1. Security Risk Management

2. Agenda Overview Reactive Vs. Proactive approaches
Quantitative risk management or qualitative risk management
Assessing Risk
Conducting Decision Support
Implementing Controls
Measuring Program Effectiveness

3. Reactive Approaches to Risk Management
Protect human life and people’s safety should always be your first priority.
Contain the harm that the attack caused helps to limit additional damage.
Determine the extent of the damage that the attack caused right after you contain the situation and duplicate the hard disks.
Understand the resources at which attack was aimed and what vulnerabilities were exploited to gain access or disrupt services.
Damage should be repaired as quickly as possible to restore normal business operations and recover data lost during the attack.
Review the process thoroughly. Determine with your team the steps that were executed successfully and what mistakes were made.

4. Proactive Approaches to Risk Management
Instead of waiting for bad things to happen and then responding to them afterwards, you minimize the possibility of the bad things ever occurring in the first place.
Common high-level procedures:
-- Identify business assets;
-- Determine what damage an attack against an asset could cause to the organization.
-- Identify the security vulnerabilities that the attack could exploit.
-- Determine how to minimize the risk of attack by implementing appropriate controls.

5. Approaches to Risk Prioritization -- Quantitative Risk Management
The goal is to try to calculate objective numeric values for each of the components gathered during the risk assessment and cost – benefit analysis.
Valuing Assets: The overall of the asset to your organization; The immediate financial impact of losing the asset; The indirect business impact of losing the asset.
Determining the Single Loss Expectancy(SLE) : SLE is the total amount of revenue that is lost from a single occurrence of the risk.
Determining the Annual Rate of Occurrence(ARO): ARO is the number of times that you reasonably expect the risk to occur during one year.
Determining Annual Loss Expectance(ALE): The ALE is the total amount of money that your organization will lose in one year if nothing is done to mitigate the risk.
Determining Cost of Controls: requires accurate estimates on how much acquiring, testing, deploying, operating, and maintaining each control would cost.
Return on security Investment: ROSI = ALE before control – ALE after control – annual cost of controls.
The results of the quantitative Risk analyses:
-- Assigned monetary values for asset
-- A comprehensive list of significant threats
-- The probability of each threat occurring
-- The loss potential for the company on a per-threat basis over 12 months.
-- Recommended safeguards, control, and actions.

6. Approaches to Risk Prioritization -- Qualitative Risk Management
The basic process is very similar to what happens in the quantitative approach.
The difference is in the details:
-- You calculate relative values not assign hard financial values to assets, expected losses, and cost of controls.
-- Risk analysis is usually conducted through a combination of questionnaires and collaborative workshops involving people from a variety of groups within the organization; 
The results are presented to management for consideration during a cost-benefit analysis.

7. Comparing two approaches:
Quantitative
Qualitative
Benefits
– Risks are prioritized by financial impact; assets are prioritized by financial values.
–Results facilitate management of risk by return on security investment.
–Results can be expressed in management-specific terminology (e.g., monetary values and probability expressed as a specific percentage).
–Accuracy tends to increase over time as the organization builds historic record of data while gaining experience.
– Enables visibility and understanding of risk ranking.
– Easier to reach consensus.
– Not necessary to quantify threat frequency.
– Not necessary to determine financial values of assets.
– Easier to involve people who are not experts on security or computers.
Drawbacks
–Impact values assigned to risks are based on subjective opinions of participants.
– Process to reach credible results and consensus is very time consuming.
– Calculations can be complex and time consuming.
–Results are presented in monetary terms only, and they may be difficult for non-technical people to interpret.
–Process requires expertise, so participants cannot be easily
– Insufficient differentiation between important risks.
– Difficult to justify investing in control implementation because there is no basis for a cost-benefit analysis.
– Results are dependent upon the quality of the risk management team that is created.

8. Microsoft Security Risk Management Process
Is a hybrid approach that joins the best elements of the 2 traditional approaches.
Significantly simpler than traditional quantitative risk management.
Minimize resistance to results of the risk analysis and decision support phases.
Enabling consensus to be achieved more quickly and maintained throughout the process.

9. Risk Management vs. Risk Assessment
Goal
Manage risks across business to acceptable level
Identify and prioritize risks
Cycle
Overall program across all four phases
Single phase of risk management program
Schedule
Ongoing
As needed
Alignment
Aligned with budgeting cycles
N/A

10. Communicating Risk

11. Determining Risk Management Maturity Level
There are 6 levels
-- 0 non existed.
-- 1 Ad Hoc
-- 2 Repeatable
-- 3 Defined Process
-- 4 Managed
-- 5 Optimized
Self assessment: given a questions list, for each question, score your organization from 0 to 5 based on the definition, then add all of the score together.

12. Defining Roles and Responsibilities

13. Assessing Risk -- Identify and prioritize risks to the business
Planning —Building the foundation for a successful risk assessment.
Facilitated data gathering — Collecting risk information through facilitated risk discussions.
Risk prioritization — Ranking identified risks in a consistent and repeatable process.

14. Assessing Risk -- Planning
Alignment: Proper timing aids in building consensus during the assessment because it allows stakeholders to take active roles in the planning process. Proper alignment of the risk management process with the budget planning cycle also benefit internal and external auditing activities.
Scope: the risk assessment scope should document all organization functions included in the risk assessment.
Stakeholder Acceptance: A best practice to enlist stakeholder support is to pre-sell the concept and the activities within the risk assessment
Preparing for success: Setting reasonable expectations is critical if the risk assessment is to be successful.
Embracing Subjectivity

15. Facilitated Data Gathering
Keys to success: Building support; Discussing vs. Interrogating; Building Goodwill
Risk Discussion Preparation:
-- Identify Risk Assessment Inputs
-- Identify and classifying Assets
-- Organizing Risk Information
-- Organizing by Defense-in-Depth Layers
-- Defining Threats and Vulnerabilities
-- Estimating Asset Exposure
-- Estimating Probability of Threats
Facilitating Risk Discussions

16. Conducting Decision Support
Define functional requirements.
Select control solutions.
Review solutions against the requirements.
Estimate the degree of risk reduction that each control provides.
Estimate costs of each solution.
Select the risk mitigation strategy.

17. Implementing Controls and Measuring Program Effectiveness
Implementing Controls phase
-- Deploy and operate control solutions to reduce risk to the business.
-- Seek holistic approach – Incorporate people, process, and technology in mitigation solution.
-- Organize by defense-in-depth – Organize mitigation solutions across the business.
Measuring Program Effectiveness phase
-- is an ongoing one in which the Security Risk Management Team periodically verifies that the controls implemented during the preceding phase are actually providing the expected degree of protection.
-- Analyze the risk management process for effectiveness and verify that controls are providing the expected degree of protection.
  -- Evaluate the risk management program for opportunities to improve.
-- Develop risk scorecard – Understand risk posture and progress.

18. Level of Effort