1. 1 The 28 th Annual International Computer Software and Applications Conference COMPSAC 2004 Hong Kong September 28, 2004 10:30 am – 12:00 noon Session 4: Panel On Risk Management And Dependability - What Are The Key Factors ? Risk Management of Corporate Confidential Information in Digital Form Dr Lucas Hui Center for Information Security & Cryptography Department of Computer Science The University of Hong Kong

2. 2 1. Introduction  Electronic commerce becomes increasingly popular More information stored in electronic form Problem: management of electronic data Evaluate risk of leaking confidential information  Common Risk Management Equation: r ≈ p x s r = risk exposure in terms of impacts or costs p = probability of exposure s = size of loss due to exposure

3. 3 Firewall setup loopholes Bugs in commercial software systems Bugs in in-house software Problems in outsourced systems Management of desktop computers for employees Management of notebook computers for staff traveling overseas Management of used floppies, CD-ROMs, etc Management of removable storage devises (e.g. USB thumb disks) Management of e-mail storage 2.Analyzing the Probability of Exposure  Probability of losing confidential e-data depends on the information infrastructure of the company  Common information infrastructure weak points:  Major Objective: to minimize the probability of exposure

4. 4 3. Analyzing the Size of Loss  Events that may occur when confidential data are lost: Trade secrets of the company are stolen by competitors (e.g. proposal to bid for a project) Customers information is stolen and disclosed on web site (may lead to lowering of customer loyalty) Passwords for customer user accounts are cracked Passwords for system administer accounts are cracked Transaction records are removed (thus unable to collect revenues) System logs are deleted  Size of Loss depends on: Diversity of events Company’s information infrastructure weak points Nature of company (bank vs florist shop)  To simplify the analysis: Different levels of confidentiality (or importance) serve as indictors about the Size of Loss

5. 5 Types of Attack or Misuse Detected in the Last 12 Months (by percent)

6. 6 Types of Attack or Misuse in Organizations Reporting Financial Loss (by number)

7. 7 Dollar Amount of Losses by Type

8. 8 4. Conclusion  The discussion is far from complete For example, if: The penalty for committing e-crimes is heavier, the risk exposure will be reduced then: Would “severity of penalty” be a risk factor ? then: Would “Modification of the Equation” be needed ?  Common Risk Management Equation: r ≈ p x s

9. 9 Panel On Risk Management And Dependability - What Are The Key Factors ? END