Risk Assessment & Management

What is Risk?

• In computer security, risk can be equated to potential monetary loss
• This can include; computer vulnerabilities, potential dangers, hardware and software failures, wasted man hours and downtime

Risk Assessments

• Computers form an indispensable part of organizations
• Managing vulnerabilities is vital to managing risks for organizations
• Computer security represents a risky business

Risk Management

• Can be defined as identification, assessment, and prioritization of risks and the mitigation and monitoring of the same
• Organizations employ four general strategies when managing a particular risk:
  • Transfer: Transferring risk to another organization or third party
    • It is possible to transfer some risk to a third party by purchasing insurance, for example covering a group of servers in a data centre
    • The organization still risks losing data if failure, theft, or disaster occurs, but transfers the financial risk if the servers are lost
  • Avoid: Avoiding potential risks altogether
    • Some organizations may decide not to carry out a proposed plan because the risk factor is too great
    • A high-profile organization could decide not to implement a new and controversial web service
  • Reduce: Act to reduce risk
    • Mitigating risks as much as possible, eliminate of all risks are not possible
    • Usually, budgeting and IT resources dictate the level of risk reduction
    • For example, a risk mitigation strategy could be to install antivirus software on every client computer. However, hardware-based firewalls are an expensive risk mitigation alternative
  • Accept: Accepting some or all the consequences of a risk
    • Most organizations are willing to accept certain levels of risk
    • Some vulnerabilities are too expensive to patch

Risk Assessment

• Risk assessment determines the number of threats and the amount of time to your computers and networks and digital assets

Risk Assessment steps

• Identify the organization’s assets
• Identify vulnerabilities
• Identify threats and their likelihood
• Identify the potential monetary impact
• Documentation

Risk assessment methods

• The two most common risk assessment methods are qualitative and quantitative

Qualitative Risk Assessments

• Qualitative risk assessments use judgement to categorize risks based on the likelihood of occurrence and impact
• The likelihood of occurrence is the probability that an event will occur, usually annually
• Impact is the magnitude of arm resulting from a risk, including the negative results of an events, for example; loss of confidentiality, integrity or availability
• Unlike its counterpart quantitative risk assessment, it does not assign monetary values to assets or possible losses.
• Represents the easier, quicker, and cheaper way to asses risk
• Cannot provide a total for possible monetary loss.

Quantitative Risk Assessments

• Quantitative does measure risk using monetary amounts
• Allows easier prioritization of risks:
  • A risk with a potential loss of £30,000 is much more important than a risk with a potential loss of £1,000
• Attempts to give an expected yearly loss in GBP, also included assessment of asset values

Quantitative Risk Assessment Values

• Three values are used when making quantitative risk calculations:
  • Single Loss Expectancy (SLE): Value in GBP based on a single incident
  • Annualized Rate of Occurrence (ARO): Represents the number of times an incident occurs per year
  • Annualized Loss Expectancy (ALE): The total loss in GBP per year due to a specific incident. The calculation is: ALE = SLE * ARO

Documentation

• The final phase of the risk assessment represents report preparation
• Report identifies the risks discovered and recommended controls
  • SQL injection attacks can be discovered in database enabled web applications
  • Rewriting the web application to protect the database, using input validation techniques or stored procedures, is recommended

Example 1: Risk Assessment

• Average cost of a laptop is $2000, inc hardware, software and data and employees lose one laptop per month on average
• Hardware locks are purchased to secure laptops for a total of $1000
• The value of each laptop is 2000,thereforeSLE=2000, therefore SLE = 2000,thereforeSLE=2000
• ARO - employees lose roughly 1 laptop a month = 12 per year
• Annual Loss Expectancy (ALE) = SLE x ARO = 2000x12=2000 x 12 = 2000x12=24000
• Security experts believe locks will reduce stolen laptops down from 12 to 2 per year
• New ALE of $4000
• Original ALE = $24,000
• = $20,000 saving a year
• Orgainistaion spent 1000tocreateoverallsavingof1000 to create overall saving of 1000tocreateoverallsavingof20000

Example 2: Risk Assessment

• The e-commerce web server fails 7 times a year (ARO = 7)
• Average downtime of each failure = 45 minutes
• The website processes an average of 10 orders every minute and revenue of $35 per order
• $350 of revenue is generated per minute
• One downtime = 15750(45outageminutesx15750 (45 outage minutes x 15750(45outageminutesx350)
• SLE is $15750 (the loss from single occurence)
• ALE = SLE x ARO - 15750x7=15750 x 7 = 15750x7=110,250 (the ALE)

Security Analysis Methodologies

• Analyse the security of assets to assess risk, including computers, servers (HW), software (SW), network devices, and data
• Develop and maintain vulnerabilities list
• Security analyst monitors the list for any exploitation and takes necessary actions

Security Analysis Types

• Analysis can be done in one of two ways:
  • Active Security Analysis
    • Tests are run on the system in question
    • Can affect the normal operation of systems that can cause loss in productivity
    • Examples;
      • Active Scanning: Identify open ports and hosts
      • Denial of Service (DoS) testing.
      • Penetration testing.
  • Passive security analysis
    • Servers, devices, and networks are not affected
    • Could be as simple as checking documentation (configurations, policies)
      • For example, checking and organization's documentation to find if there is a firewall in place
      • A missing firewall = security vunerability

Security Controls

• Three basic security controls:
  • Preventative controls: controls employed before an event, preventing an incident:
    • Example: Biometrics preventing unauthorized access to a data center or RAID 1 to prevent data loss
  • Detective controls: the controls are used during an event and can find out whether malicious activity are occurring or have occurred.
    • Example: CCTV/video surveillance, alarms, IDS, auditing
  • Corrective controls: the used after an event: limit the extent of damage and help the company recover from the damage quickly
    • Example: Tape backup, hot sites, and other fault-tolerence methods

Vulnerability Management

• Vulnerability management is the practice of finding and mitigating vulnerabilities in computers and networks.
• It consists of analyzing network documentation, testing computers and networks with a variety of security tools, and taking action to mitigate vulnerabilities

Steps for vulnerability management

• Define desired state of security: Establish policies identifying desired state of security (e.g security check lists, device configurations etc..)
• Create baselines: Assess current security state of computers, servers, network devices, and network in general. Also known as vulnerability assessments
• Prioritize vulnerabilities: Which vulnerabilities should take precedence? For example, an SQL injection attack on an e-commerce web site has higher priority than other types of attacks
• Mitigate vulnerabilities: Go through the prioritized list and mitigate as many of the vulnerabilities as possible. Depends on organisation level of risk acceptance
• Monitor the environment: monitor the environment after mitigation actions, and compare results to initial baseline. Vulnerability management is an iterative process

Penetration Testing

• Penetration tests evaluate the security of a system by simulating real-world attacks.
• Regular vulnerability scanning may be passive or active, and active penetration testing will be active
• Tests are designed to determine the impact of a threat against the target organization.

Penetration Testing (Pen Testing) Types

• Black-box: the tester has little or no knowledge of the computer, infrastructure, or environment. This simulates external actors unfamiliar with systems
• White-box: the tester has complete knowledge of the computer, user credentials, infrastructure, or environment; this aims to test internal actor threats

Assessing vulnerability

• There are multiple tools and software that facilitate discovering vunerabilities and performing risk assessments. Tools include:
  • Network Mapping
  • Vulnerability Scanning
  • Network Sniffing
  • Password Analysis

Network Mapping

• Provides a study of the physical and logical network connections
• Network mapping is a comprehensive documentation of network configurations
• Network Topology Mapper by SolarWinds scans your computer network and generates a map for your entire network infrastructure.

Vulnerability Scanning

• Technique that finds threats without exploiting them
• Some examples include:
  • Full vulnerability scanner such as Nessus
  • Simple port scanner such as Nmap

Network Sniffing

• Enables you to identify all traffic passing a network
• AKA protocol analysers
• Provides more detail than vulnerability or port scanners
• Involves capturing frames from the network adapter and displaying packets with a capture window
• Wireshark is an example

Password Analysis

• Passwords are often the weakest link in the chain
• Enforcing policies for password complexity is a wise idea in combination with scanning network devices and computers for weak and vulnerable passwords utilizing password cracking tools.

Password cracking methods

• Guessing is an educated guess based on the most common passwords.
• Dictionary Attack uses a prearranged list of sensible words, trying each of them one at a time.
• Brute-force Attack involves trying every single combination of every single character.
• Cryptanalysis Attack implements a considerable set of precalculated encrypted passwords located in a lookup table.