Risk Assessment and Management

Objective To enable an organisation mission accomplishment, by better securing the IT systems that store, process, or transmit organisational information enabling management to make well-informed risk management decisions to justify the expenditure (within the IT budget) assisting management in authorizing (or accrediting) the IT systems on the basis of the supporting documentation resulting from the performance of risk management.

Risk Assessment and Management What is Risk?

Risk is the degree to which any of the vulnerabilities can be exploited by the threats to result in loss or damage to the asset. This is called impact Examples:  Direct loss of money (cash or credit)  Breach of legislation  Loss of goodwill/reputation  Reduction of share value  Endangering staff or confidence  Loss of business opportunity  Reduction in operational efficiency/performance  Interruption of business activity

Risk is the net negative impact of the exercise of vulnerability, considering both the probability and the impact of occurrence

Risk and its Value Risk is a mathematical function of threats, vulnerabilities, their probability and the impact While the threats increase with more exposure of data/systems, vulnerabilities go up with complexity of the problem The value of the assets, if exploited determine the impact Thus, risk value is a product of the value of threat, value of vulnerability, probability value and the asset value

This is a method by which- Risks to your organisation are identified Cost of these risks are calculated. Costs of mitigating those risks are calculated A cost benefit analysis is performed Risk Assessment

This helps the management- To make informed decisions relating to the security of IT assets To ensure that the relevant controls are in place Depending on the size of the organisation, part of these controls will include extra-resourcing, i.e. a dedicated Information security officer. In a medium to large organisation, there should be a security officer to continue the design and deployment of the security programme. Risk Assessment

The first process in the risk management methodology. Made to determine the extent of the potential threat and the risk associated with an IT system throughout its SDLC. Helps to identify appropriate controls for reducing or eliminating risk during the risk mitigation process. Analyses the threats to an IT system, given the likely vulnerabilities and the controls in place Helps to determine the likelihood of a future adverse event

Risk Assessment The magnitude of harm that could be caused by a threat's exercise of vulnerability is known as Impact In the impact analysis, the merits and demerits of quantitative and qualitative assessments are considered We may adopt a qualitative assessment as it prioritises the risks and identifies areas for immediate improvement in addressing the vulnerabilities

Risk Management

Encompasses three processes Risk assessment Risk mitigation Risk evaluation & assessment. Risk management is the process that allows IT managers to balance the operational and economic costs of security to achieve gains in mission capability by protecting the IT systems and data that support their organisational mission.

Risk Management A well-structured risk management methodology, when used effectively, can help management identify appropriate controls for providing the mission-essential security capabilities Effective risk management must be totally integrated into the SDLC

Risk Management Process If effective, this becomes an important component of a successful IT security programme The process should not be treated primarily as a technical function carried out by the IT experts It should be treated as an essential management function Risk management is the process of identifying & assessing the risk and taking steps to reduce it to an acceptable level

Overall Risk Management Process Risk Increase Vulnerabilities Indicate Asset Values Threats Controls Reduce Increas e Security Needs Assets Impact on Organization Project against Exploit Expose Have Met by

Impact Assessment

The impact assessment may be made as- High: Exercise of the vulnerability may result in the highly costly loss of major tangible assets or resources significantly violate, harm, or impede an organisation's mission, reputation, or interest result in human death or serious injury

The impact assessment may be made as- Medium- Exercise of the vulnerability may result in the costly loss of tangible assets or resources violate, harm, or impede an organisation's mission, reputation, or interest result in human injury

The impact assessment may be made as- Low- Exercise of the vulnerability may result in the loss of some tangible assets or resources noticeably affect an organisation's mission, reputation, or interest.

Risk Determination

The final determination of mission risk is derived by- multiplying the ratings assigned for threat likelihood (e.g., probability) and threat impact using a matrix-table which shows how the overall risk ratings might be determined  based on inputs from the threat likelihood and threat impact categories. It is a 3 x 3 matrix of threat likelihood (High, Medium, and Low) and threat impact (High, Medium, and Low).

Risk-level Matrix Threat Likelihood Impact Low (10)Medium (50) High (100) High (1.0)Low 10 x 1.0=10 Medium 50 x 1.0=50 High 100 x1.0=100 Medium (0.5) Low 10 x 0.5=5 Medium 50 x 0.5=25 High 100 x 0.5=50 Low (0.1)Low 10 x 0.1=1 Low 50 x 0.1=5 Low 100 x 0.1=10

Using the matrix- the risk level can be identified as High, Medium or Low This in turn is a function of the likelihood and Impact This represents the degree or level of risk to which an IT system, facility, or procedure might be exposed if a given vulnerability is exercised. This also presents actions that senior management- the mission owners, must take for each risk level

From the matrix, the risk is considered- High: If an observation or finding is evaluated as a high risk, there is a strong need for corrective measures. An existing system may continue to operate, but a corrective action plan must be put in place as soon as possible. Medium: If an observation is rated as medium risk, corrective actions are needed and a plan must be developed to incorporate these actions within a reasonable period of time. Low: If an observation is described as low risk, the system's DM must determine whether corrective actions are still required or decide to accept the risk.