Risk Management a Case Study DATALAWS Information Technology Law Consultants Presented by F. F Akinsuyi (MSc, LLM)MBCS

Anatomy of a Risk Assessment UK Government Case study UK government services have gone online UK government services have gone online Personal and sensitive data being propagated and populated by government departments to provide these services Personal and sensitive data being propagated and populated by government departments to provide these services Online services targeted by hackers, fraudsters, espionage Online services targeted by hackers, fraudsters, espionage Old and new risks, threats and vulnerabilities threaten services Old and new risks, threats and vulnerabilities threaten services Departments need to identify and mitigate these risks Departments need to identify and mitigate these risks

Anatomy of Risk Management UK Case study UK government policy is that any government information system used to store, process or forward any official information must be accredited before use UK government policy is that any government information system used to store, process or forward any official information must be accredited before use Objective of accreditation is to show that all relevant risks to the system have been identified and will be managed by appropriate configuration, use, maintenance, evolution and disposal Objective of accreditation is to show that all relevant risks to the system have been identified and will be managed by appropriate configuration, use, maintenance, evolution and disposal RMADS methodology applied to government systems RMADS methodology applied to government systems

RMADS Documents and Process

RMADS Stages Determine the Business Impact Level of the information that is held on the information system to be accredited. (Most Important) Determine the Business Impact Level of the information that is held on the information system to be accredited. (Most Important) Impacts are assessed against confidentiality, integrity and availability Impacts are assessed against confidentiality, integrity and availability Depending on the findings of that, it may be sufficient to simply comply with ISO Depending on the findings of that, it may be sufficient to simply comply with ISO For higher levels of impact level, an RMADS is mandatory. For higher levels of impact level, an RMADS is mandatory.

Impact Samples Impacts measured against the government department and the data subject Impacts measured against the government department and the data subject Financial Loss due to Fraud Financial Loss due to Fraud Reputational Loss due to service not being available. Reputational Loss due to service not being available. Criminal Charges due to breach of Data Protection. Criminal Charges due to breach of Data Protection.

Business Impact Assessment Business Impact levels range from 0-8 Business Impact levels range from 0-8 Level 1 Trivial: No further actions taken Level 1 Trivial: No further actions taken Levels 2 and 3 Minor: No further actions taken Levels 2 and 3 Minor: No further actions taken Level 4: Significant: Some negative effects: Acceptable risks: actions may need to be taken Level 4: Significant: Some negative effects: Acceptable risks: actions may need to be taken Level 5: Significant: Significant negative effects: actions to be taken on case by case basis Level 5: Significant: Significant negative effects: actions to be taken on case by case basis Levels 6,7: Major risks need to be reduced or treated Levels 6,7: Major risks need to be reduced or treated Level 8: Catastrophic: Disastrous: Dealt with and reduced under all circumtances Level 8: Catastrophic: Disastrous: Dealt with and reduced under all circumtances

Business Impact Assessment Confidentiality Impact Level Markings Confidentiality Impact Level Markings For Confidentiality, the Impact Levels relate directly to protective markings: For Confidentiality, the Impact Levels relate directly to protective markings: Impact Levels 1 and 2 – PROTECT, Impact Levels 1 and 2 – PROTECT, Impact Level 3 – RESTRICTED, Impact Level 3 – RESTRICTED, Impact Level 4 – CONFIDENTIAL, Impact Level 4 – CONFIDENTIAL, Impact Level 5 – SECRET Impact Level 5 – SECRET Impact Level 6 - TOP SECRET Impact Level 6 - TOP SECRET

RMADS First Phase in developing an RMADS. First Phase in developing an RMADS. Conduct Standard 1 Technical Risk Assessment. Conduct Standard 1 Technical Risk Assessment. Catalogue the information system and generate a scope diagram. Catalogue the information system and generate a scope diagram. Verify minimum assumptions to ensure that the risk assessment is accurate. Verify minimum assumptions to ensure that the risk assessment is accurate. Perform Privacy Impact Assessment Perform Privacy Impact Assessment Perform threat assessment to produce a “Prioritised Risk Catalogue” that must be documented within the RMADS. Perform threat assessment to produce a “Prioritised Risk Catalogue” that must be documented within the RMADS.

Identify Threats Asset List: What the system is made of Asset List: What the system is made of Threat Sources: Where is the threat coming from Threat Sources: Where is the threat coming from Focus of Interest: The system being accredited Focus of Interest: The system being accredited Threat Actors: Principle parties involved in constituting the threat Threat Actors: Principle parties involved in constituting the threat

Asset List DataBase DataBase Application Application Development and Test Environments Development and Test Environments Desktop Desktop Government Offices Government Offices Inter connecting systems Inter connecting systems Data Centre Data Centre Third Party Location Third Party Location

Threat Source Samples Organised Crime Organised Crime Pressure Groups Pressure Groups Investigative Journalists Investigative Journalists Terrorist Organisations Terrorist Organisations

Threat Actor Samples Hacker: Altering website, Denial of service Hacker: Altering website, Denial of service Third Party: Inappropriate Access, Privacy Breach Third Party: Inappropriate Access, Privacy Breach Normal User: Accidental Data Loss Normal User: Accidental Data Loss Privileged User: Data Confidentiality Compromise Privileged User: Data Confidentiality Compromise Data Handler: Data Loss Data Handler: Data Loss

RMADS Second Part Create the RMADS Second Part Create the RMADS Perform an ISO Benchmarking Review to determine that there are suitable commercial countermeasures already in existence. Perform an ISO Benchmarking Review to determine that there are suitable commercial countermeasures already in existence. Develop the Security Case and Risk Treatment Plan to ensure that proposed solutions meet with the requirements of the organisation and their risk appetite. Develop the Security Case and Risk Treatment Plan to ensure that proposed solutions meet with the requirements of the organisation and their risk appetite.

ISO Benchmarking ISO Information Security Standard ISO Information Security Standard Covers: Security Policy, Security Organisation, Asset Classification, Personnel Security, Physical Security, Communications and Operations Management, Access Control, Systems Development and Maintenance, Business Continuity Management, Compliance Covers: Security Policy, Security Organisation, Asset Classification, Personnel Security, Physical Security, Communications and Operations Management, Access Control, Systems Development and Maintenance, Business Continuity Management, Compliance Benchmarking involves conducting face to face review with System Architects, Administrators, Security Teams to verify compliance with the areas above Benchmarking involves conducting face to face review with System Architects, Administrators, Security Teams to verify compliance with the areas above

Risk Treatment Plan Risk Treatment Plan identifies what steps will be taken to resolve identified risks Risk Treatment Plan identifies what steps will be taken to resolve identified risks It highlights who will be responsible for risk It highlights who will be responsible for risk Date for resolving risk Date for resolving risk Status Status

Penetration Test Network and Application tests Network and Application tests Round up to identify if there is any exposure to known vulnerabilities by conducting a penetration and application test. Round up to identify if there is any exposure to known vulnerabilities by conducting a penetration and application test. Review outcome Review outcome Accredit system Accredit system

Application Vulnerability Tests Cross Site Scripting Cross Site Scripting Failure to Restrict URL Access Failure to Restrict URL Access

End Of Session