Risk assessment - TSD Gard Thomassen, PhD USIT, UIO

When to think of risks ? Before design During design When redesigning Basicly – always Who is responsible for the risk evaluation – The Institution responsible for the data

System outline Gateway HPC - ColossusVM-server Storage Internet Secure encrypted network to special high volume data production sites 1 (project) 1 (storage area) n 1 Gard Thomassen,TSD 2.0

Doing risk assessment Three axis : – Data confidenciality (only those with access get access) – Data integrity (data manipulation, deletion) – Data accessibility (users get to data when they want from where they want) Level of detail – As easily read as possible, detailed where needed to describe neccessary functions

Risk evaluation method Define the level of security needed based on data handled Based on technical solution and risk brainstorming we listed all risk elements and evaluated them based on – probability (1 -> 4) – consequence (1 -> 4) Risks with sum (probability x consequene) – [1-4) : Accepted or underlaid some extra routine – [4-8) : Must be taken into account, can exist in a production environment for a short time and fixes have been planned – [8-16] : Unacceptable risk. Production stop, or compensated immideately by manual controls and routines that brings the level of risk down below 8. Risk evaluation details all risks > 3

Typical method would then be Brainstorm on all components and possible issues – Authentication – Authorization – Network / firewall – Virus / malware – Data import and export – Storage – HPC – Computers – Software / virtual machinges – Data harvesting

Who does risk assessment IT-security personell & System developers TSD has a “Change Advisory Board” Risk evaluation must be done when changes to the system effect the risk-assessment All users must be informed of there is a change in the risk asessment

When designing (secure) systems What are the laws and regulations for all involved parties Who are typical data owner Who are the stakeholders Where do we get the funding Who has the final decision autorithy

Thank you Questions ?