1. Welcome CCERP 2016

2. Randy Reid, PhD, CISA, CISSP Security+, Network+, A+
Combining the Extended Risk Analysis Model and the Attack Response Model to Introduce Risk Analysis
Randy Reid, PhD, CISA, CISSP
Security+, Network+, A+
Department of Management and Management Information Systems
University of West Florida
Pensacola, Fla

3. Questions ?
Not only encouraged but appreciated!

4. 4 responses to an attack Avoidance: Apply safeguards
Mitigation: Reduce the impact
Transference: Transfer the risk
Acceptance: Inform management of all of the possible impacts and accept the risk
Adler, T. R., Leonard, J. G. and Nordgren, R. K. (1999) Improving Risk Management: Moving from Risk Elimination to Risk Avoidance, Information and Software Technology, 41,
Peltier, T. R. (2004). Risk analysis and risk management. The EDP Audit, Control, and Security Newsletter, 32.
Zur Muehlen, M., and Ting-Yi Ho, D. (2005). Risk management in the BPM lifecycle. International Conference on Business Process Management. Springer Berlin Heidelberg.
Whitman, M. E. and Mattord H. J. (2014). Management of Information Security, 4th Edition, Course Technologies.

5. Risk Methodologies Application Grid
Low Impact
High Impact
Occurrence
Seldom
Accept the Risk
(acceptance)
Transfer the Risk
(insurance)
Often
Apply Safeguards
(avoidance)
Reduce the Impact
(mitigation)

6. Extended Risk Analysis Model
Threats
Vulnerabilities
Risk
Controls
Insurance No
Residual Risk
Acceptable
Finished
Yes
Reid, R. C. and Floyd, S. (2001). Extending the risk analysis model to include market insurance. Computers and Security, 20(4),

7. Hurricane, Floods, Earthquake
Origins and Sources of Threats
Source
Natural
Human
Origin
External
Hurricane, Floods, Earthquake
Hackers
Internal
Broken water pipe
Sabotage

8. Area under the control of Management
Extended Risk Analysis Model
Threats
Vulnerabilities
Risk
Area under the control of Management
Controls
Insurance No
Residual Risk
Acceptable
Finished
Yes
Reid, R. C. and Floyd, S. (2001). Extending the risk analysis model to include market insurance. Computers and Security, 20(4),

9. Extended Risk Analysis Model
Avoidance: Apply safeguards
Mitigation: Reduce the impact
Transference: Transfer the risk
Acceptance: Inform management of all of the possible impacts and accept the risk
Threats
Vulnerabilities
avoidance
Risk
Controls
Insurance
mitigation
transference No
Residual Risk
Acceptable
Finished
Yes
acceptance

10. Structure of Cyber Insurance
First-party insurance, which covers damage and costs directly incurred by the organization.
Third-party insurance, the second group, covers the costs that are paid to other groups or individuals outside of the organization, including impacts on the customers and legal costs

11. Cyber Insurance Coverage Price per $1 Million by Industry Sector

12. Future of Cyber Insurance
Currently
55 companies currently write cyber insurance policies
2 billion dollars per year in premiums
European Union (EU), about 150 million in premiums has just passed additional privacy laws which will probably increase demand
Asian markets are similar to EU so there is great potential there

13. Thank you for your time and attention
Any further questions or comments please contact me