SEC’s Cybersecurity Risk Alert Part 2 of 3 How-To: Assessing Cybersecurity Risk Thomas J. DeMayo, CISSP, CIPP, CEH, CPT, MCSE Director, IT Audit and Consulting - O’Connor Davies, LLP Timothy M. Simons, CPA, CFA, CIPM, CSCP, CFP Senior Managing Member – Focus 1 Associates LLC

© 2014 Advent Software, Inc. Advent Confidential Speakers Tom DeMayo, CISSP, CISA, CIPP, CEH, CPT, MCSE Director, IT Audit and Consulting Services - O’Connor Davies, LLP Tim Simons, CPA, CFA, CIPM, CSCP, CFP Senior Managing Member - Focus 1 Associates LLC Footer 2

© 2014 Advent Software, Inc. Advent Confidential Objectives Discuss how to perform a true cybersecurity risk assessment for your firm Learn how to develop and implement administrative, technical, and physical controls relevant to your firm’s risk exposure Establish a sound cybersecurity program based on applicable regulatory requirements and industry best practices 3

© 2014 Advent Software, Inc. Advent Confidential Fundamental Components of Risk Assessment Threats – Anything that can cause harm. Common Threat Sources Human - Events that are either enabled by or caused by human beings, such as unintentional acts (inadvertent data entry) or deliberate actions (network based attacks, malicious software upload, unauthorized access to confidential information). Natural - Floods, earthquakes, tornadoes, landslides, avalanches, electrical storms, and other such events. Environmental - Long-term power failure, pollution, chemicals, liquid leakage. 4

© 2014 Advent Software, Inc. Advent Confidential Fundamental Components of Risk Assessment Vulnerabilities – Any hardware, software or procedural weakness that can be exploited (i.e. taken advantage) by a threat. A Threat Vulnerability pair must exist in order to have RISK Risk – The probability of occurrence (likelihood) that a threat will take advantage of a vulnerability and the resulting business impact 5

© 2014 Advent Software, Inc. Advent Confidential Fundamental Components of Risk Assessment Types of Risk Assessments Qualitative – Relative measure of risk or asset value based on ranking or separation into descriptive categories such as low, medium, high Quantitative - the likelihood of occurrence of particular threats and the risks or loss associated with these particular threats are estimated and assessed according to predetermined measurement scales 6 Unless your business absolutely requires a Quantitative risk assessment, use a Qualitative approach.

© 2014 Advent Software, Inc. Advent Confidential Risk Ranking Definitions Unacceptable – Mitigation Required High – Cost Benefit Analysis Required Moderate – Possible Cost Analysis of Mitigation Low – No Analysis Required 7 When assigning values, trust your initial reaction

© 2014 Advent Software, Inc. Advent Confidential Risk Chart 8

© 2014 Advent Software, Inc. Advent Confidential Inherent Vs Residual Risk Inherent Risk – The risk associated with a threat and vulnerability pair in the absence of any controls (i.e. what is the risk posed if you don’t apply any controls) Residual Risk – The amount of risk that remains after the application of controls. 9 Understanding the Inherent Risk is key to understanding the extent of controls required to manage the Residual Risk..

© 2014 Advent Software, Inc. Advent Confidential Risk Treatment Accept - Knowingly accept the risk as it falls within the organization's "risk appetite", in other words management deem the risk acceptable, compared to the cost of improving controls to mitigate it; Reduce - Implement a suitable control or combination of controls to reduce (mitigate) the risk to a more acceptable level. Avoid - Do not undertake the associated business activity; Transfer – Shift the risk to another organization (e.g. through insurance or by contractual arrangements with a business partner) 10

© 2014 Advent Software, Inc. Advent Confidential Risk Management 11

© 2014 Advent Software, Inc. Advent Confidential Risk Areas to Consider 12

© 2014 Advent Software, Inc. Advent Confidential Risk Assessment Framework Industry recognized frameworks most commonly used include NIST SP rev1/sp800_30_r1.pdfhttp://csrc.nist.gov/publications/nistpubs/ rev1/sp800_30_r1.pdf OCTAVE services/octave/index.cfmhttp:// services/octave/index.cfm FAIR 13

© 2014 Advent Software, Inc. Advent Confidential Risk Assessment Framework Whatever methodology you choose, it should comprise of the following: Identify all critical information resources, including such things as servers, applications, data repositories, etc. Assign a value to those resources. Depending on the Organization’s risk assessment approach, this can be either a quantitative or qualitative value. Determine the threat and vulnerability pairs that exist to those resources. Determine the probability of occurrence and potential business impact of the corresponding threat vulnerability pair = Inherent Risk Value (risk value that exists if no controls are implemented) Identify the existing controls in place to reduce the inherent risk to an acceptable level = residual risk value 14 When mapping controls, consider both the design and operating effectiveness when determining the residual risk value.

© 2014 Advent Software, Inc. Advent Confidential Sample Modified Approach 15

© 2014 Advent Software, Inc. Advent Confidential Questions? Tom DeMayo, CISSP, CISA, CIPP, CEH, CPT, CHFI, MCSE Director, IT Audit and Consulting Services - O’Connor Davies, LLP Tim Simons, CPA, CFA, CIPM, CSCP, CFP Senior Managing Member - Focus 1 Associates LLC