Risk assessment - TSD
Gard Thomassen, PhD
USIT, UIO
When to think of risks ?
• Before design
• During design
• When redesigning
• Basicly – always
• Who is responsible for the risk evaluation
– The Institution responsible for the data
System
outline
VM-server
HPC - Colossus
Gateway
n
1
Internet
Secure encrypted network
to special high volume
data production sites
1 (project)
1 (storage area)
Storage
Gard Thomassen,TSD 2.0
Doing risk assessment
• Three axis :
– Data confidenciality (only those with access get
access)
– Data integrity (data manipulation, deletion)
– Data accessibility (users get to data when they
want from where they want)
• Level of detail
– As easily read as possible, detailed where needed
to describe neccessary functions
Risk evaluation method
• Define the level of security needed based on data handled
• Based on technical solution and risk brainstorming we
listed all risk elements and evaluated them based on
– probability (1 -> 4)
– consequence (1 -> 4)
• Risks with sum (probability x consequene)
– [1-4) : Accepted or underlaid some extra routine
– [4-8) : Must be taken into account, can exist in a production
environment for a short time and fixes have been planned
– [8-16] : Unacceptable risk. Production stop, or compensated
immideately by manual controls and routines that brings the
level of risk down below 8.
• Risk evaluation details all risks > 3
Typical method would then be
• Brainstorm on all components and possible issues
–
–
–
–
–
–
–
–
–
–
Authentication
Authorization
Network / firewall
Virus / malware
Data import and export
Storage
HPC
Computers
Software / virtual machinges
Data harvesting
Who does risk assessment
• IT-security personell & System developers
• TSD has a “Change Advisory Board”
• Risk evaluation must be done when changes
to the system effect the risk-assessment
• All users must be informed of there is a
change in the risk asessment
When designing (secure) systems
• What are the laws and regulations for all
involved parties
• Who are typical data owner
• Who are the stakeholders
• Where do we get the funding
• Who has the final decision autorithy
Thank you
• Questions ?