Security Risk Analysis Management Professor Rine Security Risk

Security Risk Analysis & Management Professor Rine Security Risk Analysis & Requirements Engineering 1

Security in System Development l l Risk Analysis & Management needs to be a part of system development, not tacked on afterwards Baskerville's three generations of methods 1 st Generation: Checklists Example: BS 7799 Part 1 2 nd Generation: Mechanistic engineering methods Example: this risk analysis method 3 rd Generation: Integrated design Not yet achieved [Baskerville, R. (1993). Information Systems Security Design Methods: Implications for Information Systems Development. ACM Computing Surveys 25(4): 375 -414. ] Security Risk Analysis & Management 2

Introduction Risk Analysis and Management Framework Assets Threats Vulnerabilities Risks Security Measures } } Analysis Management Security Risk Analysis & Management 3

Definitions 1 The meanings of terms in this area is not universally agreed. We will use the following l Threat: Harm that can happen to an asset l Impact: A measure of the seriousness of a threat l Attack: A threatening event l Attacker: The agent causing an attack (not necessarily human) l Vulnerability: a weakness in the system that makes an attack more likely to succeed l Risk: a quantified measure of the likelihood of a threat being realised Security Risk Analysis & Management 4

Definitions 2 l Risk Analysis involves the identification and assessment of the levels of risk, calculated from the l l Values of assets Threats to the assets Their vulnerabilities and likelihood of exploitation Risk Management involves the identification, selection and adoption of security measures justified by l l The identified risks to assets The reduction of these risks to acceptable levels Security Risk Analysis & Management 5

Goals of Risk Analysis l l All assets have been identified All threats have been identified l l Their impact on assets has been valued All vulnerabilities have been identified and assessed Security Risk Analysis & Management 6

Problems of Measuring Risk Businesses normally wish to measure in money, but l Many of the entities do not allow this l l l Valuation of assets – Value of data and in-house software - no market value – Value of goodwill and customer confidence Likelihood of threats – How relevant is past data to the calculation of future probabilities? l The nature of future attacks is unpredictable l The actions of future attackers are unpredictable Measurement of benefit from security measures – Problems with the difference of two approximate quantities -5 probability l How does an extra security measure affect a ~10 of attack? Security Risk Analysis & Management 7

Risk Levels l l Precise monetary values give a false precision Better to use levels, e. g. l l l High, Medium, Low – High: major impact on the organisation – Medium: noticeable impact (“material” in auditing terms) – Low: can be absorbed without difficulty 1 - 10 Express money values in levels, e. g. l For a large University Department a possibility is – High £ 1, 000+ – Medium £ 1, 000+ – Low < £ 1, 000 Security Risk Analysis & Management 8

Risk Analysis Steps l Decide on scope of analysis l l l Set the system boundary Identification of assets & business processes Identification of threats and valuation of their impact on assets (impact valuation) Identification and assessment of vulnerabilities to threats Risk assessment Security Risk Analysis & Management 9

Risk Analysis – Defining the Scope l l Draw a context diagram Decide on the boundary l l It will rarely be the computer! Make explicit assumptions about the security of neighbouring domains l Verify them! Security Risk Analysis & Management 10

Risk Analysis - Identification of Assets l Types of asset l l l l Hardware Software: purchased or developed programs Data People: who run the system Documentation: manuals, administrative procedures, etc Supplies: paper forms, magnetic media, printer liquid, etc Money Intangibles – Goodwill – Organisation confidence – Organisation image Security Risk Analysis & Management 11

Risk Analysis – Impact Valuation Identification and valuation of threats - for each group of assets l Identify threats, e. g. for stored data l l l Loss of confidentiality Loss of integrity Loss of completeness Loss of availability (Denial of Service) For many asset types the only threat is loss of availability Assess impact of threat l l Assess in levels, e. g H-M-L or 1 - 10 This gives the valuation of the asset in the face of the threat Security Risk Analysis & Management 12

Risk Analysis – Process Analysis Every company or organisation has some processes that are critical to its operation l The criticality of a process may increase the impact valuation of one or more assets identified So l Identify critical processes l Review assets needed for critical processes l Revise impact valuation of these assets l Security Risk Analysis & Management 13

Risk Analysis – Vulnerabilities 1 l Identify vulnerabilities against a baseline system l l For risk analysis of an existing system – Existing system with its known security measures and weaknesses For development of a new system – Security facilities of the envisaged software, e. g. Windows NT – Standard good practice, e. g. BS 7799 recommendations of good practice Security Risk Analysis & Management 14

Risk Analysis – Vulnerabilities 2 For each threat l Identify vulnerabilities l l Assess levels of likelihood - High, Medium, Low l l l How to exploit a threat successfully; Of attempt – Expensive attacks are less likely (e. g. brute-force attacks on encryption keys) Successful exploitation of vulnerability; Combine them Vulne rabili Likelihood of Attempt Likelihood of Success ty Low Med High Low Low Med High Low Med High Security Risk Analysis & Management 15

Risk Assessment Assess risk l If we had accurate probabilities and values, risk would be l l l Impact valuation x probability of threat x probability of exploitation Plus a correction factor for risk aversion Since we haven't, we construct matrices such as Risk Impact valuation Low Med High Low Low Med Vulnerability Med Low Med High Security Risk Analysis & Management 16

Responses to Risk Responses to risk l Avoid it completely by withdrawing from an activity l Accept it and do nothing l Reduce it with security measures Security Risk Analysis & Management 17

Security Measures Possible security measures l Transfer the risk, e. g. insurance l Reduce vulnerability l l Reduce likelihood of attempt – e. g. publicise security measures in order to deter attackers – e. g. competitive approach - the lion-hunter’s approach to security Reduce likelihood of success by preventive measures – e. g. access control, encryption, firewall Reduce impact, e. g. use fire extinguisher / firewall Recovery measures, e. g. restoration from backup Security Risk Analysis & Management 18

Risk Management l l Identify possible security measures Decide which to choose l Ensure complete coverage with confidence that: – The selected security measures address all threats – The results are consistent – The expenditure and its benefits are commensurate with the risks l Consider doing less than the BS 7799 recommendations? Security Risk Analysis & Management 19

Iterate l Adding security measures changes the system l l Vulnerabilities may have been introduced After deciding on security measures, revisit the risk analysis and management processes l e. g. introduction of encryption of stored files may remove threat to Confidentiality but introduce a threat to Availability – What happens if the secret key is lost? Security Risk Analysis & Management 20

Conclusion: Problems of Risk Analysis and Management l l l Lack of precision Volume of work and volume of output Integrating them into a ”normal” development process Security Risk Analysis & Management 21

Current Risk Management Techniques Security Risk Analysis & Requirements Engineering 22

Risk Management Techniques 1 Commercial tools l l CRAMM (CCTA Risk Assessment and Management Methodology): l l l Mostly rely on check lists UK Government approach Supported by software PROTEUS (BSI) software: l l Gap analysis to identify necessary actions and existing strengths Comprehensive practical guidance and the text of BS 7799 Reporting, for easy monitoring and maintenance Evidence to customers and auditors Security Risk Analysis & Management 23

Risk Management Techniques 2 Generic processes l Threat trees (see below): l l Threat analysis Based on fault trees Only addresses the threat identification stage Attack trees (see below) l Vulnerability analysis Security Risk Analysis & Management 24

Threat Trees 1 AT&T Bell Laboratories l Categorisation of threats l l Disclosure / Integrity / Denial of service Categorisation of vulnerabilities by view l l l l Personnel view Physical view Operational view Communications view Network view Computing view Information view [Amoroso, E. , W. E. Kleppinger, and D. Majette, An Engineering Approach to Secure System Analysis, Design and Integration. AT&T Technical Journal, 1994. 73(5): p. 40 -51. ] Security Risk Analysis & Management 25

Threat Trees 2 l l Model of system Calculate risks from l l Impact Vulnerability Originator O Message Handling M Threats to Electronic Mail Recipient R Disclosure Integrity Denial of Service Other Subscribers S Electronic Mail System External E O R M S E Security Risk Analysis & Management O R M S E 26

Attack Trees l Tree Structure l l l Goal is root node Ways of achieving goals are leaf nodes Costs can be associated with nodes [Schneier, B, Secrets and Lies. 2000: John Wiley and Sons. ] Security Risk Analysis & Management 27

Attack Tree Example Goal: Read a specific message … 1. Convince sender to reveal message (OR) 1. 1. Bribe user 1. 2. Blackmail user 1. 3 Threaten user 1. 4. Fool user 2. Read message when it is being entered into the computer (OR) 2. 1. Monitor electromagnetic emanations from computer screen (Countermeasure: use a TEMPEST computer) 2. 2. Visually monitor computer screen 2. 3. Monitor video memory 2. 4. Monitor video cables 3. Read message when it is being stored on sender's disk (Countermeasure: use SFS to encrypt hard drive) (AND) 3. 1 Get access to hard drive (Countermeasure: Put physical locks on all doors and windows) 3. 2. Read a file protected with SFS. 4. …. . Security Risk Analysis & Management 28