CST 481/598 Many thanks to Jeni Li

 Risk matrix or cube  Cost effectiveness analysis  Annualized Loss Expectancy  Multi-Attribute Risk Assessment  Monte Carlo analysis  … et cetera

 Vulnerability  Threat  Impact

 Cost of recovering lost or modified data  Business value of unrecoverable data  Lost productivity due to down time  Replacement cost of physical assets  Fines and penalties  For unauthorized disclosures or posting inaccurate information  Damage compensation to compromised customers  Fines imposed by regulatory agencies  Damage to reputation

 (more or less)  Asset identification and valuation  Threat/vulnerability assessment  Risk calculation  Countermeasure selection

 From Jones/Ashenden text  R = V x T x I  Useful for visuals and comparisons  Not much else

 Combines soft and hard numbers  Can use estimates or probability tables  Examples: ROSI, CRAMM

 ALE = SLE x ARO  SLE: Single Loss Expectancy  How much will it cost if it happens once?  ARO: Annualized Rate of Occurrence  How many times a year will it happen?  Actual losses will vary, of course  Poisson distribution, Monte Carlo analysis

 Used to introduce “controlled randomness”  Goal: Make estimates more realistic  Often used with ALE models  Used in latest version of ROSI  Many algorithms exist  Some information for the interested  d d

 Origin: UK government  Commercial software (cramm.com)  Used by UK, NATO, Dutch military, T-Mobile  Used for ISO compliance  Can be used to justify cost of controls  Based on statistical analysis of other agencies  Detailed departmental questionnaires  Or informed estimates (Express version)  Database of controls  Pre-assigned effectiveness, cost/benefit values

 Origin and user: AU government  Freely available   Based on Annualized Loss Expectancy and Australian Threat/Risk Assessment  User-assigned values for TRA descriptions

 Origin: Carnegie-Mellon University   Based on Multi-Attribute Risk Assessment  Categorizes attributes of impact  Revenue, Reputation, Productivity, Penalties  Likelihood, impact ratings based on industry peer review  Emphasizes coverage of threats  Protect, Detect, React  Doesn’t quantify risk financially

 Avoidance  Reduction  Retention  Transfer

 Avoidance  Reduction  Retention  Transfer

 Get out of (or don’t get into) the risky business  Do this when…  Probability of a loss is high  Potential impact is high  Gain from continuing the function is low

 Protect, detect, react  This is what we usually think of in IS  Do this when…  Probability of a loss is high  Potential impact is low

 Protect  Prevent the threat from meeting with the vulnerability  Detect  Discover and respond to a threat before it causes too much damage  React (Recover)  Minimize impact after an incident

 “Cost of doing business”  Live with it when…  Probability of a loss is low  Potential impact is low  Gain from continuing the function is high

 Common methods  Buy insurance  Outsource the risky function  Do this when…  Probability of a loss is low  Potential impact is high  Gain from continuing the function is high