Computers & Security, 12 (1993) 597-603
A comparative
framework for risk
analysis methods
J.H.P. Eloff, L. Labuschagne
K.P. Badenhorst
The past dccadc has shown the importance
of information
sccuri ty, with special emphasis
on network
security. disaster
A number
of automated
recovery
and risk n~anagcnumt.
approaches
for the facilitation
of a risk analysis study have
appeared on the software market. Organizations
today fact the
difficult
task not only of cxccuting
a risk analysis study, but
also of xlecting
a method that will best suit their requircmcnts.
and
network security, disaster recovery planning and
risk analysis. These research areas have been idcntificd by the industry itself on the basis of its needs.
Risk analysis in particular has attracted major
interest. This can be attributed to the fact that risk
analysis is very often used as the point of departure
A number
of methods
arc available today, utilizing different
for an information
security programme.
Risk
terminology
for similar
concepts.
Risk analysis,
the most
analysis
is
an
important
component
in
the
commonly
used term in this field, is mostly used to identify
compilation of an information security policy for
objects
for prorcction.
“Risk tnanagcnxnt”
might
also bc
included as part of risk analysis, dcpcnding
on the functionality
an organization. Furthermore, risk analysis should
of the method used. Autornatcd
risk zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
analysis methods need to
address all aspects of information
security. The
bc viewed not only from the internal operation
of the method
following is a general definition of information
but also from a tcrminological
point of view.
security [4].
The objcctivc of this paper is to suggest a framework
for risk
nlanagcmc‘nt
terminology.
The application
of the framework
will bc demonstrated
through
a high level discussion
of the
CRAMM, LAVA and MELISA risk analysis methods.
Information
security can bc divided into two
distinct areas. Firstly, thcrc is a technological component addressing all logical aspects (for example
logical access control) and all physical aspects, i.e.
Kfywordz: Information
security, liisk analysis, Risk asscssmcnt,
those types of activity that incur physical damage
l<isk management,
Automated
risk analysis approaches,
I<isk
monitoring.
to computer equipment. Secondly, information
security should include a so-called applications
component. All aspects surrounding the devclop1. Introduction zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
ment of an application system, for example softnformation security appears on the list of critical
ware dcvclopment mcthodologics, logical program
zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
success
factors of most major organizations
controls,
audit monitoring
and the like, are
included in the applications information security
today. It has become apparent, from discussions at
international
conferences
[l-3]
on information
division. This definition defines the scope of risk
security, that the main areas of interest today arc
analysis in the information technology discipline
I
0167-4048/93/$6.00
0 1993, Elsevier Science Publishers Ltd.
J.H.P. Eloff et al.lFramework
and is an attempt to cover information
comprchcnsivcly as possible.
for risk analysis methods zyxwvutsrqponmlkjihgfedcbaZYXWVUT
security as
The role of information security risk analysis is
summarized by the authors as follows:
l Risk analysis is a prerequisite not only for the
compilation of an information security policy but
also for the step-by-step refinement of a policy to
define a protection plan for implementation.
l The managcmcnt of business risk is usually considered a success factor by senior managcmcnt.
Risk analysis can thus be used as a mechanism for
getting senior management involved in information risk managcmcnt.
l The main deliverable of a risk analysis study is
the identification of countermeasures for threats
identified.
l Risk
bc considered are risk identification, risk analysis,
risk assessment, risk resolution and risk monitoring.
The main purpose of this paper is to define a
framework for the assessment of risk analysis
methods. The effectiveness of the framework will
be demonstrated by a discussion of three commcrcially available risk analysis methods, namely
CRAMM, LAVA and MELISA. The remainder of
this paper is organized as follows:
(1) A framework
for risk management
terminol-
ogy.
(2) An example of applying the proposed framework for comparison of the above three risk
analysis methods.
2. A framework
terminology
for risk management
analysis can add significant professional
information needed for the cxccution of a cost vs.
benefit
exercise for the information
security
programmc. Undertaking
and executing a risk
analysis study within an organization remains a
difficult task. Vendors in the software market
idcntificd this problem and saw the potential for
“ off the shelf” risk analysis methods. A number of
automated risk analysis methods appeared on the
market, including CRAMM
[5, 61, LAVA [7],
MARION
[8], MELISA [9], RiskPAC [lo] and
COBRA
[I 11. Organizations
undertaking a risk
analysis study can benefit from the automated
methods mentioned. However, organizations will
bc confronted by the following problems:
technology
Risk analysis for an information
environment, as an aid to the information security
is only in its infancy. Litcraturc
programmc,
studied by the authors indicated the USCof inconsistent terminology. These differences in terminology gave rise to the need for a standard set of
terms to be used mainly for the comparison of various risk analysis methods. The term risk managemcnt will bc used throughout and should not bc
confused with risk analysis, risk asscssmcnt, and the
like. Figure 1 summarizes the risk management
terminology framework as proposed in this paper.
(I) Inconsistent terminology used by the various
methods may be confusing.
Risk analysis, a
common term in this field, is sometimes used to
indicate the identification
of objects requiring
protection. However, some of the methods will also
USCthe term “ risk analysis” to include certain risk
managcmcnt activities such as the determination of
cost-cffectivc countcrmcasurcs.
Domain of
IT Risk
Management
(2) The functionality of the methods differs significantly. The five main functional components to
598
Computers & Security, Vol. 12, No. 6 zyxwvutsrqpon
Most of the terms used in Fig. 1 arc self-cxplanatory. A tree structure is used to demonstrate the
integration of concepts. Each of the three IT risk
technology
management
fields, i.e. information
completeness, information
security completeness
and risk approach completeness, is discussed briefly
below.
2.1. Information technology
completeness
Information
technology is a rapidly developing
field which could very well outstrip availability and
development of effective countermeasures.
Any
approach to risk management should, in a comprchensive and dynamic way, address the totality of
the information technology field as far as possible.
The risk analysis packages currently
available
should bc reviewed to identify the information
components,
such
as networks,
technology
cnvironmcnt
and documentation,
in the set of
countcrmeasurcs
provided. Current information
technology trends, such as integrated networks,
open systems and distributed processing, should
also be catered for.
2.2.
information
security
completeness
Risks regarding technological information security,
as already defined, include all aspects that have an
impact, such as disclosure, modification, unavailability and destruction [5]. Information security also
involves the provision of safeguarding mechanisms
for application systems, both from a security (e.g.
access control) and an integrity (e.g. contents of
data) point of view.
2.3.
Risk approach
completeness
The sub-domain of risk approach completeness
includes, at a high level, aspects such as risk identification, risk analysis, risk assessment, risk resolution and risk monitoring. The diagram, as shown in
Fig. I, is expanded in Fig 2, to show finer distinctions.
A brief definition of each of the more important
concepts follows. zyxwvutsrqponmlkjihgfedcbaZYXWVUTSR
Risk identification. Risk identification
is the
process of compiling an abstract model of an actual
Risk
Identification
_
......
Risk
0MStiOnnal~
Delphi
Asses.smt
zyxwvutsrqponmlkjihgfedcbaZYXWVU
Ela la ndng
Do m a in o f
E’
......
IT Risk
Ma na g e m e nt
f
Risk
Risk
_
-
_
Fig. 2. IT risk management
terminology
framcwork
cosuSanent Apprwch
lnfomwdionSaxfly Standards
Da&ion Analysis
ResdUtlRion
Approaa
Completeness
Risk
Monitoring
zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONML
What-If
E
Salandng
c
Auditing
Perfolmanca Measuring
zyxwvutsrqponmlkjihgfedcbaZY
subdomain.
599
J.H.P. Eloff et aIMFramework for risk analysis methods
information
technology environment
to be invcstigatcd, thus to define clear boundaries.
Such an
cnvironmcnt
refers to one or mom information
systems, including
both open interconnecting
and
closed independent
systems. Assets and/or liabilities arc identified,
as well as threats and vulncrabilities. zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
Target
Secure
Environment
Risk analysis. The main objective
here is to
calculate
the impact
on specific computerized
systems and the consequent
impact on the institution, should a disruption
or undesired event occur
[Iz]. Risk analysis
utilizes
various
techniques.
Thcsc could bc catcgorizcd as quantitative,
qualitativc or a combination
of quantitative
and qualitaFig. 3. The risk nxma~ctncnt
life-cycle.
tive techniques.
Detailed
information
on the
majority of these tcchniqucs
can be found in the
US Govcrnmcnt’s
Defense zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
Systems Management
Risk management
is a continuous
cyclic process,
College Handbook [ 131.
usually initiated in the risk identification
stage. The
risk resolution
and risk monitoring
components
Risk assessment. Individual
risk factors dctcrcomplete the iterative process of information
risk
mined during risk analysis are consolidated,
so as to
management.
The
ultimate
objective
of this
calculate a risk mcasuremcnt
for each information
iteration
is a so-called
target sccurc computing
technology area, i.e. the grouping of all risks related
environment
[ 141.
to “cnvironmcnt”.
The presentation
of thcsc results
The purpose of this section has been, firstly, to
is of utmost importance
to finally facilitate risk
show the terminology
framework and, secondly, to
resolution decision-making.
discuss a few of the concepts within the field of
information
technology
risk managcmcnt.
The
Risk resolution. The objective of risk resolution
is to minimize
the frequency
of realization
of a
following section attempts to apply this in a comparativc framework.
threat and the extent of the consequence
of the
threat, i.e. potential loss [ 121. This is facilitated by
implcmcnting
cost-cffcctivc
counternieasurcs
3. An example of applying
the proposed
within
each information
technology
area, as
framework
refcrrcd to in Fig. 1. The decision support system
used during the risk resolution process should conThe risk analysis methods which will be discussed
sider not only the costs and effectiveness
of
are as follows.
countcrmcasurcs,
but also international
standards.
3.1.
Risk monitoring. An ongoing
risk monitoring
function should be considered of great importance
Such an action cnsurcs not only the cffcctivc and
timely
implementation
of countcrmcasurcs
but
also the appropriatcncss
and operation thereof.
The interaction
Fig. 3 [I”].
600
of these five concepts
is shown
in
CRAMM
The CCTA risk analysis and mana cmcnt mcthodology (CRAMPA) is a structure a and consistent
method
for identifying
and justifying
protective
measures to ensure the security of all IT systems
used to process unclassified
but sensitive information. CRAMM
was developed
by the British
government
for internal
use but was later made
commercially
available [5].
Computers & Security, Vol. 12, No. 6
large, complex systems that are generally too large
3.2. LAVA zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
for other risk analysis methods [7].
LAVA stands for the Los Alamos Vulnerability/
Risk Assessment system and is a risk methodology
3.3. Melisa
developed by the Los Alamos National Laboratory.
Mclisa is a methodolo ical package designed and
It is a systematic methodology for assessing vulncrdeveloped since 1984 Bor the Dclcgation Gcncralc
abilities and risks in complex
safeguard and
pour 1’Armcmcnt. It has been adapted to commcrsecurity systems. LAVA was developed to address
C LM
x x
:: x x
x x x
x x x
x x
::
x xx xx
x x x
X
z
X
z
::
X
X
x
x
x
x
x
x
x
x
X
X
X
x
x
X
x
x
x
2
x
x
x
x
x
x
x
x
x
x
x
x
x
::
:
x
::
x
1
x
:
x
X
x
x
1
::
X
c-CRAMM
L-LAVA
M-MHJSA
X - CONCEPT ADDRESSED
?-NOTSURE
I
601
J.H.P. Eloff et al.lFramework
for risk analysis methods
cial environments.
During the creation of an information
security plan, Melisa takes into account
various assessment
phases, including
analysis of
existing
conditions
and assistance
in selecting
countermeasures
[9].
[2] Proceedings: International
tions and Applications
16- 19 March
W orkshop on A dvanced Communicafor
Hi@
Speed Networks,
Munich,
1992.
[3] Proceedings of-the 8th W orld Conference on Computer Security,
Audit
and Control,
Elsevier
Advanced
Technology,
London, 199 1.
[4] K.P. Badenhorst
and J.H.P. Eloff,
Framework
of a
methodology
for the lift cycle of computer
security in an
It should be noted that this paper is by no means
organization,
Computers fi Security, 8 (1989) 433-442.
comprehensive
and should only bc seen as a first[5] CCTA, A Guide to CRAMMfor
M anaxemmt, Information
level discussion. Most of the vendors for the aboveTechnology
Security, UK CCTAJ 0079, London, 1YS8.
mentioned
methods
provide
a demonstration
[6] BIS, CRAMM
Computer Risk Mana,yer in Action, BIS
Applied Systems, UK CCTAJ 0079, London, 1989.
diskette.
The authors
either
worked
with or
[7] S.T. Smith, LAVAfbr
Computer Security: An Application oj
attended detailed demonstrations
of each method
the Los Alamos Vulnerability Assessment M ethodology, Release
mentioned.
The methods arc summarized
in Fig. 4.
Version
1.01, Los Aamos
National
Laboratory,
New
Mexico, 1987.
[8] Coopers and Lybrand, Marion-Infrmation
System Security
4. Conclusion
Assessment Reference Manual, Coopers,
Theron
and Du
Toit, Johannesburg,
1988.
Risk management
forms an integral
part of an
[9] XP Conscil, ?‘11eMarion and M e&a M ethods, Paris, 1990.
information
security
programme.
overall
[ 101 Computer
Security
Consultants
Inc., RiskPAC
User’ s
Deliverables of the methods discussed in this paper,
Guide-Risk
Assessment Software Version 2.0, BCM
Inc,
together with others, could bc major milestones
Johannesburg,
1990.
[ 1 l] COBRA, User Guide, C&A System Security Ltd, Cheshire,
in not only the initiation
but also the managclYYO/lYYl.
ment
of an information
security
programmc.
[l2] S.B. Guarro,
Principles
and procedures
of the ALRAM
Predetermined
goals
should
decide
which
approach
to information
system
risk analysis
and
components
of the risk management
process arc
management,
Computers &Security, 6 (1987) 493-504.
applicable.
If the goal is to identify the value of
[ 131 US Government,
Defense System M anagement
Co//exe
(DSMC) Handbook, Washington,
DC, lY83, Chapter 4 &
information
technology
assets, only
the risk
Appendix F.
identification
component
is applied.
This also
1141 K.P. Badenhorst
and J.H.P.
Eloff,
lnformation
risk
depends
on the specific
environment
to be
assessment,
risk analysis and risk management:
the RI<
investigated,
its type and size, and the time
research
model,
ProcerdinXs of Compsec
International,
constraints. The framework
as proposed will assist
Elsevier Science Publishers Ltd. Oxford, 1YY1.
[l 51 K.P. Badenhorst
and J.H.P. Eloff, Computer
security
in the acquisition
of an appropriate
automated
risk
methodology:
risk
analysis
and
project
definition,
analysis method.
Comptrters &Security, 9 (1 YYO)339-346.
[ 161 ItH. Courtney, Jr., A systematic approach to data security,
Computers &Security, 1 (1982) 09-l 12.
References
[17] D.D. Clark (Chairman),
Computers at Risk-Safe
Computing
in the Information Age, National
Research Council, System
[I] Anon, Computer security and information
integrity
in
Security
Study Committee,
National
Academy
Press,
our changing
world, zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA
Proceedings of IFIlYSEC, 23-25 May
Washington,
DC, 1988.
1990.
602