Cyber Risk Assessment Stages - Week 7

Cyber Risk Assessment Stages

• Context Establishment is crucial for a successful assessment. Incorrect context can impact the entire process.
• Goals and Objectives need to be defined, including aims like reducing cyber attack likelihood and ensuring stakeholder confidence in security and compliance.
• Scope and Focus should be determined, potentially limiting the assessment to certain parts of the system and defining assumptions like insider motivations.
• Internal and External Context is important, considering external factors (regulations, laws, customer expectations) and internal aspects (assets, processes, risk management constraints).
• Assets need to be identified for protection, considering factors like integrity, availability, and confidentiality.
• Risk evaluation uses scales to assess likelihood and impact, categorizing risks into, for example, minor or major, to decide on mitigation actions.
• Potential consequences of each asset need to be defined, understanding the impact of each risk, with supporting evidence.
• Attack surface identification maps system interfaces (e.g., internet, mobile) to find potential entry points for attackers.

Risk Identification

• Purpose is to identify potential malicious and non-malicious attacks on the system.
• Malicious vs. Non-Malicious attacks are handled differently – malicious attacks start by identifying sources, threats, vulnerabilities, and incidents; non-malicious attacks reverse the order, starting with incidents.
• Identification Techniques include technical data (logs, penetration testing), and input from developers, operators, and external experts. Interviews and brainstorming also gather diverse perspectives.
• Identifying Malicious Threats follows steps like identifying adversaries and threat sources, identifying potential threats by each source, identifying and assessing vulnerabilities, and documenting specific incidents resulting from vulnerabilities and threats.
• Non-Malicious Threat Identification follows a reverse order, starting from incidents and moving backward to identify vulnerabilities, threats, and sources.

Analysis

• Purpose of risk analysis is to evaluate the level of risk by analyzing threats, vulnerabilities, likelihoods, and consequences.
• Likelihood and Severity Assessment uses frequency (e.g., rare, every 10 years) to rate threat likelihood and vulnerability severity (high/medium/low); reasoning must be documented. Incident likelihood is also rated on a frequency scale.
• Sources for Estimation include logs, industry data, security data, and expert judgment. The basis for each assessment should be clearly documented.
• Threat Analysis involves assessing the likelihood of each identified threat, differentiating between malicious and non-malicious.
• Vulnerability Analysis uses tools like scans and code reviews to evaluate vulnerability likelihood and severity, rated using accessible scales.

Incident and Consequence Analysis

• Incident and Consequence Analysis determines the impact of incidents on each affected asset, referencing the scales defined in context establishment. Assessments should be documented.
• Continual Risk Treatment applies treatment that affects risks, regularly inspected by new teams and regulators. Evidence and reasoning are critical.