Risk Assessment = Risky Business

Pop Quiz: Which Presents a Greater Risk? The correct answer is “risk to what?” Also, Eliot is a fictional character, so the lion wins by default.

Risk Assessment “The process of identifying, estimating, and prioritizing risks to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system.”

What is risk? “A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.”

… in other words Risk Likelihood Impact

Where to assess risk? Scope is fundamental question: All assets or just some? Specific types of data (cardholder data, ePHI, etc.) Specific business units, processes, and workflows?

Threats vs Vulnerabilities Examples of Vulnerabilities Injection Attack Broken Authentication and Session Management Cross-Site Scripting (XSS) Broken Access Control Security Misconfiguration Examples of Threats Adversarial Discovery Adversarial Lateral Movement Execution of Adversary Code Data Collection Exfiltration of Data and Information Command and Control

What’s your process? Spreadsheets Tool specific to { healthcare | banking | etc. } GRC Suite Multiple tools

Risk Assessment Principles Don’t Repeat Yourself We like reusable pieces Convention over Configuration All assets of type x will likely have same threats, but maybe different risk score Defaults should be built to accommodate

Our Risk Assessment Process Based on Known Frameworks (PCI requirement) NIST 800-30 OCTAVE Allegro Utilize Universal Data Threats and Vulnerabilities are fed by MITRE, OWASP Controls map to frameworks (NIST 800-53, CIS Top 20) Threats, Controls, and Vulnerabilities are Universal

SynerComm Risk Assessment App Single Page App Universal Data Included Two phases Phase 1: SynerComm Audit Tool Phase 2: Self-hosted

SynerComm Risk Assessment Methodology Step 1: Establish Ranking Criteria Step 2: Determine Risk Assessment Scope Step 3: Identify Relevant Threats, Vulnerabilities, and Controls Step 4: Determine Initial Impact and Initial Risk Scores Step 5: Evaluate Control Effectiveness Step 6: Perform System and Zone Risk Assessment Step 7: Report on Risk

Step 1: Establish Ranking Criteria Consider commonly-used data types: ePHI cardholder data (CHD/PCI) PII financial data IP Data types may also include qualities: single-point of failure large data store mobile data

Step 2: Determine Risk Assessment Scope As we set scope, SynerComm will work with the client to collect three fundamental characteristics for each asset: Asset role Web server Database server Application server Firewall Removable media Data type System and zone association Grouping of assets based on common data type and/or business purpose

Step 3: Identify Relevant Threats, Vulnerabilities, and Controls SynerComm will leverage common threat information: MITRE Corporation (MITRE) Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK™) model Other threat events, such as non-adversarial threats SynerComm will evaluate vulnerabilities: NIST National Vulnerability Database (NVD) Common Weakness Enumeration (CWE) Open Web Application Security Project (OWASP) Top 10 SynerComm will identify control types to mitigate threat events: Center for Internet Security (CIS) Top 20 Critical Security Controls (CSC)

Step 4: Determine Initial Impact and Initial Risk Scores SynerComm assigns relevant threats, vulnerabilities, and control types based on asset role. The initial impact for a system or zone is the sum of the asset impact values for all assigned assets. SynerComm then uses the mean initial impact score of all systems as a baseline risk score for all systems in the risk assessment. The mean impact score becomes the highest risk threshold for risk values.

Step 5: Evaluate Control Effectiveness SynerComm uses the list of control types identified in Step 3 as a basis to begin collecting and evaluating client controls. SynerComm scores the control based on: the control implementation status (not implemented, out-of-date, partially implemented, fully implemented), documentation of the control (not documented, out-of-date, full documentation), control test performance (not tested, failed test, passed test), and control function (preventive, detective, corrective, or insurance).

Step 6: Perform System and Zone Risk Assessments SynerComm uses the controls evaluated in Step 5 to derive the residual risk score. SynerComm classifies the residual risk score into risk levels. SynerComm will consider any additional threats, vulnerabilities, or controls relevant to the in-scope assets.

THANK YOU (QUESTIONS?)