Security Mgt U5, risk analysis and mgt (part 1)

Security Mgt U5, risk analysis and mgt (part 1)

1. risk model

   • risk
     • identify, analyze, model
       • assets
       • threats
       • vulnerabilities
     • management
       • countermeasures
       • implementation
       • audit

2. definitions

   • risk
     • potential for an unwanted event to have a negative impact upon an activity by exploiting an exposure
   • risk management
     • reduction of the exposures identified by risk analysis to a level acceptable to the organization
   • gap analysis
     • highlights areas where there are significant gaps i the security managemen process or in security measures implemented
   • business impact analysis
     • identifies impact for organization if the functions that core information systems are interrupted. quantifies importance for business
   • assets
     • physical environment
     • hardware
     • data
     • software/systems
     • communications network
     • infrastructure
     • staff

3. 4 kinds of risk

   • business
   • project
   • operational
   • financial

4. related legislation

   • HIPAA
   • Gamm Leach Bliley Act
   • Basel II
   • Sarbanes Oxley
   • financial services and markets act

5. manuallly documented or software-guided?

   • manual
     • low cost to entry
     • simpler but error prone
     • less efficient
     • harder to share and repeat
     • increased cost of expertise maintenance
   • software guided
     • consistently implements a specific methodology
     • guides user
     • reusable, shareable
     • dynamic, efficient
     • software options (image)
       • Security Mgt U5, Risk Analysis Methods and Tools (image)

6. ISMS documentation set

   • infosec policy
   • information asset register
   • risk assessment report
   • statement of applicability
   • policies and procedrues

7. threat motivation

   • resources
   • opportunity
   • capability
   • publicity
   • asset attractiveness

8. qualitative vs. quantitative

   • qualtitative
     • capable of handling soft impacts
     • handles hard & soft impacts consistently
     • adapts to emerging best practices
     • accepts that risk mgt is evolving
     • relies on consensus of "best placed"
     • dependent on expert opinion
       • only as good as your best expert opinion
   • quantitative
     • every loss is capable of beig expressed in financial terms
       • requires careful records
       • formula for financial impact (image)
         • Security Mgt U5, quantitative risk assessment forumula (image)
       • expected frequency of attacks is known (statistics bank)
       • has problems with new risks
       • has problems with less concrete risk