Security Risk Management
Jamie Sharp CISSP
Security Advisor
Microsoft Australia
Session Overview
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Agenda
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Why Develop a Security Risk
Management Process?
• Security risk management
– A process for identifying, prioritizing and managing
risk to an acceptable level within the organization
• A formal security risk management process
can address the following:
– Threat response time
– Regulatory compliance
– Infrastructure management costs
– Risk prioritization and management
Critical Success Factors
•
•
•
•
•
•
Executive sponsorship
Well defined list of stakeholders
Organizational maturity
Open communication and teamwork
Holistic view of the organization
Security risk management team authority
Risk Management Strategies
• Reactive
– A process that responds to security events as
they occur
• Proactive
– A process that reduces the risk of new
vulnerabilities in your organization
Risk Assessment Methodologies
Benefits
•
•
Quantitative
•
•
Qualitative
•
•
•
Drawbacks
Risks prioritized by financial
• Impact values assigned to
impact; assets prioritized by
risks are based upon
their financial values
subjective opinions of the
Results facilitate management
participants
of risk by return on security
• Very time-consuming
investment
• Can be extremely costly
Results can be expressed in
management-specific
terminology
Enables visibility and
understanding of risk ranking
Easier to reach consensus
Not necessary to quantify
threat frequency
Not necessary to determine
financial values of assets
• Insufficient granularity
between important risks
• Difficult to justify investing in
control as there is no basis
for a cost-benefit analysis
• Results dependent upon the
quality of the risk
management team that is
created
Microsoft Security Risk
Management Process
4
3
Measuring
Program
Effectiveness
1
Assessing Risk
Implementing
Controls
2
Conducting
Decision
Support
Agenda
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Risk Management vs. Risk
Assessment
Risk Management
Goal
Cycle
Schedule
Alignment
•
Manage risks across
business to acceptable level
•
Overall program across all
four phases
•
Scheduled activity
•
Aligned with budgeting
cycles
Risk Assessment
•
Identify and prioritize
risks
•
Single phase of
risk management
program
•
Continuous
activity
•
Not applicable
Communicating Risk
Asset
Threat
Vulnerability
Mitigation
What are you
trying to
protect?
What are you
afraid of
happening?
How could the
threat occur?
What is
currently
reducing the
risk?
Impact
What is the impact to the
business?
Probability
How likely is the threat
given the controls?
Well-Formed Risk Statement (Exposure)
Starting Points
• NIST http://www.nist.gov
– Security Self-Assessment Guide for Information Technology Systems
(SP-800-26)
• IT Governance Institute http://www.isaca.org
– Control Objectives for Information and Related Technology (CobiT)
• ISO http://www.iso.org
– ISO 17799 - ISO Code of Practice for Information Security Management
• SAI Global http://www.standards.com.au
– AS/NZS 4360:2004 - Risk Management
– AS/NZS 7799.2:2003 - Information Security Management
• Microsoft Security Risk Management Guide
– http://www.microsoft.com/technet/security/guidance/secrisk
Risk Management Maturity SelfAssessment
Level
0
1
State
Non-existent
2
Repeatable
3
Defined process
4
Managed
5
Optimized
Ad hoc
Roles and Responsibilities
Executive
Sponsor
“What's
important?”
Information
Security Group
“Prioritize risks”
IT Group
“Best control solution”
Determine
acceptable risk
Assess risks
Define security
requirements
Measure
security
solutions
Design and
build security
solutions
Operate and
support
security
solutions
Agenda
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Overview of the Assessing Risk
Phase
4
Measuring
Program
Effectiveness
1
Assessing Risk
• Plan risk data
gathering
• Gather risk data
• Prioritize risks
3
Implementing
Controls
2
Conducting
Decision
Support
Understanding the Planning
Step
• The primary tasks in the planning step include
the following:
– Alignment
– Scoping
– Stakeholder acceptance
– Setting expectations
Facilitated Data Gathering
• Elements collected
during facilitated data
gathering include:
–
–
–
–
–
Organizational assets
Asset description
Security threats
Vulnerabilities
Current control
environment
– Proposed controls
• Keys to successful data
gathering include:
– Meet collaboratively with
stakeholders
– Build support
– Understand the
difference between
discussing and
interrogating
– Build goodwill
– Be prepared
Identifying and Classifying
Assets
• An asset is anything of value to the
organization and can be classified as one of
the following:
– High business impact
– Moderate business impact
– Low business impact
Organizing Risk Information
• Use the following questions as an agenda during the
facilitated discussions:
–
–
–
–
–
–
What asset are you protecting?
How valuable is the asset to the organization?
What are you trying to avoid happening to the asset?
How might loss or exposures occur?
What is the extent of potential exposure to the asset?
What are you doing today to reduce the probability of the
extent of damage to the asset?
– What are some actions that you can take to reduce the
probability in the future?
Estimating Asset Exposure
• Exposure: The extent of potential damage to
an asset
• Use the following guidelines to estimate asset
exposure:
– High exposure: severe or complete loss of the
asset
– Medium exposure: limited or moderate loss
– Low exposure: minor or no loss
Estimating Threat Probability
• Use the following guidelines to estimate
probability for each threat and vulnerability
identified:
– High threat: Likely—one or more impacts
expected within one year
– Medium threat: Probable—impact expected within
two to three years
– Low threat: Not probable—impact not expected to
occur within three years
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task One: Determining Organizational Assets and
Scenarios
•
•
•
•
Interest Calculation Systems
Customer Personally Identifiable Information (PII)
Reputation
Consumer financial data—High Business Impact (HBI)
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task Two: Identifying Threats
• Threat of a loss of integrity to consumer financial data
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task Three: Identifying Vulnerabilities
• Theft of financial advisor credentials by trusted employee abuse
using non-technical attacks, for example, social engineering or
eavesdropping
• Theft of financial advisor credentials off local area network (LAN)
hosts through the use of outdated security configurations
• Theft of financial advisor credentials off remote, or mobile, hosts as
a result of outdated security configurations
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task Four: Estimating Asset Exposure
• Breach of integrity through trusted employee abuse:
– Damaging, but not severe. Each financial advisor can only access
customer data that he/she manages.
• Breach of integrity through credential theft on LAN hosts:
– May result in a severe, or high, level of damage.
• Breach of integrity through credential theft on mobile hosts:
– Could have a severe, or high, level of damage. The discussion group
notes that the security configurations on remote hosts often lag behind
LAN systems.
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task Five: Identifying Existing Controls and Probability of
Exploit
• Agreement that their remote hosts, or mobile hosts, do not receive
the same level of management as those on the LAN.
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
– Task Six: Summarizing the Risk Discussion
• Risk Assessment Facilitator summarizes the discussion and
highlights the assets, threats, and vulnerabilities discussed.
Scenario 1: Facilitating a Risk
Discussion at Woodgrove Bank
• Woodgrove Bank is a consumer financial institution
in the process of conducting a Security Risk
Management project
–
–
–
–
–
Task One: Determining Organizational Assets and Threats
Task Two: Identifying Threats
Task Three: Identifying Vulnerabilities
Task Four: Identifying Asset Exposure
Task Five: Identifying Existing Controls and Probability of
Exploit
– Task Six: Summarizing the Risk Discussion
Defining Impact Statements
• Impact data includes the following
information:
Scenario 2: Defining an Impact
Statement For Woodgrove Bank
Asset
Name
Consumer
financial
investment
data
Consumer
financial
investment
data
Consumer
financial
investment
data
Asset
Class
HBI
HBI
HBI
DID
Level
Threat
Description
Vulnerability
Description
Host
Unauthorized access to
consumer data through
theft of Financial Advisor
credentials
Theft of credentials of
managed LAN client via
outdated security
configurations
H
H
Host
Unauthorized access to
consumer data through
theft of Financial Advisor
credentials
Theft of credentials off
managed remote client
via outdated security
configurations
H
H
Data
Unauthorized access to
consumer data through
theft of Financial Advisor
credentials
Theft of credentials by
trusted employee abuse,
via non-technical attacks
L
M
ER
IR
(H,M,L)
(H,M,L)
Understanding Risk
Prioritization
Start risk
prioritization
Conduct
summarylevel risk
prioritization
Summary
level risk
prioritization
Review with
stakeholders
Conduct
detailedlevel risk
prioritization
Detailed
level risk
prioritization
End of risk
prioritization
Conducting Summary-Level
Risk Prioritization
1
2
•
High. Likely—one or more impacts expected within one year
Medium. Probable—impact expected within two to three years
Low. Not probable—impact not expected to occur within three years
4
The summary-level prioritization includes the following:
1.
2.
3.
4.
Determine impact level
Estimate summary-level probability
Complete the summary-level risk list
Review with stakeholders
3
Scenario Three: Summary-Level
Risk Prioritization at Woodgrove
Bank
• Task One: Determine Impact Level
– Trusted Employee Theft Impact
• HBI asset class *Low Exposure = Moderate Impact
– LAN Host Compromise Impact
• HBI asset class *High Exposure = High Impact
– Remote Host Compromise Impact
• HBI asset class *High Exposure = High Impact
Scenario Three: Summary-Level
Risk Prioritization at Woodgrove
Bank
• Task Two: Estimate Summary-Level Probability
– Trusted Employee Theft Probability
• Low
– LAN Host Compromise Probability
• Medium
– Remote Host Compromise Probability
• High
Scenario Three: Summary-Level
Risk Prioritization at Woodgrove
Bank
• Task Three: Complete the Summary-Level Risk List
– Trusted Employee Theft Risk
• Moderate Impact *Low Probability = Low
– LAN Host Compromise Risk
• High Impact *Medium Probability = High
– Remote Host Compromise Risk
• High Impact *High Probability = High
– Enter Results in the Impact Statement Spreadsheet
Scenario Three: Summary-Level
Risk Prioritization at Woodgrove
Bank
• Task Four: Review With Stakeholders
– Trusted Employee abuse risk is rated as Low in the
summary level risk list and does not need to graduate to
the detailed level risk prioritization step
– LAN and remote host compromise risks are both rated as
high and so are then prioritized at the detailed level
Scenario Three: Summary-Level
Risk Prioritization at Woodgrove
Bank
•
•
•
•
Task One: Determine Impact Level
Task Two: Estimate Summary Level Probability
Task Three: Complete the Summary-Level Risk List
Task Four: Review With Stakeholders
Conducting Detailed-Level Risk
Prioritization
•
The following four tasks outline the process
for building a detailed-level list of risks:
1.
2.
3.
4.
•
Determine impact and exposure
Identify current controls
Determine probability of impact
Determine detailed risk level
Use the Detailed-Level Risk Prioritization
template (SRJA3-Detailed Level Risk
Prioritization.xls)
Scenario Four: Detailed-Level Risk
Prioritization at Woodgrove Bank
• Task One: Determine Impact and Exposure
– LAN Host Compromise Exposure Rating: 4 (80%)
• HBI = 10
• Impact Rating: 10 *80% = 8
– Remote Host Compromise Exposure Rating: 4 (80%)
• HBI = 10
• Impact Rating: 10 *80% = 8
– Impact Range = Between 7-10 which compares to High
Scenario Four: Detailed-Level Risk
Prioritization at Woodgrove Bank
• Task Two: Identify Current Controls
– Financial Advisors can only access accounts they own;
thus, the exposure is less than 100 percent.
– E-mail notices to patch or update hosts are proactively
sent to all users.
– Antivirus and patch updates are measured and enforced
on the LAN every few hours. This control reduces the time
window when LAN hosts are vulnerable to attack.
Scenario Four: Detailed-Level Risk
Prioritization at Woodgrove Bank
• Task Three: Determine Probability of Impact
– LAN and remote hosts: Likely that all vulnerability
attributes in the High category will be seen inside and
outside Woodgrove’s LAN environment in the near future.
Vulnerability value = 5 for both risks
– Control Effectiveness:
• LAN: Result of Control Effectiveness Questions = 1
• Remote: Result of Control Effectiveness Questions = 5
– Total Probability Rating: (Sum of Vulnerability and Control
Effectiveness)
• LAN = 6
• Remote = 10
Scenario Four: Detailed-Level Risk
Prioritization at Woodgrove Bank
• Task Four: Determine Detail Risk Level
– Impact Rating *Probability Rating
• LAN: 8 *6 = 48
• Remote Hosts: 8 *10 = 80
• Both rate an overall risk of High
Scenario Four: Detailed-Level Risk
Prioritization at Woodgrove Bank
•
•
•
•
Task One: Determine Impact and Exposure
Task Two: Identify Current Controls
Task Three: Determine Probability of Impact
Task Four: Determine Detail Risk Level
Quantifying Risk
• The following tasks outline the process for
determining the quantitative value:
– Assign a monetary value to each asset class
– Input the asset value for each risk
– Produce the single-loss expectancy value (SLE)
– Determine the annual rate of occurrence (ARO)
– Determine the annual loss expectancy (ALE)
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task One: Assign Monetary Values to Asset Classes
–
–
–
–
–
Using 5% Materiality Guideline for valuing assets
Net Income: $200 Million annually
HBI Asset Class: $10 Million (200 *5%)
MBI Asset Class: $5 Million (based on past spending)
LBI Asset Class: $1 Million (based on past spending)
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task Two: Identify the Asset Value
– Consumer financial data = HBI Asset Class
– HBI = $10 Million
– Asset Value = $10 Million
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task Three: Produce the Single Loss
Expectancy Value (SLE)
Risk Description
Asset Class
Value
Exposure
Rating
Exposure
Value
SLE
$10
4
80%
$8
$10
4
80%
$8
LAN Host Risk
($ in millions)
Remote Host Risk
($ in millions)
High Business Impact Value = $M
Asset Class
Exposure Rating
Exposure Factor %
5
100
4
80
HBI Value
$M
3
60
MBI Value
$M/2
2
40
LBI Value
$M/4
1
20
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task Four: Determine the Annual Rate of Occurrence
(ARO)
– LAN Host ARO: Based on the qualitative assessment of Medium probability,
the Security Risk Management Team estimates the risk to occur at least once
in two years; thus, the estimated ARO is 5.
– Remote Host ARO: Based on the qualitative assessment of High probability,
the Security Risk Management Team estimates the risk to occur at least once
per year; thus, the estimated ARO is 1.
Qualitative
Rating
Description ARO range Description Examples
High
Likely
>=1
Medium
Probable
.99 to .33
Low
Not
probable
.33
Impact once or more per
year
At least once every 1-3
years
At least once greater
than 3 years
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task Five: Determine the Annual Loss
Expectancy (ALE) (SLE *ARO)
Risk
Description
Asset
Class
Value
Exposure
Rating
Exposure
Value
SLE
ARO
ALE
LAN Host Risk
($ in millions)
$10
4
80%
$8
0.5
$4
Remote Host
Risk
($ in millions)
$10
4
80%
$8
1
$8
Scenario Five: Quantifying Risk
For Woodgrove Bank
• Task One: Assign Monetary Values to Asset Classes
• Task Two: Identify the Asset Value
• Task Three: Produce the Single Loss Expectancy
Value (SLE)
• Task Four: Determine the Annual Rate of Occurrence
(ARO)
• Task Five: Determine the Annual Loss Expectancy
(ALE) (SLE *ARO)
Assessing Risk: Best
Practices
• Analyze risks during the data gathering
process
• Conduct research to build credibility for
estimating probability
• Communicate risk in business terms
• Reconcile new risks with previous risks
Agenda
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Overview of the Decision
Support Phase
4
3
Measuring
Program
Effectiveness
Implementing
Controls
1
Assessing Risk
1. Define functional requirements
2. Identify control solutions
3. Review solution against
requirements
Conducting
4. Estimate degree of risk reduction
Decision
5. Estimate cost of each solution
Support
6. Select the risk mitigation
strategy
2
Identifying Output for the
Decision Support Phase
• Key elements to gather include:
– Decision on how to handle each risk
– Functional requirements
– Potential control solutions
– Risk reduction of each control solution
– Estimated cost of each control solution
– List of control solutions to be implemented
Considering the Decision
Support Options
• Options for handling risk: ATAM
– Accept
– Transfer
– Avoid
– Mitigate
Step 1: Define Functional
Requirements
Security risk
management
team
1
Mitigation
owner
2 Identify control
Define
functional
requirements
solutions
Security
steering
committee
3
Review
solutions
against
requirements
4
5
Estimate
degree of risk
reduction
Estimate
cost of
each solution
6 Select the risk
mitigation
strategy
Step 2: Identify Control
Solutions
Security risk
management
team
1
Mitigation
owner
2
Security
steering
committee
Define
functional
requirements
Identify
control
solutions
3
Review
solutions
against
requirements
4
5
Estimate
degree of risk
reduction
Estimate
cost of
each solution
6 Select the risk
mitigation
strategy
Step 3: Review Solutions
Against Requirements
Security risk
management
team
1
Mitigation
owner
2
Security
steering
committee
Define
functional
requirements
Identify
control
solutions
3
Review
solutions
against
requirements
4
5
Estimate
degree of risk
reduction
Estimate
cost of
each solution
6 Select the risk
mitigation
strategy
Step 4: Estimate Degree of Risk
Reduction
Security risk
management
team
1
Mitigation
owner
2
Security
steering
committee
Define
functional
requirements
Identify
control
solutions
3
Review
solutions
against
requirements
4
5
Estimate
degree of risk
reduction
Estimate
cost of
each solution
6 Select the risk
mitigation
strategy
Step 5: Estimate Cost of Each
Solution
Security risk
management
team
1
Mitigation
owner
2
Security
steering
committee
Define
functional
requirements
Identify
control
solutions
3
Review
solutions
against
requirements
4
5
Estimate
degree of risk
reduction
Estimate
cost of
each solution
6 Select the risk
mitigation
strategy
Step 6: Select the Risk
Mitigation Strategy
Security risk
management
team
1
Mitigation
owner
2
Security
steering
committee
Define
functional
requirements
Identify
control
solutions
3
Review
solutions
against
requirements
4
Estimate
degree of risk
reduction
5
6
Estimate
cost of
each solution
Select the
risk mitigation
strategy
Conducting Decision Support:
Best Practices
•
•
•
•
Assign a security technologist to each risk
Set reasonable expectations
Build team consensus
Focus on the amount of risk after the
mitigation solution
Agenda
•
•
•
•
•
Security Risk Management Concepts
Security Risk Management Prerequisites
Assessing Risk
Conducting Decision Support
Implementing Controls and Measuring
Program Effectiveness
Implementing Controls
4
3
Measuring
Program
Effectiveness
Implementing
Controls
• Seek a holistic
approach
• Organize by Defensein-Depth
1
Assessing Risk
2
Conducting
Decision
Support
Organizing the Control
Solutions
• Critical success determinants to organizing
control solutions include:
– Communication
– Team scheduling
– Resource requirements
Organizing by Defense-in-Depth
Physical
Network
Host
Application
Data
Measuring Program
Effectiveness
4
Measuring
Program
Effectiveness
1
Assessing Risk
• Develop scorecard
• Measure control
effectiveness
3
Implementing
Controls
2
Conducting
Decision
Support
Developing a Security Risk
Scorecard for Your Organization
• A simple security risk scorecard organized
by the Defense-in-Depth layers:
FY05 Q1
H
FY05 Q2
M
Application
M
M
M
M
M
H
Data
L
L
Physical
Network
Host
FY05 Q3
Risk Levels (H, M, L)
FY05 Q4
Measuring Control Effectiveness
• Methods for measuring the effectiveness of
implemented controls include:
– Direct testing
– Submitting periodic compliance reports
– Evaluating widespread security incidents
Summary
•
•
•
•
•
Decide on risk management methodology
Determine your maturity level
Conduct risk assessment
Conduct decision support
Implement controls & measure effectiveness
Next Steps
•
Australia Security Portal
http://www.microsoft.com/australia/security
•
Microsoft Security Risk Management Guide
http://www.microsoft.com/technet/security/guidance/secrisk
•
MOF - Security Management
http://www.microsoft.com/technet/itsolutions/cits/mo/smf/mofsmsmf.mspx
•
Additional security tools and content
http://www.microsoft.com/security/guidance