Gestión de Riesgos de Sistemas de Información

Chapter Review

• Risk management is the process of identifying, assessing, reducing risk to an acceptable level, and ensuring it remains at that level.
• An ISRM (Information Systems Risk Management) policy establishes the framework for security risk management processes and procedures, addressing all aspects of information security.
• A threat is a potential cause of an unwanted event that can harm a system or organization.
• Key risk assessment methodologies include NIST SP 800-30, FRAP (Facilitated Risk Analysis Process), OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation), and FMEA (Failure Modes and Effects Analysis).
• FMEA is a structured method to determine system functions, identify potential failures, and analyze their causes and effects.
• Fault tree analysis helps to identify failures in complex systems and environments.
• Quantitative risk analysis assigns monetary values to assets in the analysis, while qualitative analysis uses judgment and experience instead of numerical values.
• Qualitative risk analysis relies on expert experience to assess probabilities, potential losses, and the severity of threats.
• SLE x ARO = ALE (Single Loss Expectancy x Annualized Rate of Occurrence = Annualized Loss Expectancy).

Quick Review

• Risk management seeks to identify risks, assess their impact, and implement controls.
• Risk management controls encompass administrative, technical, and physical measures.
• Four risk assessment methodologies are mentioned: NIST SP 800-30, FRAP, OCTAVE, and FMEA.
• FMEA is a technique for analyzing potential failures by examining possible causes and their consequences.

Risk Management (Chapter 2)

• The main goals of risk analysis involve identifying assets, assigning values, identifying vulnerabilities and threats, quantifying the impact, and balancing risk with the cost of mitigation.
• Risk analysis should acknowledge uncertainty, impacting the confidence in findings.
• Automated risk analysis tools reduce manual work and estimate future losses.
• Risk management teams should include personnel from different organizational departments.
• Risk can be transferred, avoided, reduced, or accepted.
• Threats multiplied by vulnerability and asset values equal total risk; multiplying again by controls gap equals residual risk.
• Risk controls are categorised as administrative, technical, and physical.
• Control assessments evaluate controls' implementation correctness, effectiveness, and desired outcomes.
• Security controls are verified (did we implement correctly?) and validated (did we implement the right control?).
• Continuous risk monitoring is vital for identifying, assessing, and controlling risk.
• Change management addresses risks introduced by environmental changes.
• Continuous improvement in procedures and processes is crucial.
• Business Continuity Management (BCM) encompasses strategies for BCP and DRP (Disaster Recovery Plan).
• A BCP defines procedures for emergency responses, extended backups, and post-disaster recovery.
• A BCP should encompass the whole organization, prioritize critical applications, and require executive support.
• Threats can be natural, man-made, or technical and include business impact analysis (BIA).

Questions

• Risk management should address all identified risks.
• Risk mitigation should commence when the cost of the countermeasure does not exceed the asset value and potential loss.