Visual 3. 1 Lesson 3 Risk Assessment and Risk Mitigation

Visual 3. 2 Objective 4 n At the end of Lesson 3, you will be able to describe: –several approaches to risk assessment, –considerations in developing and selecting countermeasures, –the importance of the management decision, and –reasons why risk management is really an art instead of a science

Visual 3. 3 The Variable Nature of the Elements of Risk

Visual 3. 4 Risk is Commonplace

Visual 3. 5 Qualitative Data n Description of –qualities, –elements, or –ingredients of a variable This is not a nice day

Visual 3. 6 Quantitative Data n Allows the variable to be measured n Numerical values may be assigned based on measured observations Temp 75 F Humid 45% Bar 29.35" o

Visual 3. 7 Purpose of Risk Assessment (Bottom Line) n Permit managers to make reasoned decisions regarding risk to the organization’s mission

Visual 3. 8 Using Risk Management Terms - The Catcher at Risk

Visual 3. 9 Risk Assessment - Questions to Be Answered n What is the relationship of the system to the customer’s mission? n What are all of the undesirable events that could happen and affect the mission? n How could they happen? n Realistically, what are the chances of them happening? n Suppose such an event happens, how much damage could be done?

Visual Performing a Risk Assessment n Define the purpose of the assessment n Identify the product or system n Select assessment approach n Gather information n Develop attack scenarios n Estimate risk parameters n Produce assessment report

Visual Define the Purpose of the Assessment n What is the general situation? n What decisions are to be made as a result of the risk assessment? n Who will make the decisions?

Visual Identify and Bound the Product or System - Decide on Scope or Depth of Assessment

Visual Organize for the Assessment n Individual n Individuals n Group or team of individuals n Groups

Visual Define Relationships n How will individuals, groups, etc., work together performing the tasks of: –data collection –analysis –synthesis –conclusions –recommendations

Visual What do Analysts do? n Identify threats and their characteristics n Gather and exchange information n Develop attack scenarios –Confidentiality –Integrity –Availability n Postulate potential consequences –Impact on organization's mission n Estimate risk parameters

Visual Information Sources n Knowledge of Individual Members n Computer Emergency Response Team Coordination Center, etc. n Outside Experts n Systems Administrators, Manager, etc. n Users n Threat Assessments and other Reports

Visual Threat Characteristics Conditional Likelihood An Adversary Can Succeed Capability Motivation Willingness Likelihood of Attack (Given Capable) Likelihood of Success (Threat Value) (Given Attempted and Capable)

Visual Threat Sources n Nature - Historical n Unintentional human error - Historical n Technological failure - Historical n Adversarial - Threat Assessment

Visual Adversarial Threat Characteristics n Objectives - As opposed to ours n Intentions n Motivation to act n Willingness to accept risk n Willingness to accept cost n Technical capability n Resources

Visual Gather and Exchange Information n Define What the System Does n Define the Environment n Determine Data Sensitivity n Identify System Users n Identify vulnerabilities

Visual Gather Information n How does the system support the mission?

Visual Gather Information n Define the Environment

Visual Gather Information n Determine Data Sensitivity –including its value to an adversary and –value to the mission

Visual Gather Information n Identify System Users –and their need for the system and its information

Visual Gather Information n Identify Potential Vulnerabilities

Visual Develop Attack Scenarios n THREAT AGENTS - Adversarial - Adversarial - Nature - Nature - Human error - Human error - Technological failure - Technological failure n TARGETS - Confidentiality - Integrity - Availability - Others

Visual Avenues of Attack ConfidentialityIntegrityAvailability Network ConnectPublic Switch Public Power Application SWCommunicationsLocal Power FirewallUPS Remote Access Physical Access InsidersCryptoTEMPEST

Visual Determine Potential Consequences n Impact on information system, n resulting in impact on organization's mission

Visual Estimate Risk Parameters n Likelihood of Success –that a credible threat exists, –with capability to attack, and –the willingness and intention to do so n Consequences –the degree of damage resulting from an attack

Visual Assessing Risk CONSEQUENCECONSEQUENCECONSEQUENCECONSEQUENCE L I K E L I H O O D of SUCCESS

Visual Attack Scenario No. 1 Coalition Force IS U.S. Forces IS Coalition Force ISs heavily dependent upon Internet, few security features, lack procedural discipline.

Visual Estimate of Risk Attack Scenario #1 CONSEQUENCECONSEQUENCECONSEQUENCECONSEQUENCE LIKELIHOOD OF SUCCESS Y- X- LoMedHi Lo Med Hi o A-1

Visual o Estimate of Risk Attacks # 1 thru 8 CONSEQUENCECONSEQUENCECONSEQUENCECONSEQUENCE LIKELIHOOD OF SUCCESS Y- X- LoMedHi Lo Med Hi o A-1/3/4 o o o o o o A-5 A-2/7 A-6 A-8

Visual Rating Overlay LoMedHi Lo Med Hi HH HM M M M M L

Visual o Likelihood of Success Attack Scenario #1 CONSEQUENCECONSEQUENCECONSEQUENCECONSEQUENCE LIKELIHOOD OF SUCCESS Y- X- LoMedHi Lo Med Hi o A-1/3/4 o o o o o o A-5 A-2/7 A-6 A-8 HH HM M M M M L

Visual Risk Assessment Methodology n Aids Decision Makers n Promotes Discussion n Focus on Most Serious Problems n Early Identification of Risk n Highlights Recurring Problems n Aids Concurrent Engineering

Visual Risk Mitigation COUNTERMEASURE MGR RISK

Visual Countermeasure Considerations n What is the cost Vs. benefit? n Are we creating another vulnerability? n Are people involved? If so, will they participate? n How long is the countermeasure needed? n How long will the countermeasure be effective?

Visual Cost Vs.. Benefit n Cost in –dollars –time to implement –impact on operations Results

Visual The Catcher at Risk

Visual Risk Mitigation - At What Cost?

Visual Creating New Vulnerabilities n Law of unanticipated consequences New Vulnerability Risk Analyst

Visual People Considerations n Are people involved? Will they participate in the solution? COUNTERMEASURE USER

Visual Time Consideration n How long is the countermeasure needed?

Visual Time Consideration n How long will the countermeasure be effective?

Visual Risk Assessment Reality n Are we sure of the threat? n Have we identified all vulnerabilities? n Have we considered all possible attacks? n Is our estimate of consequence correct? n Is all of this art or science?

Visual Never Ending Cycle RISK ASSESSING MITIGATING