Course Period ISYS 8038 IS Security and Risk

Course Period : ISYS 8038 / IS Security and Risk Management : September / February 2019 Reports and Consulting Session 11 D 1459 – Dr. Ir. Jarot S. Suroso, M. Eng.

Reports and Consulting Textbook: Evan Wheeler (2011). Security Risk Management: Building an Information Security Risk Management Program from the Ground Up 1 st Edition. Elsevier Inc, ISBN: 978 -1 -59749 -615 -5.

Reports and Consulting • Risk Management Artifacts • A Consultant’s Perspective • Writing Audit Responses

Risk Management Artifacts Risk assessment template should at least capture the following information: • Brief risk description • Risk rating • Why a rating was given • Compensating controls considered • Risk owner • Risk decision (mitigation plan, accept risk with exception, transfer risk)

Besides the documentation of a risk finding, mitigation plan, or exception request, these are some other artifacts that you should expect to create: • • • Security risk profile Questionnaires Risk inventory (also called a risk register) Enterprise risk assessment Architectural or design analysis

A CONSULTANT’S PERSPECTIVE This chapter presents one approach for structuring a risk assessment project as a consultant and this process has been loosely based on the methodology in OCTAVE Allegro, a popular industry framework for risk assessment.

Octave Allegro Coming out of CERT and Carnegie Mellon’s Software Engineering Institute (SEI), the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Allegro methodology takes a more software development lifecycle approach to risk management, as opposed to some of the more operationfocused approaches for assessing system risk like NIST’s Certification and Accreditation process. There have been many revisions to the framework including OCTAVE (first published in 1999), OCTAVE-S (published in 2003) and now OCTAVE Allegro (published in 2007)

A Phased Approach In particular, the artifacts provided by OCTAVE Allegro are an extremely good place to start for those just beginning to implement formal risk assessments within their organization. • Develop qualitative risk evaluation criteria that describe the organization’s operational risk tolerances • Identify assets that are important to the mission of the organization

A Phased Approach • Identify threats to the mission of the organization through threat modeling • Identify vulnerabilities associated with the likely threats and critical assets • Determine and evaluate the potential consequences to the organization if threats are realized • Develop a mitigation plan for each critical asset

Gathering Business Requirements One of the strengths of this methodology, for a consultant, is that it is strongly focused on gathering business requirements and tailoring the assessment to those priority areas. It is essential to understand an organization’s mission and objectives if you are going to design a risk assessment that really addresses the areas of highest exposure.

OCTAVE Allegro relies on Subject Matter Experts (SME), typically consisting of three to five people per assessment team, being closely involved in the assessment process. Each SME should have strong working knowledge of the critical assets, security requirements, threats, and security practices of the organization.

OCTAVE process flow

The methodology includes extensive questionnaires for profiling threat exposures and vulnerabilities. Specific objectives are as follows: • Develop risk measurement criteria that are consistent with organizational drivers. • Profile assets including information containers. • Identify threats through a structured process. • Identify risks and develop mitigation strategies.

Risk Assessment Engagement Phase 1: Build Asset-Based Threat Profiles • Identify organizational information • Create threat profiles Phase 2: Identify Vulnerabilities • Examine the critical resources • Examine the supporting infrastructure Phase 3: Evaluate Risks and Develop Security Strategy • Identify and analyze risks • Develop protection strategy and mitigation plans For risk assessments, a very simple workflow can

Phase 1: Build Asset-Based Threat Profiles It is always important to start by profiling the organization and their critical resources. When you start scoping out the engagement with your client, you will likely come across two scenarios: 1. The client wants you to identify the critical assets that should be included. 2. The client will already have specific assets identified in the scope of the engagement.

This phase of the project should include the following steps: • • Identify organizational information Establish impact evaluation criteria Identify organizational assets Evaluate organizational security practices Create threat profiles Select critical assets Identify security requirements for critical assets • Identify threats to critical assets

Security Requirements

OCTAVE areas of concern worksheet

Phase 2: Identify Vulnerabilities This phase has a singular focus: to assess the applicable vulnerabilities related to the critical resources and any supporting infrastructure. You might think of this phase as being comprised of two steps: 1. Examine the critical resources 2. Examine the supporting infrastructure

Phase 3: Evaluate Risks and Develop Security Strategy Once a list of the vulnerabilities has been compiled, the bulk of the analysis work begins. This phase of the project includes two very distinct steps: 1. Identify and analyze risks 2. Develop protection strategy and mitigation plans.

The risk evaluation step should include the following: 1. Determine likelihood of threat/vulnerability 2. Determine severity of threat/vulnerability 3. Determine risk exposure (including risk sensitivity) 4. Identify safeguards 5. Determine residual risk level

Develop a Mitigation Strategy 1. Recommend protection strategy 2. Select risk mitigation steps 3. Identify near-term action items 4. Update status of mitigation plan

Structure of a Risk Assessment Report There are many ways to format and organize a risk assessment report. Shown here is one organizational style: 1. Executive summary 2. Asset-based threat profiles 3. Risk findings

4. Security strategy and plans • Appendix A: Updated Action Plan Status • Appendix B: Risk Assessment References • Appendix C: Third-Party Resources List • Appendix D: Additional Project Data

Executive Summary This approach starts with the obligatory executive summary section, describes the threat profiles for critical resources, then details the results of the risk evaluation, and finally includes the recommended mitigation steps. The executive summary should include four basic elements: 1. Purpose of analysis 2. Scope of analysis 3. Assessment steps 4. Findings summary

Body of the Report It is common in the body of the report for the focus to be on the results of each individual vulnerability assessment activity, but this way of organizing the information misses the point of a risk assessment. Rather than going through each test and listing the findings, it is better to highlight the risks and include the assessment test findings that pertain to that risk exposure as a way to qualify the risks you are highlighting.

Appendices The appendices are optional sections that can be used to capture changes in risk during a follow-up assessment, provide links to tools used and advisories referenced, and other resources to supply further context for the findings.

Report Language and Style Be careful about the choice of words and tone in the entire report. If you are performing a true audit, you would include words like “must, ” but if you are just providing an assessment, you would want to use “should” instead. It’s important to set the right tone and give clients the opportunity to find their own solutions to the risks being identified.

WRITING AUDIT RESPONSES The typical flow for an audit is as follows: 1. Scope of audit and start date are established. 2. Auditors provide a list of preliminary evidence requests to the organization. 3. Audit begins with meetings and requests for evidence of controls. 4. Auditors review samples of the evidence and ask qualifying questions or request further evidence.

5. Draft report of findings is presented by auditors. 6. A discussion of the findings takes place between auditors and organization (sometimes multiple meetings with management and/or technical representatives). 7. Any revisions or clarifications are made and an audit report is published. 8. Organization writes their response (within 2 weeks or so). 9. Management response is included in the final report.

Supporting Material • R. A. Caralli, J. F. Stevens, L. R. Young, W. R. Wilson, Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process, Software Engineering Institute, 2007. www. sei. cmu. edu/reports/07 tr 012. pdf • Open Source Security Testing Methodology Manual. www. isecom. org/osstmm