HOW MUCH RISK IS ASSOCIATED WITH IT HYGIENE USING FAIR? Case Study Shared courtesy of RiskLens CONFIDENTIAL - FAIR INSTITUTE 2016

CONFIDENTIAL - FAIR INSTITUTE 2016 ANALYSIS SCOPING Understand how much risk is associated with IT hygiene RISK SCENARIO DESCRIPTION Internal systems including databases, servers and workstations ASSET(S) DESCRIPTION Confidentiality and Availability LOSS TYPE Malicious attack by cyber criminals, general hackers and internal privileged users Non-malicious incident by internal privileged users THREAT(S) DESCRIPTION CONFIDENTIAL - FAIR INSTITUTE 2016

ANALYSIS SCOPING Analysis Approach IT Hygiene Internal Threats (Malicious / Non-Malicious) External Threats (Malicious) Servers Confidentiality Events Availability Events included Databases Workstations CONFIDENTIAL - FAIR INSTITUTE 2016

CONFIDENTIAL - FAIR INSTITUTE 2016 ANALYSIS SCOPING Questions to Answer How much risk is associated with IT hygiene as a whole How much risk is associated with each asset type (server, database, workstation) How much risk is associated with confidentiality and availability What percentage of the overall risk is driven by the different actors CONFIDENTIAL - FAIR INSTITUTE 2016

ANNUALIZED REDUCTION IN LOSS EXPOSURE (RISK) ANALYSIS RESULTS RISK = Frequency x Magnitude of future loss. We express risk in terms of loss exposure. ANNUALIZED REDUCTION IN LOSS EXPOSURE (RISK) Analysis Minimum * Average Maximum * Current State $3.2M $14.5M $45.0M *Min represents the more probable 10th percentile of simulation results. *Max represents the more probable 90th percentile of simulation results. CONFIDENTIAL - FAIR INSTITUTE 2016

ANNUALIZED LOSS EXPOSURE (RISK) ANALYSIS RESULTS RISK = Frequency x Magnitude of future loss. We express risk in terms of loss exposure. ANNUALIZED LOSS EXPOSURE (RISK) 60% related to Confidentiality, 40% related to Availability CONFIDENTIAL - FAIR INSTITUTE 2016

CONFIDENTIAL - FAIR INSTITUTE 2016 ANALYSIS RESULTS Average Loss Exposure Concentrations of Risk Relevant Threats CONFIDENTIAL - FAIR INSTITUTE 2016

ANALYSIS LEVERAGED THE FAIR MODEL Risk Loss Event Frequency Loss Magnitude Threat Event Frequency Vulnerability Primary Loss Secondary Loss Contact Frequency Probability of Action Threat Capability Resistance Strength Loss Event Frequency Loss Magnitude CONFIDENTIAL - FAIR INSTITUTE 2016

Threat Event Frequency THE FAIR MODEL Risk Loss Event Frequency Loss Magnitude Threat Event Frequency Vulnerability Primary Loss Secondary Loss Contact Frequency Probability of Action Threat Capability Resistance Strength Loss Event Frequency Loss Magnitude CONFIDENTIAL - FAIR INSTITUTE 2016

ANALYSIS CONSIDERATIONS Configuration Management Consistency of authentication controls Consistency of access privileges Consistency of configuration standards Vulnerability Management Consistency or state of patch levels Additionally, estimated threat event frequency CONFIDENTIAL - FAIR INSTITUTE 2016

Threat Event Frequency THE FAIR MODEL Risk Loss Event Frequency Loss Magnitude Threat Event Frequency Vulnerability Primary Loss Secondary Loss Contact Frequency Probability of Action Threat Capability Resistance Strength Loss Event Frequency Loss Magnitude CONFIDENTIAL - FAIR INSTITUTE 2016

CONFIDENTIAL - FAIR INSTITUTE 2016 ANALYSIS INPUT Incident response Investigation PRIMARY LOSSES Notification / credit monitoring Regulatory notification Possible fines / judgments Customer service requests Potential litigation Loss of current/future customers (reputation) Card replacement SECONDARY LOSSES CONFIDENTIAL - FAIR INSTITUTE 2016

CONFIDENTIAL - FAIR INSTITUTE 2016 DECISION SUPPORT / ROI DATA LOSS CONSIDERATIONS Confidentiality Estimated the amount of data stored or processed across population of assets Availability Estimated the productivity costs associated with loss of system availability THE CIO/CISO WAS ABLE TO UNDERSTAND Where this top risk issue stands among other priorities Where the team should focus next This analysis will be revisited bi-annually to assess reductions of risk associated with IT hygiene and determine the value that the team is providing to the organization. CONFIDENTIAL - FAIR INSTITUTE 2016