Course ISYS 8014 IS RISK MANAGEMENT Effective Period

Course : ISYS 8014 - IS RISK MANAGEMENT Effective Period: September 2016 THE RISK MANAGEMENT LIFECYCLE Session 02

THE RISK MANAGEMENT LIFECICLE Textbook: Evan Wheeler (2011). Security Risk Management: Building an Information Security Risk Management Program from the Ground Up 1 st Edition. Elsevier Inc, ISBN: 978 -1 -59749 -615 -5.

THE RISK MANAGEMENT LIFECYCLE • • • Stages of the Risk Management Lifecycle Business Impact Assessment A Vulnerability Assessment Is Not a Risk Assessment Making Risk Decisions Mitigation Planning and Long-Term Strategy Process Ownership

STAGES OF THE RISK MANAGEMENT LIFECYCLE • Risk Is a Moving Target There are many times when a re-evaluation is needed (basically starting the assessment cycle over) including the following: Ø A change in the sensitivity of the target resource Ø A significant shift in the threat landscape Ø A change in legal/regulatory requirements Ø A change in security policy Ø On a schedule, based on the resource’s sensitivity to risk

A Comprehensive Risk Management Workflow

BUSINESS IMPACT ASSESSMENT • Resource Profiling Risk profiles can vary in detail and format, but there are some basic data points that you will want to capture in each profile: Ø General description Ø Function and features Ø Information classification Ø Criticality to organization Ø Applicable regulations

A VULNERABILITY ASSESSMENT IS NOT A RISK ASSESSMENT • Vulnerability Assessment Vulnerabilities are identified and rated based on a very general knowledge of how they might be exploited; however, no real analysis of applicability or threat analysis is included.

• Risk Assessment A risk assessment is the superset of activities for taking that vulnerability data, mapping it to likely threats, evaluating the severity for the given environment, and articulating the risk(s) that might result.

MAKING RISK DECISIONS • Risk Evaluation There are several options for addressing a risk: Ø Accept A decision to accept the risk. Ø Avoid Ceasing (or not engaging in) the activity that is presenting the risk altogether. Ø Transfer Shifting the responsibility or liability for a risk to another party. Ø Mitigate Limit the exposure in some way.

• Document At a minimum, you want to capture the following details of your analysis for each risk finding: Ø Why a rating was given Ø Compensating controls considered Ø Business justification Ø Mitigation plans—long- and short-term Ø Policy exceptions/risk acceptance

MITIGATION PLANNING AND LONG-TERM STRATEGY • Risk Mitigation There are many options for mitigating a risk, and again the focus is not always on trying to eliminate the risk, but rather to reduce the risk exposure to an acceptable level. To mitigate a risk, you either have to 1. reduce the likelihood of occurrence, or 2. limit the severity of the impact, or 3. decrease the sensitivity of the resource.

MITIGATION PLANNING AND LONG-TERM STRATEGY • Validation Once controls have been implemented to mitigate a risk, you need to verify the adequacy of these controls through active testing or review.

MITIGATION PLANNING AND LONG-TERM STRATEGY • Monitoring and Audit There is no rest for the risk management program: we are constantly either assessing a risk, tracking the mitigation, evaluating an exception request, or monitoring for new and changing risk exposures. The most common triggers for a reassessment of risks are as follows: Ø Significant resource changes Ø Changes to the threat landscape Ø Shifts in business focus Ø Changes to the regulatory or legal requirements Ø Detected weaknesses in current controls Ø Predetermined period of time has passed

PROCESS OWNERSHIP There a lot of different teams and roles involved in the risk management lifecycle. For example, • Business owner • Custodian • Information security.

• PROCESS OWNERSHIP The business owner is the subject matter expert when it comes to defining the needs of their resource, and often the Information Technology team assumes a role of custodian for that resource and fills the role of implementing and maintaining the controls.

Risk Responsibilities and Roles

• Risk Responsibilities and Roles In Table Risk Responsibilities and Roles, the business owner is intentionally listed first for steps 3 and 4 of lifecycle because they should be driving those risk activities with support and guidance from security. For example, the information security team doesn’t need to draft the mitigation plan or submit the exception request. Nor should we take responsibility for making the risk decisions about how to address an exposure

Supporting Material • • • J. Jones, An Introduction to Factor Analysis of Information Risk (FAIR). www. risk managementinsight. com/media/docs/FAIR_introduction. pdf, 2010 (accessed 06. 03. 10). PCI Security Standards Council. www. pcisecuritystandards. org, 2010 (accessed 02. 10). A Complete Guide to the Common Vulnerability Scoring System, Version 2. 0. http: // www. first. org/cvss-guide. html, 2010 (accessed 30. 01. 10). [7] Society of Information Risk Analysts (SIRA). www. societyinforisk. org, 2011 (accessed 05. 01. 11).