risk assessment

security risk

February 6, 2014 by Bruce Brown Leave a Comment

NIST SP 800-39, Manage Information Security Risk

NIST SP 800-39 deals entirely with fixing the challenge of security risk in an organization. Chapter 2 of 800-39 discusses the basics of security risk management & chapter 3 goes into the process of applying security risk management across and organization.

The Fundamentals of Security Risk Management (Chapter 2, 800-39)
The philosophy security risks and how to manage information security at multiple levels of an organization are discussed in Chpt 2 of NIST SP 800-39. The three layers of security risk are:

Tier 1: Organization level
Tier 2: Mission/Business Process level
Tier 3: Information System level

Tier 1: Organization Level security risk management
Tier 1 addresses security risk from the organizations perspective. This include the implementation of the first component of security risk management which is called risk framing.

In tier 1 or security risk management, the management of the organization establishes governance structure that are in compliance with laws, regulations and policies. Tier 1 activities include establishment of the Risk Executive Function, establishment of the risk management strategy and determination of the risk tolerance.

Security Risk framing provides context for all the security risk activities within an organization, which affects the risk tasks of tier 1 & 2. The result of risk framing is Security Risk Management Strategy.

Security Risk Management Tier 2: Mission/Business Process

Tier 2 Security risk management tasks include: 1) defining the mission processes. 2) Prioritize the mission process with respect to the long term goals of the organization. 3) Define the type of information needed to successfully execute the mission/business processes, critical/sensitivity of the information and the information flows both internal and external of the information.

Tier 3: Information System Security Risk management

From the information system perspective, tier 3 addresses the following tasks:

Categorization of the information system
Allocating the organizational security control
Selection, implementation, assessment, authorization, and ongoing

Chapter 3 focuses on the step to have a comprehensive security risk management program. The tasks discussed include:

Risk Framing
Risk Assessing
Risk Response
Risk Monitoring

Risk Assessment

NIST 800-30 goes into Risk Assessment process. 800-39 covers from a high level. Risk assessment is threat & vulnerability identification and risk determination. Organizational risk framing is a prerequisite to risk assessments, because methods of risk assessment must be established by the contexts of the organizations risk.

Risk Response
Risk response identifies, evaluates, decides on, and implements appropriate courses of action to accept, avoid, mitigate, share, or transfer risk to organizational operations and assets, individuals, other organizations, and the Nation, resulting from the operation and use of information systems.

Risk identification is key to risk response. Risk types include:
Risk accept- is the appropriate risk response when the identified risk is within the organizational risk tolerance. Organizations can accept risk deemed to be low, moderate, or high depending on particular situations or conditions.

Risk avoidance– Organizations may conduct certain types of activities or employ certain types of information technologies that result in risk that is unacceptable. In such situations, risk avoidance involves taking specific actions to eliminate the activities or technologies that are the basis for the risk or to revise or reposition these activities or technologies in the organizational mission/business processes to avoid the potential for unacceptable risk.

Risk mitigation-adding management, technical, administrative safeguards to minimize identified risks to the system.
Risk share & transfer- Risk sharing or risk transfer is the appropriate risk response when organizations desire and have the means to shift risk liability and responsibility to other organizations. Risk transfer shifts the entire risk responsibility or liability from one organization to another organization (e.g., using insurance to transfer risk from particular organizations to insurance
companies).

Risk Monitoring Risk changes with each modification of the system. It’s important to monitor the changes of the risk of a system. Changes to threats can also change risk. This is where Continuous monitoring comes in.

risk assessment table

February 5, 2014 by Bruce Brown Leave a Comment

Risk assessment table is usually a 2 dimensional matrix used to measure the likelihood of risk by matching vulnerability, assets, threats and/or impacts of threats to vulnerability of assets.

A risk assessment table can be homemade. Homemade might be best because the no one knows better than they organization the landscape within their information systems infrastructure, the threats associated or the importance of the assets should they get compromised.

risk assessment model

January 23, 2014 by Bruce Brown Leave a Comment

The risk assessment model is decomposed in NIST SP 800-37, Guide for Risk Assessments.

The risk assessment model is designed to identify threat sources and events, identify vulnerabilities and predisposing conditions, determine likelihood of occurrence, determine magnitude of impact and finally determine risk. Some of the devices used to do this are risk register:

Risk Register Template – version a Risk Register Template – version b

The risk assessment model is only one part of the risk management process in DIARMF and other risk management frameworks:

risk register template

January 23, 2014 by Bruce Brown 1 Comment

As risk register is a tool in the form or spread sheet, application or database that you can use during risk assessments for risk identification. It allows the person conducting the risk assessment to log the threat, asset and impact and give some idea of the probability of the threat. It is used in DIARMF, DIACAP, project management and other risk management processes to help decision makers.

Its also known as a risk log.

Here is a risk register template I got from British Colombia gov site http://www.gov.bc.ca/fin/):

Risk Register Template

Here is another risk register template from the Israel Institute of Technology(webcourse.cs.technion.ac.il):

Risk Register Template

what is a risk assessment

January 23, 2014 by Bruce Brown 1 Comment

What is a risk assessment?

To answer this question we must first know what “risk” is.

There are many kinds of risks: financial risks, safety risks, investment risk. But we are talking about Security Risk. In the context of SECURITY, risk is the likelihood that something harmful (a threat) will happen to something of value (an asset). The asset must be vulnerable to the the harmful event.

So a risk is the probability that a threat will exploit the weakness of an asset.

A risk assessment is the process of identifying the actual risk. This done by identifying the threat, the asset, the associated weaknesses and countermeasures and then determining the impact should the threat harm the asset.

Risk identification is done with a risk assessment. NIST SP 800-30, Guide for Conducting Risk Assessments breaks down the entire process of risk determination, risk identification.

As described in the earlier post DIACAP Process:

Risk = ((Vulnerability * Threat) / Countermeasure) * Asset Value at Risk IT Risk

Risk is the likelihood that a threat will compromise the weakness of an asset. So risk identification is based on knowing the threat, the vulnerability and the asset.

Risk assessment report_Example

risk evaluation

January 21, 2014 by Bruce Brown Leave a Comment

A risk evaluation from a system security perspective is known as a risk assessment (or security assessment). The process of the risk evaluation is detailed in NIST SP 800-30, Guide for Risk Assessments and NIST SP 800-39, Risk Management.

Risk evaluation means risk identification. Risk identification has 7 mains steps (two additional steps dedicated to recommendation and documentation):

1) System characterization – a System Security Plan (SSP). Evaluate the Asset information covers the following:

Hardware
Software
System interfaces (e.g., internal and external connectivity)
Data and information
Persons who support and use the IT system
System mission (e.g., the processes performed by the IT system)
System and data critical (e.g., the system’s value or importance to an organization)
System and data sensitivity

2) Threat Evaluation – Evaluate possible threat sources by looking at what negative activities are likely to happen to the system.

3) Vulnerability Evaluation – Look at the vulnerabilities and evaluate the biggest weakness in the systems.

4) Security Control Evaluation – Examine what controls the system already has applied.

5) Likelihood of occurrence evaluation – The probability that your asset will be exploited is based on the threat source motivation, threat capability, your vulnerability and the security controls you have in place. Based on all these factors you can calculated the likelihood of an attack or disaster.

6) Impact Evaluation – This where you gather all the data from asset identification, threat source, vulnerability identification, security controls, likelihood of attack and figure you what would happen if something really did happen. How important is your system and its data? What would happen to the mission or bottom line or profits if the system went down for a few hours? a few days? a few weeks? Some system are so important that they cannot be down for even a minute. Impact is very important to the level of risk. The more important the system is, the high the risk.

7) Risk Determination / Risk Evaluation – Based on all the data gathered you can make a pretty good risk determination. You should have defined the systems components and what data is important, made a pretty good conclusion on threat sources and likelihood of the vulnerability exploits and know exactly what kind of impact there will be if the system goes down.