchmarking is seeking out and studying the practices from other organizations that produce the results desired, and then measuring the differences between the way the organizations conduct business
When benchmarking, an organization typically uses one of two measures to compare practices:
Metrics-based measures are comparisons based on numerical standards
Process-based measures are generally less focused on numbers and are more strategic
Benchmarking
Benchmarking is the process of seeking out and studying the practices used in other organizations that produce the results you desire in your organization.
An organization typically benchmarks by selecting a measure with which to compare itself with the other organizations in its market.
The organization then measures the difference in the way it conducts business and the way the other organizations conduct business.
When benchmarking, an organization typically uses one of two measures to compare practices: metrics-based measures or process-based measures.
Metrics-based measures are comparisons based on numerical standards, such as:
Numbers of successful attacks
Staff hours spent on systems protection
Dollars spent on protection
Numbers of security personnel
Estimated value in dollars of the information lost in successful attacks
Loss in productivity hours associated with successful attacks
Process-based measures are generally less focused on numbers and are more strategic.
For each of the areas the organization is interested in benchmarking, process based measures enable the companies to examine the activities an individual company performs in pursuit of its goal, rather than the specifics of how goals are attained.
The primary focus is the method the organization uses to accomplish a particular process, rather than the outcome.
In the field of information security, two categories of benchmarks are used:
standards of due care and due diligence, and
best practices.
Within best practices, the gold standard is a subcategory of practices that are typically viewed as “the best of the best.”
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 58 58

59. Benchmarking (continued)
In the field of information security, two categories of benchmarks are used:
Standards of due care and due diligence
Best practices
Within best practices, the gold standard is a subcategory of practices that are typically viewed as “the best of the best”
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 59

60. Due Care and Due Diligence
For legal reasons, an organization may be forced to adopt a certain minimum level of security
When organizations adopt levels of security for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances
This is referred to as a standard of due care
Due diligence is the demonstration that the organization is persistent in ensuring that the implemented standards continue to provide the required level of protection
Due Care and Due Diligence.
For legal reasons, an organization may be forced to adopt a certain minimum level of security.
When organizations adopt levels of security for a legal defense, they may need to show that they have done what any prudent organization would do in similar circumstances. This is referred to as a standard of due care.
Due diligence is the demonstration that the organization is persistent in ensuring that the implemented standards continue to provide the required level of protection.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 60 60

61. Best Business Practices
Security efforts that seek to provide a superior level of performance are referred to as best business practices
Best security practices are those that are among the best in the industry, balancing access to information with adequate protection, while maintaining a solid degree of fiscal responsibility
Companies with best practices may not be the best in every area, but may simply have established an extremely high-quality or successful security effort in one or more area
Best Business Practices
Security efforts that seek to provide a superior level of performance are referred to as best business practices.
Best security practices are those that are among the best in the industry, balancing access to information with adequate protection, while maintaining a solid degree of fiscal responsibility.
Companies with best practices may not be the best in every area, but may simply have established an extremely high quality or successful security effort in one or more area.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 61 61

62. The Gold Standard
Even the best business practices are not sufficient for some organizations
These organizations aspire to set the standard by implementing the most protective, supportive, and yet fiscally responsible standards they can
The gold standard is a defining level of performance that demonstrates a company’s industrial leadership, quality, and concern for the protection of information
Seeking the gold standard is a method of striving for excellence
The Gold Standard
Even the best business practices are not sufficient for some organizations. These organizations aspire to set the standard by implementing the most protective, supportive, and yet fiscally responsible standards they can.
The gold standard is a defining level of performance that demonstrates a company’s industrial leadership, quality, and concern for the protection of information.
Seeking the gold standard is a method of striving for excellence.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 62 62

63. Problems with Benchmarking and Best Practices
Organizations don’t talk to each other
No two organizations are identical
Best practices are a moving target
Simply knowing what was going on a few years ago doesn’t necessarily indicate what to do next
Problems with Benchmarking and Best Practices
1) Organizations don’t talk to each other.
2) No two organizations are identical.
3) Best practices are a moving target.
4) Simply knowing what was going on a few years ago, doesn’t necessarily indicate what to do next.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 63 63

64. Baselining
Baselining is the analysis of measures against established standards
In information security, baselining is the comparison of security activities and events against the organization’s future performance
The information gathered for an organization’s first risk assessment becomes the baseline for future comparisons
Baselining
Baselining is the analysis of measures against established standards.
In information security, baselining is the comparison of security activities and events against the organization’s future performance.
The information gathered for an organization’s first risk assessment becomes the baseline for future comparisons.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 64 64

65. Documenting Results
When the risk management program of an organization has been completed, the result is that a series of proposed controls are prepared, each of which is justified by one or more feasibility or rationalization approaches
At a minimum, each information asset-threat pair should have a documented control strategy that clearly identifies any residual risk remaining after the proposed strategy has been executed
Some organizations document the outcome of the control strategy for each information asset-threat pair in an action plan that includes concrete tasks, each with accountability assigned to an organizational unit or to an individual
Documenting Results
When the risk management program of an organization has been completed, the result is that a series of proposed controls are prepared, each of which is justified by one or more feasibility or rationalization approaches.
At a minimum, each information asset-threat pair should have a documented control strategy that clearly identifies any residual risk remaining after the proposed strategy has been executed.
Some organizations document the outcome of the control strategy for each information asset-threat pair in an action plan that includes concrete tasks, each with accountability assigned to an organizational unit or to an individual.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 65 65

66. The OCTAVE Method
The Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVESM) Method defines the essential components of a comprehensive, systematic, context-driven, self-directed information security risk evaluation
By following the OCTAVE Method, an organization can make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets
The operational or business units and the IT department work together to address the information security needs of the organization
The OCTAVE Method
The Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVESM) Method defines the essential components of a comprehensive, systematic, context-driven, self-directed information security risk evaluation.
By following the OCTAVE Method, an organization can make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets. The operational or business units and the IT department work together to address the information security needs of the organization.
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 66 66

67. Important Aspects of the OCTAVE Method
The OCTAVE Method is self-directed
The OCTAVE Method requires an analysis team to conduct the evaluation and to analyze the information
The basic tasks of the team are:
To facilitate the knowledge elicitation workshops of Phase 1
To gather any supporting data that are necessary
To analyze threat and risk information
To develop a protection strategy for the organization
To develop mitigation plans to address the risks to the organization’s critical assets
Important Aspects Of The OCTAVE Method
The OCTAVE Method is self directed.
The OCTAVE Method requires an analysis team to conduct the evaluation and to analyze the information
The basic tasks of the team are:
to facilitate the knowledge elicitation workshops of Phase 1
to gather any supporting data that are necessary
to analyze threat and risk information
to develop a protection strategy for the organization
to develop mitigation plans to address the risks to the organization’s critical assets
The OCTAVE Method uses a workshop-based approach for gathering information and making decisions.
The OCTAVE Method relies upon the following major catalogs of information:
catalog of practices – a collection of good strategic and operational security practices
threat profile – the range of major sources of threats that an organization needs to consider
catalog of vulnerabilities – a collection of vulnerabilities based on platform and application
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 67 67

68. Important Aspects of the OCTAVE Method (continued)
The OCTAVE Method uses a workshop-based approach for gathering information and making decisions
The OCTAVE Method relies upon the following major catalogs of information:
Catalog of practices – a collection of good strategic and operational security practices
Threat profile – the range of major sources of threats that an organization needs to consider
Catalog of vulnerabilities – a collection of vulnerabilities based on platform and application
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 68

69. The OCTAVE Method
For more information, you can download the OctaveSM method implementation guide at:
The OCTAVE Method
For more information, you can download the OctaveSM method implementation guide from
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 69 69

70. Summary Risk management techniques Risk identification
Risk mitigation startegies
Risk control classification categories
OCTAVE approach to managing risk
Summary
Introduction
Risk Control Strategies
Risk Control Strategy Selection
Categories of Controls
Feasibility Studies and Cost-Benefit Analysis
Risk Management Discussion Points
Recommended Risk Control Practices
The OCTAVE Method
Management of Information Security, Whitman & Mattord
Management of Information Security, 2nd ed. - Chapter 8
Slide 70 70