Welcome CCERP 2016 rcreid@uwf.edu

Randy Reid, PhD, CISA, CISSP Security+, Network+, A+ Combining the Extended Risk Analysis Model and the Attack Response Model to Introduce Risk Analysis Randy Reid, PhD, CISA, CISSP Security+, Network+, A+ Department of Management and Management Information Systems University of West Florida Pensacola, Fla

Questions ? Not only encouraged but appreciated!

4 responses to an attack Avoidance: Apply safeguards Mitigation: Reduce the impact Transference: Transfer the risk Acceptance: Inform management of all of the possible impacts and accept the risk Adler, T. R., Leonard, J. G. and Nordgren, R. K. (1999) Improving Risk Management: Moving from Risk Elimination to Risk Avoidance, Information and Software Technology, 41, 29-34. Peltier, T. R. (2004). Risk analysis and risk management. The EDP Audit, Control, and Security Newsletter, 32. Zur Muehlen, M., and Ting-Yi Ho, D. (2005). Risk management in the BPM lifecycle. International Conference on Business Process Management. Springer Berlin Heidelberg. Whitman, M. E. and Mattord H. J. (2014). Management of Information Security, 4th Edition, Course Technologies.

Risk Methodologies Application Grid Low Impact High Impact Occurrence Seldom Accept the Risk (acceptance) Transfer the Risk (insurance) Often Apply Safeguards (avoidance) Reduce the Impact (mitigation)

Extended Risk Analysis Model Threats Vulnerabilities Risk Controls Insurance No Residual Risk Acceptable Finished Yes Reid, R. C. and Floyd, S. (2001). Extending the risk analysis model to include market insurance. Computers and Security, 20(4), 331-339.

Hurricane, Floods, Earthquake Origins and Sources of Threats   Source Natural Human Origin External Hurricane, Floods, Earthquake Hackers Internal Broken water pipe Sabotage

Area under the control of Management Extended Risk Analysis Model Threats Vulnerabilities Risk Area under the control of Management Controls Insurance No Residual Risk Acceptable Finished Yes Reid, R. C. and Floyd, S. (2001). Extending the risk analysis model to include market insurance. Computers and Security, 20(4), 331-339.

Extended Risk Analysis Model Avoidance: Apply safeguards Mitigation: Reduce the impact Transference: Transfer the risk Acceptance: Inform management of all of the possible impacts and accept the risk Threats Vulnerabilities avoidance Risk Controls Insurance mitigation transference No Residual Risk Acceptable Finished Yes acceptance

Structure of Cyber Insurance First-party insurance, which covers damage and costs directly incurred by the organization. Third-party insurance, the second group, covers the costs that are paid to other groups or individuals outside of the organization, including impacts on the customers and legal costs

Cyber Insurance Coverage Price per $1 Million by Industry Sector

Future of Cyber Insurance Currently 55 companies currently write cyber insurance policies 2 billion dollars per year in premiums European Union (EU), about 150 million in premiums has just passed additional privacy laws which will probably increase demand Asian markets are similar to EU so there is great potential there

Thank you for your time and attention Any further questions or comments please contact me rcreid@uwf.edu