Taking Information Security Risk Management Beyond Smoke ...
29
Insert presenter logo here on slide master. See hidden slide 4 for directions Session ID: Session Classification: Evan Wheeler Omgeo Taking Information Security Risk Management Beyond Smoke & Mirrors GRC-107 Intermediate
Transcript of Taking Information Security Risk Management Beyond Smoke ...
Insert presenter logo here on slide master. See hidden
slide 4 for directions
Session ID:Session Classification:
Evan WheelerOmgeo
Taking Information Security Risk Management Beyond Smoke &
Mirrors
GRC-107Intermediate
Session Agenda
Designing a Risk Program
Prerequisites for a Risk Management Program
Program Roadmap
2Image Available at: www.riskczar.com
Insert presenter logo here on slide master. See hidden
slide 4 for directions
Designing a Risk Program
3
Common Perception of Risk Management
Program Goals
Empower Business Units to Identify & Remediate RisksHelp Prioritize Remediation TasksEducate the Organization Regarding Real Threats & WeaknessesIncrease Visibility and Capability to Track RisksImprove the Consistency of Risk Assessment Approaches
5
Program Goals
Empower Business Units to Identify & Remediate RisksHelp Prioritize Remediation TasksEducate the Organization Regarding Real Threats & WeaknessesIncrease Visibility and Capability to Track RisksImprove the Consistency of Risk Assessment Approaches
6
Program Lifecycle
7Image Available at: www.ossie-group.org
Phase 1 - Risk IdentificationSecurity Risk ProfilesCompliance to Standards ReviewVendor Due Diligence ReviewThreat & Vulnerability AdvisoriesCertification & AccreditationSecurity Scanning / Penetration Testing
Phase 2 - Risk ResponsePolicy Exception / Risk Acceptance ProcessMitigation Plan Approval & Tracking ProcessRisk Reporting Process
Phase 3 - Risk MonitoringRisk Register / InventoryRe-Assessment ScheduleSecurity Event MonitoringIncident Response & TrackingIndependent Audit ProgramKey Risk Indicators ReportingRisk Training & Awareness Program
Resource Profiling
Identify critical assetsRate their importance or impact to the organization, and relative to each otherStart with a basic scale (L, M, H)Application, System, or Environment
8
Looking at the Internal Gaps
9Image Available at: www.ossie-group.org
Not an Audit
10
E-Commerce siteCurrent Password Lockout Policy:
3 attempts before lockoutUnlock requires administrator
Proposed change:5 attempts before lockoutAutomatic unlock after 15 minutes
Going External
Security Risk ProfileArchitectural ReviewQuestionnaire
Common FormatTailored by Risk ProfileLinked to Internal Policies/Standards
On-Site ReviewExample: FedRAMPSecurity Controls list
11Reference SIG at: www.sharedassessments.orgReference FedRAMP at: www.fedramp.gov
Vendor Review Schedule Example
12
Vendor/Service Risk Sensitivity
Last Assessment
Date
Risks Discovered in Last Assessment
(400 Questions)
Next Assessment
Date
Vendor A High SIG Detailed
11/23/2010
Critical: 0
High: 0
Moderate: 15
Low: 4
SIG Level 2
12/01/2012
Vendor B High SIG Detailed
2/17/2010
Critical: 1
High: 5
Moderate: 43
Low: 12
SIG Detailed
03/01/2011
Vendor C Moderate SIG Level 1
8/11/2009
Critical: 0
High: 11
Moderate: 61
Low: 7
SIG Level 1
09/01/2011
Threat & Vulnerability Management
Risk IdentificationSecurity ScanningPenetration Testing
Risk ResponseRemediation SLAPresenting to Metrics to Management
Risk MonitoringMonitor AdvisoriesScanning & Testing Schedule
13
Filtering is Your Friend
14
- 50% - 20% - 62%
Only ~ 15% of findings deserve to be addressed the first time through
Oversight & Tracking
15Image Available at: www.ossie-group.org
Steal What’s Out There
NISTHigh-level approach evolved into C&A solutionComprehensive lifecycleAutomated implementations are successful
OCTAVE AllegroDetailed worksheets & questionnairesBest suited for projects and one-time assessments
FAIRDetailed quantitative and probabilistic methodMay be overwhelming for novices without integration into a tool
16
Insert presenter logo here on slide master. See hidden
slide 4 for directions
Prerequisites for a Risk Management Program
17
Program Prerequisites
Security Policies, Standards and Baselines Information Resources Inventory Common Risk FormulaEnterprise Risk CommitteeMapping of Risk Domains to Business Objectives
18www.sans.org/security-training/course_sums/1467.pdf
Sensitivity-Based Risk ModelSensitivity – a value relative to the resource’s tolerance for riskSeverity – measures the degree of impact of the threat/vulnerability pairLikelihood – measures the probability of the threat/vulnerability pair
Exposure = (Sensitivity x Severity) x LikelihoodLOW MODERATE HIGH CRITICAL
Self-AssessmentCalculate the Annual Loss Exposure (ALE) given the following details:
Each laptop in your company costs $1,000 to replaceBased on your asset tracking records, you have estimated 1 laptop gets stolen every 2 yearsThere is no other value associated with these laptops
Based on this scenario, what is the ALE for this risk?
Applying the Textbook Risk ApproachNow try to calculate the ALE of these scenarios:
1. Backup tapes with sensitive data are transferred to an offsite storage facility in the back of an intern’s car once per week, and all data is in cleartext
2. All Internet links are serviced by a single ISP
3. Multiple vulnerabilities in Adobe Reader 9 and Acrobat 9 could allow remote attackers to crash the application or potentially control affected systems.
The Big PictureEnterprise Risk Committee(s)
Looks at risks across the entire organizationInformation Security is just one memberFocus on only the highest level risksOften systemic or thematic risks are highlightedFormal escalation criteria
Other GovernancePolicy Review CommitteeChange Approval BoardAudit Committee
Present Consequences, Not Vulnerabilities
Risk Domains & AreasRisk Area Assessments
Potential for exposure of sensitive informationPotential for failure of a legal/regulatory obligationPotential for failure of a key process or service
Risk RegisterFindings & Incidents
Individual VulnerabilitiesEvents and Incidents
23
Strategic
Tactical
Potential Single Points of Failure
May Extend a Service Outage after a Failure
Insert presenter logo here on slide master. See hidden
slide 4 for directions
Program Roadmap
24
Essential Steps
1. Select a standard/baseline2. Establish an asset
inventory3. Define your risk scales4. Profile your environments
(sensitivity)5. Define a workflow for
assessing vulnerabilities
25
Pitfalls to Avoid
1. Don't run a security scan of the entire environment...
2. Don't try to identify and profile every system …
3. Don't try to build a comprehensive risk model that will account for every possible scenario and special case imaginable…
4. Don't take on large scale assessments until you have proven your methodology …
26
27
Lessons LearnedStart smallStart with industry scales and ratings before developing your ownFocus on oversight, security can’t fix everythingTie security initiatives to business objectives
Image Available at: www.riskczar.com
Additional ResourcesSecurity Risk Management: Building an Information Security Risk Management Program from the Ground Up
ISBN: 9781597496155Publisher: SyngressPublication Date: May 2011Amazon Link: http://amzn.to/hyrMvC
MGT 442: Information Security Risk Management
2 day courseAvailable On Demand & Conference
