IT Security Management Basics

• Security requirements means organizations must ask themselves what assets need protection, how assets are threatened, and what actions can counter those threats.
• IT security management is determining security objectives and risk profiles, performing security risk assessments of assets, and selecting, implementing, and monitoring controls to mitigate risks.
• Assets are anything that holds value for an organization.
• Threats are potential causes of unwanted incidents that may harm a system or organization.
• Vulnerability is a weakness in an asset or group of assets exploitable by a threat.
• Risk is the potential of a given threat exploiting vulnerabilities of an asset group, causing loss or damage.
• Asset identification includes anything that needs protection, value to the organization's objectives, and can be tangible or intangible.
• Expertise from relevant areas should be drawn for identifying key assets.
• Identifying and interviewing personnel as well as referring to checklists in standards are good options.
• Threats can be natural occurrences or man-made from accidental mistakes to deliberate actions.
• Human attackers warrant consideration looking at motivation, capability, resources, probability of attack, and deterrence.
• Previous history of attacks should be considered.
• Identifying threats and risks to assets involve identifying potential causes of harm and how those events can occur.
• Threats hinder or prevent assets from providing appropriate levels of security services, like confidentiality, integrity, availability, accountability, authenticity, and reliability.
• Vulnerability identification identifies exploitable flaws or weaknesses in IT systems/processes, determining the applicability and significance of the threat.
• Risk creation is achieved by combining threats and vulnerabilities.
• Risk analysis specifies the likelihood of occurrence for each threat to an asset, considering existing controls.
• Management, operational, and technical processes all work to reduce exposure for organization to some risks.
• Consequence specification derives an overall risk rating for each threat, calculating risk as the probability of a threat occurring multiplied by the cost to the organization.
• Qualitative ratings rather than quantitative ratings are used, ultimately sorting resulting risks for treatment.
• Risk ratings are determined through likelihood assessment.
• Rare likelihood: events may occur only in exceptional circumstances and "unlucky’ circumstances.
• Unlikely likelihood: events could occur but are not expected with the current controls, circumstances, and recent events.
• Possible likelihood: an event might occur but just as likely as not, and is difficult to control due to external influences.
• Likely likelihood: events will probably occur and should not be surprising if they occur.
• Aimost certain likelihood: events are expected to occur in most circumstances or sooner.
• Determining consequence involves an assessment of impact for security breaches.
• Insignificant consequence: occurs as a result of a minor security breach in a single area; impacts are likely to last less than several days and requires only minor expenditure to rectify
• Minor consequence: a security breach in one or two areas; impact is likely to last less than a week, but can be dealt with at segment of project level without management intervention
• Moderate consequence: limited systematic (and possibly ongoing) security breaches with impact last for up to two weeks. It generally requires management intervention and have ongoing compliance costs
• Major consequence: ongoing systemic security breach. Impact will likely last 4-8 weeks and requires significant management, resources for compliance costs.
• Catastrophic consequence: major systemic security breach. Impact generally lasts for three months or more, requiring senior management intervention and compliance costs
• Doomsday: there are multiple instances of major security breaches. The impact cannot be determined and requires senior management to place the company under voluntary administation or other major restructuring.
• Determining Resultant Risk
• Consequences of risk can be categorized based on likelihood levels with impact rating of extreme needing detailed research and planning with regular reviews at executive/director level.
• High-level risks require management attention, but planning can be left to senior project/team leaders.
• Medium-level risks are capable of being managed with specific monitoring and response procedures, whereas low-level risks can be handled through routine procedures.
• Risk treatment and unavoidable expenses.
• High level: Forego all effort at reducing risk and accept losses
• Low level: Spare no expense to mitigate all possible risks regardless of their likelihood
• Tradeoff between combining the cost of losses and the effort expended to avoid the losses.

Risks Treatment Alternatives

• Risk acceptance involves acknowledging the risks.
• Risk avoidance involves avoiding the activity that leads to risk.
• Risk transfer involves insurance or outsourcing.
• Reduce consequence involves modifying uses of an asset to reduce risk impact.
• Reduce likelihood involves implementing suitable controls.

Risk Analysis Process

• Step 1: System Characterization
• System Boundary
• System Functions
• System and Data Criticality and Sensititivy
• Step 2: Threat Identification
• Threat Statement
• Step 3: Vulnerability Identification
• List of Potential Vulnerabilities
• Step 4: Control Analysis
• List of Current and Planned Controls
• Step 5: Likelihood Determination
• Likelihood Rating
• Step 6: Impact Analysis
• Impact Rating
• Step 7: Risk Determination
• Risks and Associated Risk Levels
• Step 8: Control Recommendations
• Recommended Controls
• Step 9: Resutls Documentation
• Risk Assesment Report