April 3-5, 2005Security Professionals Conference Ways to Fit Security Risk Management to Your Environment Using the OCTAVE Methodology Tailoring OCTAVE at CSUSB Dr. Javier Torner Information Security Officer Professor of Physics

April 3-5, 2005Security Professionals Conference Strategy for Information Risk Management University Information Risk Management Committee –Two individuals from each Division –Must be members of the Division Information Risk Assessment Group Division Information Risk Assessment Group –One or Two members from each Office/Department Risk Assessment Team Office/Department Risk Assessment Team

April 3-5, 2005Security Professionals Conference Effective Risk Management Requires: Risk Aware Culture Experience and Expertise Self Direction Systematic Process –OCTAVE, OCTAVE-S –STAR –etc

April 3-5, 2005Security Professionals Conference OCTAVE/-S Method A systematic method for risk assessment that involves –senior managers –operational area managers –staff –IT staff Defined with procedures, worksheets, information catalogs, and training

April 3-5, 2005Security Professionals Conference OCTAVE/-S Method OCTAVE is broken into the following three major phases: –Phase 1: Build Asset-Based Threat Profiles –Phase 2: Identify Infrastructure Vulnerabilities –Phase 3: Develop Security Strategy and Plans

April 3-5, 2005Security Professionals Conference OCTAVE vs. OCTAVE-S Main differences –OCTAVE-S designed for smaller organizations/departments –OCTAVE-S defines a more structured method for evaluating risks uses “fill-in-the-blank” as opposed to “essay” style –OCTAVE-S requires less security expertise in analysis team –OCTAVE-S requires smaller analysis team to have a full, or nearly full, understanding of the organization/department and what is important –OCTAVE-S is easier to start!

April 3-5, 2005Security Professionals Conference CSUSB Approach CSUSB pilot project used a “hybrid” OCTAVE Selected elements of OCTAVE for –Senior Management –Operational Area Managements Selected elements of OCTAVE-S for –IT-Staff –Staff

April 3-5, 2005Security Professionals Conference CSUSB Strategy for Risk Assessment Pilot Project Identify a few interested Offices/Departments in each division Set up Office/Departments Risk Assessment Teams Provide training in Risk Assessment –Office/Department Risk Assessment Teams –Division Information Risk Assessment Group Tailor Risk Assessment tools to meet the needs of each Department/Office –Tailoring OCTAVE & OCTAVE-S

April 3-5, 2005Security Professionals Conference CSUSB Strategy for Risk Assessment Objectives of the Pilot Identify critical assets Identify security requirements for each critical asset Identify threats for each critical asset Conduct organizational and operational vulnerability assessments Identify risks and impacts Develop and implement mitigation plans

April 3-5, 2005Security Professionals Conference CSUSB Strategy for Risk Assessment Results from the Pilot Office/Department Risk Assessments –Training in Risk Assessment took longer that expected – –Increased “Risk Aware Culture” –First tailored version of OCTAVE-S Catalog of Practices –Operational Practice Areas – worked very well –Strategic Practice Area – under revision

April 3-5, 2005Security Professionals Conference CSUSB Strategy for Risk Assessment Office/Department Risk Assessments –Produced good and effective mitigation plans –Issues associated with Strategic Practices – difficult to implement at this level Division Information Risk Assessments –In progress

April 3-5, 2005Security Professionals Conference Next Steps Finalized and gain approval of a university wide Risk Assessment Tool Obtain final approval for a campus wide implementation DO IT!!

April 3-5, 2005Security Professionals Conference References OCTAVE - Operationally Critical Threat, Asset, and Vulnerability Evaluation Educause – Internet 2 – Effective Security Practices Guide ISO/IEC – International Code of Practices for Information Security Management csrc.nist.gov/publications/secpubs/ otherpubs/reviso-faq.pdf

April 3-5, 2005Security Professionals Conference Contact Information Dr. Javier Torner Information Security Office – PL-520 California State University San Bernardino 5500 University Parkway San Bernardino, CA Telephone: (909)