Risk, Risk Analysis, and Risk Management

Risk
The possibility that something could happen to damage, destroy, or disclose data or other resources.

Risk Management

Detailed process of identifying factors that could damage or disclose data, evaluating those factors in light of data value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk.

Risk Analysis
The process by which the goals of risk management are achieved.

CyberSecurity: Risk Management Quiz

1. The identification and assessment of levels of risk in an organization describes which of the following?

• Risk identification
• Risk management
• Risk reduction
• Risk analysis

2. Two of the activities involved in risk management include identifying risks and assessing risks. Which of the following activities is part of the risk assessment process?

• Assigning a value to each information asset
• Creating an inventory of information assets
• Classifying and organizing information assets into meaningful groups
• Calculating the severity of risks to which assets are exposed in their current setting

3. The likelihood of the occurrence of a vulnerability multiplied by the value of the information asset minus the percentage of risk mitigated by current controls plus the uncertainty of current knowledge of the vulnerability are each examples of _____.

• Risk assessment estimate factors
• Vulnerability mitigation controls
• Attack analysis calculation
• Exploit likelihood equation

4. Which of the following describes an organization’s efforts to reduce damage caused by a realized incident or disaster through planning and preparation?

• Mitigation
• Transference
• Avoidance
• Acceptance

5. Which of the following can be described as the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility?

• Risk appetite
• Risk termination
• Residual risk
• Risk assurance

CyberSecurity: Risk Management Practice Quiz

1. Having an established risk management program means that an organization's assets are completely protected.

• True
• False

2. The InfoSec community often takes on the leadership role in addressing risk.

• True
• False

3. Some threats can manifest in multiple ways, yielding multiple vulnerabilities for an asset-threat pair.

• True
• False

4. An evaluation of the threats to information assets, including a determination of their potential to endanger the organization is known as exploit assessment.

• True
• False

5. A prioritized lists of assets and threats can be combined with exploit information into a specialized report known as a TVA worksheet.

• True
• False

Answer:
1. False
Reason: Risk management programs do not assure complete protection, rather they demonstrate a diligent effort to assure protection.
2. True:
Reason: Because members of the InfoSec community best understand the threats and attacks that introduce risk, they often take a leadership role in addressing risk.
3. True:
Reason: Since assets operate in a common defended environment, threats that can attack one asset can often attack other assets as well. Likewise, many threats are capable of multiple modes of operation, allowing them to bypass many common defenses.
4. False
Reason: Vulnerability assessment is the process of finding weaknesses. Exploits are a means of using the weakness to cause the loss.
5 False:
Reason: Vulnerabilities are the weaknesses, exploits are the means by which vulnerabilities are used against the defender.

CyberSecurity: Risk Management - The Risk Assessment Process

In order to begin the risk assessment phase, the organization uses the list of information assets it has identified and prioritizes assets and the threats facing them to compare information assets to threats. The resulting list of vulnerabilities are those that remain risks to the organization. This list should be created for each information asset to document its vulnerability to each possible or likely attack. The best way found to do this documentation is the threat vulnerability asset, or TVA, Table.



As shown, it would list assets along the x-axis from most to least valuable and lists threats along the y-axis from most to least dangerous. At the intersection of the asset and threat pair, list the vulnerabilities that the threat might use to cause a loss to the asset. Now, we move onto assess the risk that exists in each of the TVA tables. Risk is commonly calculated as the likelihood that a threat to an asset will result in an adverse impact which is then multiplied by the consequences or impact of that attack.



That value is then increased by an estimate of how reliable our values of both likelihood and impact are, known as a confidence interval. Many approaches to assessing likelihood exist. One example of some likelihood ratings on a scale of 0 to 5 is shown here. Likewise, there are many ways to assess impact. Here is an example of some impact ratings on a scale of zero to five.

    

Before the organization can proceed with the final phase of risk management, activities, which is risk control, it needs to understand how much risk is acceptable to management. Some organizations have a very low tolerance for risk. Such as banking and other financial services firms. Other types of organization may tolerate more risk. The amount of risk that remains after all current levels are implemented is known as residual risk. Any organization may reach a point in the risk management process and find that the documented residual risk is low enough to accept being within the bounds of its risk appetite. They would end the current risk management cycle and document everything for the next cycle.



Once the organization has assessed the current level of risk facing its information assets and defined its risk appetite, it can move to the final phase of risk management. And that's called Risk Control. In the Risk Control phase, organizations employ one or more of the five strategies of risk control.

1. Defense, which is applying safeguards that eliminate or reduce the remaining uncontrolled risk. 
2. Transference, which is shifting risk to other areas or outside entities. 
3. Mitigation, which is reducing the impact to information assets should an attacker successful exploit a vulnerability. 
4. Acceptance. That's understanding the consequences of choosing to leave a risk uncontrolled and then formally accepting the risk that remains without an attempt at control. 
5. And the final is termination. And that's removing or discontinuing the information asset from the organization's operating environment all together. 

Risk management is an essential process for every organization. There are many formalized models for risk management in the marketplace, and many organizations are using consulting resources to assist them in finding the optimum means to reduce operational risk.

CyberSecurity: Risk Management - The Risk Identification Process

At its heart, information security is all about managing risk.

What is risk? 
Risk is the probability of a loss. It's the chance of something adverse happening to our interests.

Risk Management?
Risk management is understanding how bad the loss from an adverse event can be, and how we can get the risk down to a level we can absorb. A loss is an event that can negatively affect our information assets, such as  

• unauthorized/unwanted access,  
• destruction, 
• modification,  
• theft or  
• denial of access. 

Risk management involves a preparation and planning phase followed by a risk identification phase, a risk assessment phase, a risk appetite determination phase, and then a risk control phase.

• Risk identification is where we seek to determine if risk exists from known vulnerabilities as well as threats that we can identify that may attempt to exploit those vulnerabilities or find new ways to cause us loss. 
• Risk assessment is the determination of the extent to which our assets are at risk. 
• In determining our risk appetite, we determine and document how much risk we can tolerate? 
• Risk control is where we plan additional appropriate controls to reduce excessive risk to that defined acceptable level. 

Risk management also means that we continue to monitor our risk environment until we need to begin the process again.



Risk identification is the first phase of the process, the first step in risk identification involves identifying, classifying, and prioritizing our assets. Information assets are found across the organization not just in data basis or on service. Information exists in filling cabinets, on personal computers and numerous other locations. Once identified, assets must be evaluated and place in the classes or categories to determine who cannot access to it. Many approaches to classifying data exist. One common approach is signs asset as one of public, official use only, or confidential. After classification, assets must be assess for a value it has to the organization. Using this information, we'll be able to determine each assets needed level of protection.

When assessing the value of an information asset, there are a number of questions we could use.
Like: Which information asset...

• is the most critical to the success of the organization?
• generates the most revenue?
• generates the highest profitability?
• is the most expensive to replace?
• is the most expensive to protect?
• loss or compromise would be the most embarrassing or cause the greatest liability? 

Placing an exact dollar value on most assets is very difficult. However, we can place relative values to help us prioritize them. One method uses a weighted factor table to assess and compare the worth of our assets.



This is done by first listing the criteria we care about and then assessing each asset using those criteria. This allows the creation of a weighted score. Which helps us to compare the value of dissimilar assets within our organization. The second step in risk identification is to identify and prioritize the threats to our information assets. We can identify threats by looking for studies and surveys published in trade and academic journals. This study published by the communications of the ACM, identified 12 categories of threats to information security.



Other such lists have been published as well. Just as we assessed our assets, we must assess the threats facing them. The questions shown here could be used as criteria in a weighted table to prioritize threats.



Threat Assessment questions: Which Threat:

• Present danger to this organization's information assets in its current environment?
• represent the gravest danger to the organization's information assets?
• have the highest probability of success?
• could result in the greatest loss if successful?
• is the organization least prepared to handle?
• cost the most to protect against?
• cost the most to recover from?

Summary:
There are four ways of managing risk

1. avoiding the risk – avoidance would mean stopping the activity that is causing the risk. For example, deleting all banking information and unsubscribing from internet banking would avoid the risks associated with the information assets related to banking.
2. modifying the risk (likelihood and/or impact) – this involves choosing and implementing a security mechanism that reduces the likelihood of a successful attack, or the impact that would result from such an attack. For example, installing an up to date antivirus application can prevent the attacker from using malware to gain access to the computer holding the internet banking information.
3. transferring the risk to others – typically involves taking out insurance to cover any losses in the event the threat materialises.
4. accepting the risk – would mean choosing not to implement any of these countermeasures, choosing instead to monitor the information asset for any attacks.

Cyber Security: Information as an asset

Information as an asset



You’ll remember from Week 1 that, when thinking about computer security, it helps to think of information as an asset. Just like money in the bank, it is valuable, possibly irreplaceable, and crucially it can be lost or stolen.

When we think about our assets, traditionally we consider tangible things such as money, property, machinery and so on. Increasingly, it is recognised that information itself is an asset, crucial to adding value. In today’s digital world, it is increasingly apparent that information is the most important asset, for both businesses or individuals – just think of the value of music to a media company or a games program to a video game company.


   
Considering information as an asset allows us to create strategies for protecting information and minimising the consequences of any disaster.

Case study: San Francisco Medical Center
In October 2002, the University of California, San Francisco Medical Center received an email message from someone who claimed to be a doctor working in Pakistan and who threatened to release patient records onto the internet unless the money owed to her was paid. Several confidential medical transcripts were attached to the email.

UCSF staff were mystified, they had no dealings in Pakistan and certainly did not employ the person who sent the email. The Medical Center began an immediate investigation, concentrating on their transcription service, which had been outsourced to Transcription Stat, based in nearby Sausalito. It transpired that Transcription Stat farmed out work to 15 sub-contractors scattered across America. One of these sub-contractors was Florida-based Sonya Newburn, who in turn employed further sub-contractors, including Tom Spires of Texas. No one at Transcription Stat realised that Spires also employed his own sub-contractors, including the sender of the email. The sender alleged that Spires owed her money, and had not paid her for some time.

 

Newburn eventually agreed to pay the $500 that the email sender claimed was owed to her. In return the sender informed UCSF that she had had no intention of publicising personal information and had destroyed any records in her care. Of course, there is no way to prove that the records have actually been destroyed.

Naturally, you would not wish your own medical records to be publicised: they should be secure. This threat cost the organisation little in monetary terms, but how much in reputation? Just what is a reputation worth? Or, to put it another way, how much should you invest in information security to protect a reputation?



Information in this context is a very broad term and it applies to large and small organisations as well as to individual users. So a doctor’s surgery’s information assets would include things such as personal medical records, telephone contact lists, its emails as well as personal information about its employees. A manufacturing company will have electronic records of order books, correspondence with suppliers and customers, staff records, bank references and so on.

Risk management
Information security risk management assesses the value of information assets belonging to an individual or an organisation and, if appropriate, protects them on an ongoing basis.

Information is stored, used and transmitted using various media; some information is tangible, paper for example, and it is relatively straightforward to put in place strategies to protect this information – such as locking filing cabinets, or restricting access to archives.

On the other hand, some information is intangible, such as the ideas in employees’ minds, is much harder to protect. Companies might try to secure information by making sure their employees are happy, or by legal means such as having contracts that prevent people leaving and going to work for a rival.



Imperatives and incentives
Information security risk management considers the process in terms of two factors: imperatives or incentives. Imperatives are pressures that force you to act. Incentives are the rewards and opportunities that arise from acting.

The imperatives for information security arise from legislation and regulation. The Computer Misuse Act and the Data Protection Act, are examples of legislative imperatives. Regulatory imperatives include standards such as the Payment Card Industry Data Security Standard (PCI-DSS), which specifies how merchants should secure all card transactions.

The most important incentive is trust. People and organisations are more likely to work with other people and organisations who have secured their information. Establishing this trust requires that the parties involved examine each others’ information security practices to ensure that there are adequate safeguards to protect the information. One way of doing this is to show that the organisation has satisfied the requirements of standards such as PCI-DSS or the ISO27000 family of standards for designing and implementing information security management systems.

   


Risk analysis
We use the term risk in everyday speech, but a whole science has grown up around the identification, analysis and management of risks. You will now look briefly at how to apply some of these ideas to identifying, assessing and reducing risks that affect the security of your information.

Risk can be thought of as the chance of adverse consequences or loss occurring. Generally, risks can be identified and the likelihood of them occurring assessed.

The main technique for a qualitative analysis of risk is to construct a likelihood–impact matrix in which the likelihood and impact of each risk event are assessed against a defined scale and then plotted on a two-dimensional grid. The position on the grid represents the relative significance of each risk. The simplest matrix is formed by classifying both likelihood and impact as either high or low, which leads to a 2 by 2 grid. This basic classification of a high or low value leads to the following rank order for tackling risks:

• high-impact, high-likelihood risks
• high-impact, low-likelihood risks
• low-impact, high-likelihood risks.

 

Risk analysis in practice

Let’s think about a practical example of how qualitative risk analysis could be done for Lewis’s information assets.

Any successful attack on email, banking details and password information will have high impact and there is a high likelihood that these attacks will be targeted due to their high value. So they should go in the high-high box.

An attack that affects the study materials or digital photographs will have high impact, but there is a low likelihood given that these assets have minimal financial value to an attacker. These should be placed in the high-low box.

An attack on the digital music or videos will have low impact, since these can be downloaded again easily. However, this will have high likelihood because these assets can be easily copied and sold, this making these attractive to an attacker. Therefore, they go in the low-high box.

Conducting a risk analysis is an important part of protecting your information assets. Following Lewis’s example consider your own list of information assets and carry out a similar risk analysis to determine the impact and likelihood of attack for each type of information.

© The Open University

 

Cyber Security: Information Security - Risk management in practice

Risk management in practice
Having analysed the situation, the next stage is to decide what to do about the risks.
For each risk to be managed, we need to identify what cost-effective countermeasures can be applied. Possible countermeasures are:

• avoiding the risk – avoidance would mean stopping the activity that is causing the risk. For example, deleting all banking information and unsubscribing from internet banking would avoid the risks associated with the information assets related to banking.
• modifying the risk (likelihood and/or impact) – this involves choosing and implementing a security mechanism that reduces the likelihood of a successful attack, or the impact that would result from such an attack. For example, installing an up to date antivirus application can prevent the attacker from using malware to gain access to the computer holding the internet banking information.
• transferring the risk to others – typically involves taking out insurance to cover any losses in the event the threat materialises.
• accepting the risk – would mean choosing not to implement any of these countermeasures, choosing instead to monitor the information asset for any attacks.

 

Protecting your information assets
Now you’ve done a risk analysis, it’s time to look at how we can better protect our information assets.

You’ve already thought about backing up data and using encryption to protect information – but have you put any of these measures into practice? 

What steps have you taken to protect them? For example:

• Have you set up firewalls to protect your networked computers from external attack?
• Are you protected by up to date antivirus software?
• Are your operating system and key applications up to date?
• Is important information protected by encryption?