Chapter 14 Legal Issues Quantitative Risk Assessment

Risk Analysis, Incident Response, and Contingency Planning

• Risk management is an important tool which helps an organization understand the risks, vulnerabilities, and threats it faces daily, to strengthen its security posture.
• Organizations cannot meet information security goals or protect resources and data without understanding IT risks.
• Fundamental risk concepts are reviewed and how organizations use risk management to create contingency plans is explained

Contingency Planning

• Organizations must plan for various events, include all types of planning to ensure operation during interruptions, emergencies, or disasters, not limited to IT assets.
• Recent dramatic events like the September 11 attacks, power-grid failures, H1N1 flu outbreak, and California wildfires highlight the need for contingency plans.
• Contingency plans are holistic, covering the whole organization and its processes, identifying critical operations for business survival and recovery.
• These plans include IT resources and operations, as many organizations depend on IT for data storage and automated processes.
• Focusing on protecting and recovering IT assets is vital for contingency planning, especially for small organizations, as 43% of cyberattacks target them.
• Incident response (IR), disaster recovery (DR), and business continuity (BC) planning are discussed in relation to IT resources.
• Contingency planning's scope ranges from life safety to business continuity without electricity, focusing on IT resource security.
• Although each has different goals, contingency plans share the same foundation, requiring risk analysis to understand and protect IT resources.
• Organizations cannot create any contingency plans until it understands the risks to its IT resources.

Risk Management

• According to NIST, risk management is a complex, multifaceted activity requiring the involvement of the entire organization.
• Risk management identifies risks, ensures cost-effective responses, and supports business goals.
• One of the main goals of risk management is to protect the organization's bottom line, aligning information security practices with business objectives.
• Organizations use risk management to plan and prioritize its information security activities.
• A risk analysis of a database with customer data, for example, shows a vulnerability because system administrators share a single account with a weak password.
• The database is therefore open to attack which can compromise the confidentiality and availability of data.
• As part of its RM function, the organization reviews the potential impact of this risk and considers costs like customer notification, regulatory reporting, fines, lawsuits, and operational issues.
• Steps are taken to mitigate the risk by requiring system administrators to use individual accounts with multifactor authentication and properly backing up customer data.
• The RM process identifies risks, offers solutions, secures resources, and protects business operations and bottom line including:
  • Risk assessment to identify threats and vulnerabilities
  • Risk response with policies to respond to risks
  • Employee training on threats and vulnerabilities
  • Continuous monitoring to update policies and controls
• RM process and information form the basis for an organization's contingency plans, of which BC and DR are examples that respond to natural or man-made disasters through discovery during the RM process.

Risk Assessment Process

• Risk assessment identifies threats/vulnerabilities to IT resources, reviews probability of occurrence (realized risk), potential harm, and policies/controls to respond.
• Risk response reduces realized risk to an acceptable level, with the remaining risk known as residual risk.
• Risk assessment supports executive management in making informed decisions about information security controls.
• Without risk assessment, management cannot know if the controls and policies it implements are needed or cost effective.
• The steps in a risk assessment are:
  • Inventory the assets included in the assessment
  • Identify threats and vulnerabilities to those assets
  • Categorize likelihood of occurrence and potential loss
  • Document where controls are needed.
• An RA team should include people with different roles, from IT personnel to business personnel.
• RA team members must be objective and must avoid conflicts of interest.
• Consultants can help with objectivity and risk analysis expertise, but they need to learn business processes, IT systems, and respect culture quickly.
• Collecting information about assets and risks and reporting assessment results to executive management is the task of a RA team.
• An RA must be narrowly scoped, and focused, reviewed one component at a time, in order to be manageable.
• The RA teams should consider:
  • Personnel
  • Data
  • Hardware and software
  • Physical facilities
  • Business process workflows
  • Safeguarding controls
• IT resources need to know how vulnerabilities and threats might affect confidentiality, integrity, and availability.
• A vulnerability is a weakness or flaw in an IT system, while a threat is anything harmful.
• There are four broad categories of vulnerabilities:
  • People
  • Process
  • Facility
  • Technology
• While threats include:
  • Human
  • Natural
  • Technology and operational
  • Physical and envioronmental
• Threats are can be deliberate or accidental.
• To identify vulnerabilities, the team should review policies, procedures, industry guidelines, and use automated scanning.
• It isn't possible to identify every vulnerability, such as zero-day exploits because technology changes so rapidly.

Likelihood and Potential Loss

• The risk team determines how likely risk is and potential loss as quantitative or qualitative measure, depending on risk methodology.
• Quantitative analysis uses real numbers to calculate risk and potential loss, assigning real numbers to asset values and control costs.
• Quantitative provides monetary-based assessment, understanding both the costs of risk and controls, allowing to compare costs with recommended controls.
• Disadvantages:
  • It is difficult to administer
  • Assigning value to all the assets
• The exposure factor is the percentage of asset loss likely caused by an identified threat.
• Single loss expectancy, or SLE, = asset value x Exposure factor (the amount of money the organization loses if realized) is another factor
• ARO stands for "annual rate of occurrence": it refers to how many times a specific risk might occur during a 1-year time frame
• ALE, or Annualized loss expectancy, is the SLE multipled by the ARO
• Qualitative (subjective) Risk Analysis, in contract, uses scenarios and ratings systems to calculate risk and harm without assigning money value, rather descriptive categories.
• The advantages of this approach are:
  • Easy to use and does not require specialized financial knowledge.
• However
  • It is very subjective
  • Lacks real numbers
• Impact categories and likelihood help compare risks measured by:
  • Low - Events that are unlikely to happen within a year
  • Medium - Events that are that somewhat likely to happen within a year
  • High - Events that are likely to happen within a year
• The team will then need a way to correlate and compare risk for where to apply controls.

Document Needed Controls

• Document security controls by: reviewing assessment results, prioritizing by ALE and recommending controls.

Risk Assessment Methods

• Variety of RA processes and software are available from vendors. Examples include:
  • NIST "SP 800-30 Guide for Conducting Risk Assessments" (qualitative)
  • ISO 31010 "Risk Management – Risk Assessment Techniques"
  • MoR framework
  • Carnegie Mellon University's OCTAVE (qualitative and self-directed)
  • Thomas Peltier's FRAAP (based on ISO/IEC 27001)
  • Microsoft's "Security Risk Management Guide" (quantitative and qualitative elements)
• Executive management reviews report and uses it as part of information security governance, show due care and due diligence.

Risk Response

• Executive management must decide org's response: actions to reduce risk to acceptable level with the most appropriate and cost-effective controls and minimum impact.
• Risk avoidance applies controls or action to avoid particular risk completely.
• Example system owners can disable functions
• Risk mitigation applies to reduce a particular risk to acceptable level (residual risk).
• Example: use access controls to only trusted employees.
• Organizations can use risk transfer (insurance) to transfer the risk through cyberliability policies
• Organizations can implement risk acceptance and intentional do nothing for the potential risk.

Training Employees and Continuous Monitoring

• Employees should is included in the Risk Management process:
  • Often employees can contribute to organizational risk
  • Org policies direct employee behavior to reduce risk
  • Training keeps employees aware of security responsibilities
• Organizations must always maintain continuous monitoring of :
  • Information security risk.
  • Of the controls that are put into place
  • Executive management must be diligent reviewing risk because technology changes quickly

Three Types of Contingency Planning

• Conducting an RA forces organizations to plan for risks it accepts/cannot avoid by limiting financial loss from adverse events, minimizing service and process interruptions, and customer impact.
• The three main types of contingency plans are:
  • Incident response (IR) plans
  • Disaster recovery (DR) plans
  • Business continuity (BC) plans
• Organizations create these plans to respond to IT resources and business processes from an info secu perspective.
• Preserve human life with these plan in mind

Incident Response Planning

• This is where the organization's IR process reacts to IT attacks and help sure the org can recover from security incidents, continuing operations.
• Incident Response or Incident Handling describes actions to:
  • Detect information security incidents
  • Determine cause
  • Mitigate damages from incident
  • Recover

Defining an Incident

• Incidents describe the adversity in confidentiality, integrity, and availability of a organizations data.
• Organizations need to use acceptable use polices to help define usage of IT resources for employees.
• Important parts of IR include documentation, creating incident response teams that include different cross-department advisors such as:
  • Information security/ IT
  • Legal counsel
  • HR
  • Auditing

IR Plan Process

• The IR plan should outline:
  • Incident Triage
  • Investigation
  • Containment/Mitigation
  • Recovery
  • Review

Incident Triage

• Incident triage represents the first phase in the Incident Response process
  • This is where a potential incident is initially accessed
  • The primary handler makes sure that an adverse event meets the "incident designation"
  • There can be Operational Incident teams that include the previously listed departments

Operational Incident Roles

• Victim - of incident
• Attacker - the person who caused incident -Incident report- person how reports incident -Primary handler- Person who is in charge of coordinating the response to a particular incident

Classifications

• Incidents also sorted by threat or exploited vulnerability
• Organizations use incident categories based on NIST guidance. -Such as DHS's NCCIC (used by US CERT which all agencies must report)

Investigation

• This phase details what the incident, source, and the impact have on an organization.
• These handlers must always be fully documented, be kept on staff, in case of regulatory requirements.
• There should be internal policies and if it is deemed a crime, handlers need to follow good evidentiary practices to contact law enforcement.
• Incident response begins its containment/mitigation step as fast as possible but can range based on the incident.
• Damaged IT need to be repaired and not vulnerable to similar future events.

Disaster Recovery and Business Continuity Planning

• DR and BC plans assist an organization to respond to events that can make business operations collapse and can negatively affect critical business functions. Incident are less severe and easier to deal with than disasters.
• Natural and human caused threats can include earthquakes, sabotage, terrorists etc
• Organizations should measure to limit damaged caused by potential disasters.

DR and BC

• DR plans focus on an organization's recovery. Usually focusing on IT systems
• BC is an organization's operations during and after IT recovery

DR and BC TEAMS

• Consist of:
  • IT
  • Legal counsel
  • HR
  • Executive management
  • Physical security

DR/BC Plan Development

• Similar to Ra and IR planning, DR/BC planning consists of:
• BC Policy
• Business impact analysis
• Potential controls and threats
• Recovery Strategy
• Design and maintain the policy
• Analysis used to estimate business impact and help with decision.

Preventative Controls

• Consist of Fire suppression
  • Generator back up -Offsite backup -Data backup

Backup Site Options

-The organization needs a place with backups to move its operations to -Mirrored sites are fully operational, but most expensive -Hot- site, an operational backup that can become operational rather fast -Warm-site- a partial site with some things, such as electricity and network -Cold site- cheap as it is, but has nothing (no hardware or connectivity), can take weeks to establish -Employee environment where employee has backup so they can communicate -IT operation also needs back plan, vendors have contracts so they can retrieve equipment quickly.

• After, plans should be monitored for changes and personnel
• There should be plans to react to events that affect IT resources/businesses

Testing The Plan

Contingency plans can be conducted through tests

• A test can include things such as familiarizing work flows, emergency train and identidying deficiencies. Some testing tools can consist of -checklist test, walk-through test to help with employees. Simulation and full interruption test to see the effects of business activities.

Special Considerations

RM and contingency planning are good business that that help with planning of threats for the wellbeing of the business.

Compliance in Planning

• It is worth addressing that for many organizations, it may or may not be required by law.
• Under common law (reporting) the US does not require crimes they witness There are some instances where it may be required, such as child vulnerability in danger.

Public Relations

Organizations need to account for communication because communication can overload the system. In regional disasters for resources, there can be an impact. PR is a marketing to manage an org's image by: -Who is authorized to comment -content shared with the public -information shared with the public -How all this is shared if there are communication method unavalibility.

Test your knowledge of Quantitative Risk Assessment. Questions cover advantages, challenges, valuation, and the steps in performing a quantitative risk analysis. Assess your familiarity with exposure factors and decision-making related to security controls.