Security Risk Management
Liping Cai
02/01/2006
1
Agenda







Overview
Reactive Vs. Proactive approaches
Quantitative risk management or qualitative risk
management
Assessing Risk
Conducting Decision Support
Implementing Controls
Measuring Program Effectiveness
2
Introduction – why, who, what?

Why this guide?
-- The environmental Challenge
-- New legislation
-- lack of in-house expertise, budget resources, and guidelines to outsource

Who should read this Guide?
-- Architects and planners
-- Members of the information security team
-- Security and IT auditors
-- Senior executives, business analysts and BDMs
-- Consultants and partners.

What is in the guide?
-- Survey of Security Risk Management practice
-- Security Risk Management Process:
Assessing Risk
Conducting Decision Support
Implementing Controls
Measuring Program Effectiveness
3
Reactive Approaches to Risk Management
Protect human life and people’s safety should always be your first
priority.
Contain the harm that the attack caused helps to limit additional
damage.
Determine the extent of the damage that the attack caused right
after you contain the situation and duplicate the hard disks.
Understand the resources at which attack was aimed and what
vulnerabilities were exploited to gain access or disrupt services.
Damage should be repaired as quickly as possible to restore
normal business operations and recover data lost during the attack.
Review the process thoroughly. Determine with your team the
steps that were executed successfully and what mistakes were
made.
4
Proactive Approaches to Risk Management


Instead of waiting for bad things to happen and then
responding to them afterwards, you minimize the
possibility of the bad things ever occurring in the first
place.
Common high-level procedures:
-- Identify business assets;
-- Determine what damage an attack against an asset could cause to the
organization.
-- Identify the security vulnerabilities that the attack could exploit.
-- Determine how to minimize the risk of attack by implementing
appropriate controls.
5
Approaches to Risk Prioritization -- Quantitative Risk Management








The goal is to try to calculate objective numeric values for each of the components
gathered during the risk assessment and cost – benefit analysis.
Valuing Assets: The overall of the asset to your organization; The immediate financial
impact of losing the asset; The indirect business impact of losing the asset.
Determining the Single Loss Expectancy(SLE) : SLE is the total amount of revenue
that is lost from a single occurrence of the risk.
Determining the Annual Rate of Occurrence(ARO): ARO is the number of times that
you reasonably expect the risk to occur during one year.
Determining Annual Loss Expectance(ALE): The ALE is the total amount of money
that your organization will lose in one year if nothing is done to mitigate the risk.
Determining Cost of Controls: requires accurate estimates on how much acquiring,
testing, deploying, operating, and maintaining each control would cost.
Return on security Investment: ROSI = ALE before control – ALE after control –
annual cost of controls.
The results of the quantitative Risk analyses:
-- Assigned monetary values for asset
-- A comprehensive list of significant threats
-- The probability of each threat occurring
-- The loss potential for the company on a per-threat basis over 12 months.
-- Recommended safeguards, control, and actions.
6
Approaches to Risk Prioritization -- Qualitative Risk Management



The basic process is very similar to what happens in the
quantitative approach.
The difference is in the details:
-- You calculate relative values not assign hard financial values
to assets, expected losses, and cost of controls.
-- Risk analysis is usually conducted through a combination of
questionnaires and collaborative workshops involving people
from a variety of groups within the organization;
The results are presented to management for consideration
during a cost-benefit analysis.
7
Comparing two approaches:
Quantitative
Qualitative
Benefi – Risks are prioritized by financial impact; assets – Enables visibility and
are prioritized by financial values.
understanding of risk ranking.
ts
–Results facilitate management of risk by return
on security investment.
–Results can be expressed in managementspecific terminology (e.g., monetary values and
probability expressed as a specific percentage).
–Accuracy tends to increase over time as the
organization builds historic record of data while
gaining experience.
Drawb –Impact values assigned to risks are based on
subjective opinions of participants.
acks
– Process to reach credible results and consensus
is very time consuming.
– Calculations can be complex and time
consuming.
–Results are presented in monetary terms only,
and they may be difficult for non-technical
people to interpret.
–Process requires expertise, so participants
cannot be easily
– Easier to reach consensus.
– Not necessary to quantify threat
frequency.
– Not necessary to determine
financial values of assets.
– Easier to involve people who are
not experts on security or
computers.
– Insufficient differentiation
between important risks.
– Difficult to justify investing in
control implementation because
there is no basis for a cost-benefit
analysis.
– Results are dependent upon the
quality of the risk management
team that is created.
8
Microsoft Security Risk Management Process




Is a hybrid approach that joins the best elements of the 2 traditional
approaches.
Significantly simpler than traditional quantitative risk management.
Minimize resistance to results of the risk analysis and decision support
phases.
Enabling consensus to be achieved more quickly and maintained
throughout the process.
9
Risk Management vs. Risk Assessment
Risk Management
Risk Assessment
Goal
Manage risks across
business to acceptable level
Identify and
prioritize risks
Cycle
Overall program across all
four phases
Schedule
Ongoing
Single phase of risk
management
program
As needed
Alignmen Aligned with budgeting
cycles
t
N/A
10
Communicating Risk
11
Determining Risk Management Maturity Level
There are 6 levels
-- 0 non existed.
-- 1 Ad Hoc
-- 2 Repeatable
-- 3 Defined Process
-- 4 Managed
-- 5 Optimized
 Self assessment: given a questions list, for each question, score your
organization from 0 to 5 based on the definition, then add all of the score
together.
>= 52. The organization is well prepared to introduce and use the Microsoft
security risk management process to its fullest extent.
34—50 indicates the organization has taken many significant steps to control
security risks and is ready to gradually introduce the process.
< 34 should consider starting very slowly with the Microsoft security risk
management process by creating the core security risk management team and
applying the process to a single business unit for the first few months.

12
Defining Roles and Responsibilities
13
Assessing Risk -- Identify and prioritize risks to the business



Planning —Building the foundation for a successful
risk assessment.
Facilitated data gathering — Collecting risk
information through facilitated risk discussions.
Risk prioritization — Ranking identified risks in a
consistent and repeatable process.
14
Assessing Risk -- Planning





Alignment: Proper timing aids in building consensus during the
assessment because it allows stakeholders to take active roles in the
planning process. Proper alignment of the risk management process
with the budget planning cycle also benefit internal and external
auditing activities.
Scope: the risk assessment scope should document all organization
functions included in the risk assessment.
Stakeholder Acceptance: A best practice to enlist stakeholder
support is to pre-sell the concept and the activities within the risk
assessment
Preparing for success: Setting reasonable expectations is critical if
the risk assessment is to be successful.
Embracing Subjectivity
15
Facilitated Data Gathering



Keys to success: Building support; Discussing vs. Interrogating; Building
Goodwill
Risk Discussion Preparation:
-- Identify Risk Assessment Inputs
-- Identify and classifying Assets
-- Organizing Risk Information
-- Organizing by Defense-in-Depth Layers
-- Defining Threats and Vulnerabilities
-- Estimating Asset Exposure
-- Estimating Probability of Threats
Facilitating Risk Discussions
16
Prioritize risks

Primary Tasks and Deliverables
-- Task One: Build the summary level list using broad categorizations to estimate probability of
impact to the organization.
Output: Summary level list to quickly identify priority risks to the organization.
-- Task Two: Review summary level list with stakeholders to begin building consensus on priority
risks and to select the risks for the detailed level list.
-- Task three: Build the detailed level list by examining detailed attributes of the risk in the current
business environment. This includes guidance to determine a quantitative estimate for each risk.
Output: Detailed level list providing a close look at the top risks to the organization.




Conducting Summary Level Risk Prioritization
-- Task one – Determine impact value from impact statements collected in the data
gathering process.
-- Task two – Estimate the probability of the impact for the summary level list.
-- Task Three – Complete the summary level list by combining the impact and
probability values for each risk statement.
Reviewing with stakeholders
Building detailed level list of risks.
-- Determine impact and exposure; -- Identify current controls
-- Determine probability of impact; -- Determine detailed risk level
Quantifying Risks
-- Assign a monetary value to each asset class for your organization
-- Input the asset value for each risk; --Produce the single loss expectancy value
-- Determine the annual Rate of occurrence; --Determine the annual loss expectancy.
17
Conducting Decision Support






Define functional
requirements.
Select control
solutions.
Review solutions
against the
requirements.
Estimate the degree of
risk reduction that
each control provides.
Estimate costs of each
solution.
Select the risk
mitigation strategy.
18
Implementing Controls and Measuring Program Effectiveness
Implementing Controls phase
-- Deploy and operate control solutions to reduce risk to the business.
-- Seek holistic approach – Incorporate people, process, and technology in
mitigation solution.
-- Organize by defense-in-depth – Organize mitigation solutions across the
business.
 Measuring Program Effectiveness phase
-- is an ongoing one in which the Security Risk Management Team
periodically verifies that the controls implemented during the preceding
phase are actually providing the expected degree of protection.
-- Analyze the risk management process for effectiveness and verify that
controls are providing the expected degree of protection.
-- Evaluate the risk management program for opportunities to improve.
-- Develop risk scorecard – Understand risk posture and progress.

19
Level of Effort
20