Risk in Business Continuity Management

Risk in Business Continuity Management

• Risk is a quantitative measure of potential damage from threats, vulnerabilities, or events affecting an organization's IT assets
• Risk exposure leads to potential losses
• Risk is a measure of the average loss expected from that exposure
• High risk warrants rapid deployment of specific information security controls

Assessing Risk

• Risk assessment considers three variables:
  • Strength of threat agent (incentive and capability)
  • Presence and severity of vulnerabilities
  • Potential impact on the business
• Likelihood of threat occurrence combines the strength of the threat agent and presence of vulnerabilities
• Overall risk approaches zero if any variable approaches zero
• Risk is the combination of threat likelihood and its impact (consequence)

Understanding Risk

• Risk is an ever-present factor that must be recognized, identified and understood
• Impact is covered in Business Impact Analysis (BIA)
• Risk Assessment (RA) and BIA are often intertwined

Definitions

• Risk management identifies risks, their impact, frequency and risk reduction measures
• Risk appetite represents the acceptable level of risk, affecting cash value, share price, and profit
• Hazards, threats, and risks are commonly used interchangeably
• An asset is something of value
• A hazard or threat is a theoretical exposure to danger
• Risk is a hazard or threat with assessed probability of occurring to a particular asset

Risk Assessment Justification

• Risk assessment is necessary for:
  • Protecting life, health, and safety
  • Fulfilling duty of care and corporate governance
  • Meeting legislative and compliance requirements
  • Ensuring public accountability
• The objective of risk assessment is to reduce risk as much as practically possible

Risk Assessment Process

• Identify threats at a conceptual level such as fire, flood, and power loss
• Examine the vulnerability of assets to identified threats
• Analyze the risk and develop countermeasures, considering vulnerability
• Cost justification measures are implemented after BIA completion, balancing cost vs. potential loss

Options for Risk Management

• Accept the risk by doing nothing
• Avoid the risk by developing an alternative plan
• Reduce the risk by implementing countermeasures like CCTV to deter thieves
• Contain the risk by minimizing impact using multiple backup servers
• Transfer the risk via outsourcing or insurance
• Residual risk will always remain
• An acceptable level of risk and possible losses must be defined

Threat Examples

• Examples of natural disasters include fire, flood, and earthquakes
• Health and human resource issues involve industrial actions and loss of key staff
• Operational and man-made disasters include equipment failure
• Technology and infrastructure failure involves software, hardware, and network issues
• Supply failures may be service level related
• Business and compliance failures include legal breaches
• External threats can be recession or terrorist activity
• Financial threats may include cashflow problems
• Fraud is a possible threat

Challenges of Measuring Risks

• Measuring risks in monetary value can be difficult
• Asset valuation including data, in-house software (no market value), goodwill, and customer confidence, is challenging
• Likelihood of future threats is hard to predict because:
  • The relevance of past data is questionable
  • Future attacks are unpredictable
  • Actions of future attackers are hard to determine
• Measuring the benefit from security measures is difficult when assessing the effect on probability of attack

Corporate IT Assets

• Corporate IT assets encompass:
  • Desktops, PCs, laptops
  • Mobile devices, wireless networks
  • Application, mail, and web servers
  • Databases, corporate data
  • Network elements
  • PBXs, IP-PBXs, VRUs, ACDs, voicemail systems
  • Mobility support systems
  • Power sources
  • Remote/branch location systems
  • Key business processes

Loss Areas

• Primary business and financial liabilities result from lapses in:
  • Confidentiality: protection of sensitive information
  • Integrity: information, assets, and IT controls
  • Availability: IT services
• Top business liabilities include:
  • Loss/theft of customer data
  • Business disruptions from IT failures
  • Loss of integrity for critical IT assets and information

Risk Management Needs

• Any organization is suitable for Risk Management if they:
  • Has IT assets/data/proprietary information
  • Keeps customer information
  • Requires formal documentation
  • Adheres to legal/fiduciary requirements

Impact of Risk Management

• Risk management is vital, despite being not well understood
• Businesses on average:
  • Incur incidents daily
  • Have 58% chance of major incident yearly
• Implementing risk management can:
  • Reduce information risk exposure
  • Decrease major incident chances
  • Save funds by reducing risk
• Controls decrease minor incidents, with fewer resulting inefficiencies

Roles in Risk Management

• Management, users, and IT must collaborate. Roles include:
  • Asset owners developing inventory lists
  • Users/experts identifying threats/vulnerabilities and likelihoods
  • Risk management experts guiding risk assessment
  • Security experts selecting controls
  • Management reviewing risk management and approving controls

Risk Management Processes

• Risk Identification consists of identifying threats, vulnerabilities, and events to IT assets
• Risk Assessment considers calculating potential damage/cost
• Risk Mitigation Planning involves controlling and mitigating IT risks through cost-benefit analysis
• Risk Mitigation Implementation consists of deploying identified solutions
• Evaluation of Mitigation's Effectiveness is monitoring the environment, and determining if new modifications result in different threats/vulnerabilities

Risk Identification Details

• Risk identification involves identifying threats, vulnerabilities, or events to IT assets
• Risk identification begins with identifying organization's assets and assessing their value
• Assets are targets of threat agents
• Risk management identifies organization's assets and incidents exploited by threat agents

Asset Identification, Valuation, and Prioritization

• Asset identification, valuation, and prioritization is an iterative process
• Begins with identifying all elements of system
• Assets include people, procedures, data, software, hardware, and networks
• Assets classified and categorized

Asset Valuation Questions

• To determine which information asset to protect:
  • What is most critical to organization's success?
  • What generates most revenue/profitability?
  • What is most expensive to replace or protect?
  • What would be most embarrassing or cause greatest liability if revealed?

Asset Prioritization

• Create weighting for each category
• Calculate each asset by weighted factor analysis
• List assets in order of importance

Data Classification and Management

• Various classification schemes are used by corporate and military organizations
• Information owners classify assets
• Conduct periodic reviews of classifications
• Most organizations don't need detailed classifications used by the military
• Classify data to provide protection

Threat Modeling Approaches

• Attacker-centric: starts from attackers, their goals and evaluating how they might achieve them.
• System-centric: starts from system model to follow logic with the intent to discover attacks against various model elements.
• Asset-centric: starts from assets trusting a system with identifying security breaches of CIA properties

Incident/Threat Identification Questions

• Is the incident realistic?
• Should other incidents be set aside?
• Questions for identification
  • Which incidents/threats can affect assets?
  • What represents the most danger?
  • How much to recover from attack? -Which incidents/ threat are most expensive to prevent?

Vulnerability Identification

• Vulnerabilities are avenues threat agents exploit to attack an information asset
• Examine organizations assets and vulnerabilities
  • Assess how each incident or threat could be perpetrated
• Utilize personnel for diverse perspectives to work in iterations
• Achieve a final list of assets and their vulnerabilities

Risk Estimation Types

• Qualitative: descriptive scales (ex: minor, moderate and catastrophic)
• Semi-quantitative: assigns numerical values to qualitative scales
• Quantitative: numerical values for consequence and likelihood

Risk Handling Decisions

• Risk is only unacceptable if the following apply to a viable threat
  • the system is designed to be vulnerable
  • the system is exploitable
  • the vulnerability exists
  • the attacker has more to gain than the cost of the system

Ranked Vulnerability Risk Worksheet Contents

• Worksheet details:
  • Asset
  • Asset impact
  • Vulnerability
  • Vulnerability likelihood
  • Risk-rating factor

Risk Control Strategies

 1. Reduce/mitigate risk
 2. Transfer risk
 3. Retain risk
 4. Avoid risk

Risk Treatment Based On

- the extent of risk reduction
- any additional benefits obtained

High risk levels may be acceptable if beneficial opportunities arise as a result of taking the risk Balance cost of implementing treatment option and benefits derived (proportionality principle) Large risk reductions for low expenditure should be implemented