IT Threat and Risk Assessment Overview June 6, 2014

Impact x Likelihood = Risk 2

Risk LIKELIHOOD IMPACT High Medium Low Seldom/ never Major Moderate Significant Minor Negligible http://museumsassn.bc.ca/wp-content/uploads/2013/07/BP-7-Risk-Management.pdf Based on BC Museums Best Practices Module – Risk Management, 2005 (modified) 3

Risk Assessment Threat > Impact x Likelihood = Risk > Safeguards > Residual Risk Threat: A potential act or event that could cause unauthorized access, modification, disclosure or destruction of information or IT assets. Residual Risk: The risk that remains after the implementation of recommended safeguards. Potential act or event that could cause loss Define IT security requirements Risk that remains after safeguards are implemented 4

Risk Assessment Risk assessment is a “business” exercise IT risk assessment is ideally part of the overall risk assessment of the project Risk assessment can scale Can be short and simple, or detailed and rigorous “Generic” risk assessments Can re-use assessment from similar project 5

Threat and Risk Assessment / Certification & Accreditation Steps Identify and Categorize Assets Threat and Risk Assessment Implement Certify Accredit Threat and Risk Assessment: The process of identifying and qualifying threats and risks to information and IT assets and of implementing or recommending safeguards to mitigate risks that are deemed unacceptable. Certification: To verify that the security requirements established for a particular system or service are met and that the controls and safeguards work as intended. Accreditation: To signify that management has authorized a system or service to operate and has accepted the residual risk of operating a system or service, based on the certification evidence. How critical? How sensitive? Identify safeguards, IT security requirements Implement safeguards Confirm whether safeguards are implemented Accept residual risk Project Team Project Team Project Team IT Security Coordinator Management 6

Risk Assessment Example 7

Sample Threat and Risk Assessment Worksheet Impact Likelihood Risk Safeguards Residual Risk Disk failure Major Common High Redundant disks; Backups Low Power supply failure Significant Unlikely Moderate Redundant power supplies Records misfiled Minor Employee training Non- sensitive information shared 8

Roll-out, tools and support Trial approach on a few projects Tools TRA worksheet and guide List of sample threats Integrate into regular project planning Prioritize based on sensitivity, criticality Decision records in Enterprise Assess as we go 9

Decision records in Enterprise 10

Discussion and feedback 11

References Management of Information Technology Security (MITS) Operational Security Standard: https://www.tbs-sct.gc.ca/pol/doc- eng.aspx?id=12328&section=text BC Museums Best Practices Module – Risk Management: http://museumsassn.bc.ca/wp- content/uploads/2013/07/BP-7-Risk- Management.pdf 12

Management Accountability Framework (MAF) 13