INFORMATION SECURITY MANAGEMENT LECTURE 7 RISK MANAGEMENT IDENTIFYING
- Slides: 17
INFORMATION SECURITY MANAGEMENT LECTURE 7: RISK MANAGEMENT IDENTIFYING AND You got to be careful if you don’t know where you’re going, ASSESSINGbecause RISK you might not get there. – Yogi Berra
Risk Management “The process of determining the maximum acceptable level of overall risk to and from a proposed activity, then using risk assessment techniques to determine the initial level of risk and, if this is excessive, developing a strategy to ameliorate appropriate individual risks until the overall level of risk is reduced to an acceptable level. ”
Risk Terminology
Risk Identification Figure 8 -1 Risk identification process Source: Course Technology/Cengage Learning
Importance of Assets
Risk Terminology
Threat Identification
Threat Identification (cont’d. ) Weighted ranks of threats to information security Source: Adapted from M. E. Whitman. Enemy at the gates: Threats to information security. Communications of the ACM, August 2003. Reprinted with permission
Risk Terminology
Vulnerability Assessment Table 8 -4 Vulnerability assessment of a DMZ router Management of Information Security, 3 rd ed. Source: Course Technology/Cengage Learning
Risk Terminology
The TVA Worksheet (cont’d. ) Table 8 -5 Sample TVA spreadsheet Source: Course Technology/Cengage Learning
Introduction to Risk Assessment • The goal is to create a method to evaluate the relative risk of each listed vulnerability Figure 8 -3 Risk identification estimate factors Source: Course Technology/Cengage Learning
Risk Determination – Example 1 Asset A has a value of 50 and has one vulnerability, which has a likelihood of 1. 0 with no current controls. Your assumptions and data are 90% accurate
Risk Determination – Example 2 Asset B has a value of 100 and has two vulnerabilities: n vulnerability #1 has a likelihood of 0. 5 with a current control that addresses 50% of its risk n vulnerability # 2 has a likelihood of 0. 1 with no current controls. Your assumptions and data are 80% accurate
Qualitative Risk Assessment
Example of Qualitative Risk Assessment Threat Impact Initial Probability Countermeasure Residual Probability Flood damage H L Water alarms L Theft H L Key cards, surveillance, guards L Logical intrusion H M Intrusion prevention system L
