Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Security Risk Management Jamie Sharp CISSP Security Advisor Microsoft Australia Session Overview • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Agenda • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Why Develop a Security Risk Management Process? • Security risk management – A process for identifying, prioritizing and managing risk to an acceptable level within the organization • A formal security risk management process can address the following: – Threat response time – Regulatory compliance – Infrastructure management costs – Risk prioritization and management Critical Success Factors • • • • • • Executive sponsorship Well defined list of stakeholders Organizational maturity Open communication and teamwork Holistic view of the organization Security risk management team authority Risk Management Strategies • Reactive – A process that responds to security events as they occur • Proactive – A process that reduces the risk of new vulnerabilities in your organization Risk Assessment Methodologies Benefits • • Quantitative • • Qualitative • • • Drawbacks Risks prioritized by financial • Impact values assigned to impact; assets prioritized by risks are based upon their financial values subjective opinions of the Results facilitate management participants of risk by return on security • Very time-consuming investment • Can be extremely costly Results can be expressed in management-specific terminology Enables visibility and understanding of risk ranking Easier to reach consensus Not necessary to quantify threat frequency Not necessary to determine financial values of assets • Insufficient granularity between important risks • Difficult to justify investing in control as there is no basis for a cost-benefit analysis • Results dependent upon the quality of the risk management team that is created Microsoft Security Risk Management Process 4 3 Measuring Program Effectiveness 1 Assessing Risk Implementing Controls 2 Conducting Decision Support Agenda • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Risk Management vs. Risk Assessment Risk Management Goal Cycle Schedule Alignment • Manage risks across business to acceptable level • Overall program across all four phases • Scheduled activity • Aligned with budgeting cycles Risk Assessment • Identify and prioritize risks • Single phase of risk management program • Continuous activity • Not applicable Communicating Risk Asset Threat Vulnerability Mitigation What are you trying to protect? What are you afraid of happening? How could the threat occur? What is currently reducing the risk? Impact What is the impact to the business? Probability How likely is the threat given the controls? Well-Formed Risk Statement (Exposure) Starting Points • NIST http://www.nist.gov – Security Self-Assessment Guide for Information Technology Systems (SP-800-26) • IT Governance Institute http://www.isaca.org – Control Objectives for Information and Related Technology (CobiT) • ISO http://www.iso.org – ISO 17799 - ISO Code of Practice for Information Security Management • SAI Global http://www.standards.com.au – AS/NZS 4360:2004 - Risk Management – AS/NZS 7799.2:2003 - Information Security Management • Microsoft Security Risk Management Guide – http://www.microsoft.com/technet/security/guidance/secrisk Risk Management Maturity SelfAssessment Level 0 1 State Non-existent 2 Repeatable 3 Defined process 4 Managed 5 Optimized Ad hoc Roles and Responsibilities Executive Sponsor “What's important?” Information Security Group “Prioritize risks” IT Group “Best control solution” Determine acceptable risk Assess risks Define security requirements Measure security solutions Design and build security solutions Operate and support security solutions Agenda • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Overview of the Assessing Risk Phase 4 Measuring Program Effectiveness 1 Assessing Risk • Plan risk data gathering • Gather risk data • Prioritize risks 3 Implementing Controls 2 Conducting Decision Support Understanding the Planning Step • The primary tasks in the planning step include the following: – Alignment – Scoping – Stakeholder acceptance – Setting expectations Facilitated Data Gathering • Elements collected during facilitated data gathering include: – – – – – Organizational assets Asset description Security threats Vulnerabilities Current control environment – Proposed controls • Keys to successful data gathering include: – Meet collaboratively with stakeholders – Build support – Understand the difference between discussing and interrogating – Build goodwill – Be prepared Identifying and Classifying Assets • An asset is anything of value to the organization and can be classified as one of the following: – High business impact – Moderate business impact – Low business impact Organizing Risk Information • Use the following questions as an agenda during the facilitated discussions: – – – – – – What asset are you protecting? How valuable is the asset to the organization? What are you trying to avoid happening to the asset? How might loss or exposures occur? What is the extent of potential exposure to the asset? What are you doing today to reduce the probability of the extent of damage to the asset? – What are some actions that you can take to reduce the probability in the future? Estimating Asset Exposure • Exposure: The extent of potential damage to an asset • Use the following guidelines to estimate asset exposure: – High exposure: severe or complete loss of the asset – Medium exposure: limited or moderate loss – Low exposure: minor or no loss Estimating Threat Probability • Use the following guidelines to estimate probability for each threat and vulnerability identified: – High threat: Likely—one or more impacts expected within one year – Medium threat: Probable—impact expected within two to three years – Low threat: Not probable—impact not expected to occur within three years Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task One: Determining Organizational Assets and Scenarios • • • • Interest Calculation Systems Customer Personally Identifiable Information (PII) Reputation Consumer financial data—High Business Impact (HBI) Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Two: Identifying Threats • Threat of a loss of integrity to consumer financial data Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Three: Identifying Vulnerabilities • Theft of financial advisor credentials by trusted employee abuse using non-technical attacks, for example, social engineering or eavesdropping • Theft of financial advisor credentials off local area network (LAN) hosts through the use of outdated security configurations • Theft of financial advisor credentials off remote, or mobile, hosts as a result of outdated security configurations Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Four: Estimating Asset Exposure • Breach of integrity through trusted employee abuse: – Damaging, but not severe. Each financial advisor can only access customer data that he/she manages. • Breach of integrity through credential theft on LAN hosts: – May result in a severe, or high, level of damage. • Breach of integrity through credential theft on mobile hosts: – Could have a severe, or high, level of damage. The discussion group notes that the security configurations on remote hosts often lag behind LAN systems. Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Five: Identifying Existing Controls and Probability of Exploit • Agreement that their remote hosts, or mobile hosts, do not receive the same level of management as those on the LAN. Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Six: Summarizing the Risk Discussion • Risk Assessment Facilitator summarizes the discussion and highlights the assets, threats, and vulnerabilities discussed. Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank • Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – – – – – Task One: Determining Organizational Assets and Threats Task Two: Identifying Threats Task Three: Identifying Vulnerabilities Task Four: Identifying Asset Exposure Task Five: Identifying Existing Controls and Probability of Exploit – Task Six: Summarizing the Risk Discussion Defining Impact Statements • Impact data includes the following information: Scenario 2: Defining an Impact Statement For Woodgrove Bank Asset Name Consumer financial investment data Consumer financial investment data Consumer financial investment data Asset Class HBI HBI HBI DID Level Threat Description Vulnerability Description Host Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials of managed LAN client via outdated security configurations H H Host Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials off managed remote client via outdated security configurations H H Data Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials by trusted employee abuse, via non-technical attacks L M ER IR (H,M,L) (H,M,L) Understanding Risk Prioritization Start risk prioritization Conduct summarylevel risk prioritization Summary level risk prioritization Review with stakeholders Conduct detailedlevel risk prioritization Detailed level risk prioritization End of risk prioritization Conducting Summary-Level Risk Prioritization 1 2 • High. Likely—one or more impacts expected within one year Medium. Probable—impact expected within two to three years Low. Not probable—impact not expected to occur within three years 4 The summary-level prioritization includes the following: 1. 2. 3. 4. Determine impact level Estimate summary-level probability Complete the summary-level risk list Review with stakeholders 3 Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank • Task One: Determine Impact Level – Trusted Employee Theft Impact • HBI asset class *Low Exposure = Moderate Impact – LAN Host Compromise Impact • HBI asset class *High Exposure = High Impact – Remote Host Compromise Impact • HBI asset class *High Exposure = High Impact Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank • Task Two: Estimate Summary-Level Probability – Trusted Employee Theft Probability • Low – LAN Host Compromise Probability • Medium – Remote Host Compromise Probability • High Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank • Task Three: Complete the Summary-Level Risk List – Trusted Employee Theft Risk • Moderate Impact *Low Probability = Low – LAN Host Compromise Risk • High Impact *Medium Probability = High – Remote Host Compromise Risk • High Impact *High Probability = High – Enter Results in the Impact Statement Spreadsheet Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank • Task Four: Review With Stakeholders – Trusted Employee abuse risk is rated as Low in the summary level risk list and does not need to graduate to the detailed level risk prioritization step – LAN and remote host compromise risks are both rated as high and so are then prioritized at the detailed level Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank • • • • Task One: Determine Impact Level Task Two: Estimate Summary Level Probability Task Three: Complete the Summary-Level Risk List Task Four: Review With Stakeholders Conducting Detailed-Level Risk Prioritization • The following four tasks outline the process for building a detailed-level list of risks: 1. 2. 3. 4. • Determine impact and exposure Identify current controls Determine probability of impact Determine detailed risk level Use the Detailed-Level Risk Prioritization template (SRJA3-Detailed Level Risk Prioritization.xls) Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank • Task One: Determine Impact and Exposure – LAN Host Compromise Exposure Rating: 4 (80%) • HBI = 10 • Impact Rating: 10 *80% = 8 – Remote Host Compromise Exposure Rating: 4 (80%) • HBI = 10 • Impact Rating: 10 *80% = 8 – Impact Range = Between 7-10 which compares to High Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank • Task Two: Identify Current Controls – Financial Advisors can only access accounts they own; thus, the exposure is less than 100 percent. – E-mail notices to patch or update hosts are proactively sent to all users. – Antivirus and patch updates are measured and enforced on the LAN every few hours. This control reduces the time window when LAN hosts are vulnerable to attack. Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank • Task Three: Determine Probability of Impact – LAN and remote hosts: Likely that all vulnerability attributes in the High category will be seen inside and outside Woodgrove’s LAN environment in the near future. Vulnerability value = 5 for both risks – Control Effectiveness: • LAN: Result of Control Effectiveness Questions = 1 • Remote: Result of Control Effectiveness Questions = 5 – Total Probability Rating: (Sum of Vulnerability and Control Effectiveness) • LAN = 6 • Remote = 10 Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank • Task Four: Determine Detail Risk Level – Impact Rating *Probability Rating • LAN: 8 *6 = 48 • Remote Hosts: 8 *10 = 80 • Both rate an overall risk of High Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank • • • • Task One: Determine Impact and Exposure Task Two: Identify Current Controls Task Three: Determine Probability of Impact Task Four: Determine Detail Risk Level Quantifying Risk • The following tasks outline the process for determining the quantitative value: – Assign a monetary value to each asset class – Input the asset value for each risk – Produce the single-loss expectancy value (SLE) – Determine the annual rate of occurrence (ARO) – Determine the annual loss expectancy (ALE) Scenario Five: Quantifying Risk For Woodgrove Bank • Task One: Assign Monetary Values to Asset Classes – – – – – Using 5% Materiality Guideline for valuing assets Net Income: $200 Million annually HBI Asset Class: $10 Million (200 *5%) MBI Asset Class: $5 Million (based on past spending) LBI Asset Class: $1 Million (based on past spending) Scenario Five: Quantifying Risk For Woodgrove Bank • Task Two: Identify the Asset Value – Consumer financial data = HBI Asset Class – HBI = $10 Million – Asset Value = $10 Million Scenario Five: Quantifying Risk For Woodgrove Bank • Task Three: Produce the Single Loss Expectancy Value (SLE) Risk Description Asset Class Value Exposure Rating Exposure Value SLE $10 4 80% $8 $10 4 80% $8 LAN Host Risk ($ in millions) Remote Host Risk ($ in millions) High Business Impact Value = $M Asset Class Exposure Rating Exposure Factor % 5 100 4 80 HBI Value $M 3 60 MBI Value $M/2 2 40 LBI Value $M/4 1 20 Scenario Five: Quantifying Risk For Woodgrove Bank • Task Four: Determine the Annual Rate of Occurrence (ARO) – LAN Host ARO: Based on the qualitative assessment of Medium probability, the Security Risk Management Team estimates the risk to occur at least once in two years; thus, the estimated ARO is 5. – Remote Host ARO: Based on the qualitative assessment of High probability, the Security Risk Management Team estimates the risk to occur at least once per year; thus, the estimated ARO is 1. Qualitative Rating Description ARO range Description Examples High Likely >=1 Medium Probable .99 to .33 Low Not probable .33 Impact once or more per year At least once every 1-3 years At least once greater than 3 years Scenario Five: Quantifying Risk For Woodgrove Bank • Task Five: Determine the Annual Loss Expectancy (ALE) (SLE *ARO) Risk Description Asset Class Value Exposure Rating Exposure Value SLE ARO ALE LAN Host Risk ($ in millions) $10 4 80% $8 0.5 $4 Remote Host Risk ($ in millions) $10 4 80% $8 1 $8 Scenario Five: Quantifying Risk For Woodgrove Bank • Task One: Assign Monetary Values to Asset Classes • Task Two: Identify the Asset Value • Task Three: Produce the Single Loss Expectancy Value (SLE) • Task Four: Determine the Annual Rate of Occurrence (ARO) • Task Five: Determine the Annual Loss Expectancy (ALE) (SLE *ARO) Assessing Risk: Best Practices • Analyze risks during the data gathering process • Conduct research to build credibility for estimating probability • Communicate risk in business terms • Reconcile new risks with previous risks Agenda • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Overview of the Decision Support Phase 4 3 Measuring Program Effectiveness Implementing Controls 1 Assessing Risk 1. Define functional requirements 2. Identify control solutions 3. Review solution against requirements Conducting 4. Estimate degree of risk reduction Decision 5. Estimate cost of each solution Support 6. Select the risk mitigation strategy 2 Identifying Output for the Decision Support Phase • Key elements to gather include: – Decision on how to handle each risk – Functional requirements – Potential control solutions – Risk reduction of each control solution – Estimated cost of each control solution – List of control solutions to be implemented Considering the Decision Support Options • Options for handling risk: ATAM – Accept – Transfer – Avoid – Mitigate Step 1: Define Functional Requirements Security risk management team 1 Mitigation owner 2 Identify control Define functional requirements solutions Security steering committee 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy Step 2: Identify Control Solutions Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy Step 3: Review Solutions Against Requirements Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy Step 4: Estimate Degree of Risk Reduction Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy Step 5: Estimate Cost of Each Solution Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy Step 6: Select the Risk Mitigation Strategy Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 Estimate degree of risk reduction 5 6 Estimate cost of each solution Select the risk mitigation strategy Conducting Decision Support: Best Practices • • • • Assign a security technologist to each risk Set reasonable expectations Build team consensus Focus on the amount of risk after the mitigation solution Agenda • • • • • Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness Implementing Controls 4 3 Measuring Program Effectiveness Implementing Controls • Seek a holistic approach • Organize by Defensein-Depth 1 Assessing Risk 2 Conducting Decision Support Organizing the Control Solutions • Critical success determinants to organizing control solutions include: – Communication – Team scheduling – Resource requirements Organizing by Defense-in-Depth Physical Network Host Application Data Measuring Program Effectiveness 4 Measuring Program Effectiveness 1 Assessing Risk • Develop scorecard • Measure control effectiveness 3 Implementing Controls 2 Conducting Decision Support Developing a Security Risk Scorecard for Your Organization • A simple security risk scorecard organized by the Defense-in-Depth layers: FY05 Q1 H FY05 Q2 M Application M M M M M H Data L L Physical Network Host FY05 Q3 Risk Levels (H, M, L) FY05 Q4 Measuring Control Effectiveness • Methods for measuring the effectiveness of implemented controls include: – Direct testing – Submitting periodic compliance reports – Evaluating widespread security incidents Summary • • • • • Decide on risk management methodology Determine your maturity level Conduct risk assessment Conduct decision support Implement controls & measure effectiveness Next Steps • Australia Security Portal http://www.microsoft.com/australia/security • Microsoft Security Risk Management Guide http://www.microsoft.com/technet/security/guidance/secrisk • MOF - Security Management http://www.microsoft.com/technet/itsolutions/cits/mo/smf/mofsmsmf.mspx • Additional security tools and content http://www.microsoft.com/security/guidance