1. HOW MUCH RISK IS ASSOCIATED WITH IT HYGIENE USING FAIR?
Case Study Shared courtesy of RiskLens
CONFIDENTIAL - FAIR INSTITUTE 2016

2. CONFIDENTIAL - FAIR INSTITUTE 2016
ANALYSIS SCOPING
Understand how much risk is associated with IT hygiene
RISK SCENARIO DESCRIPTION
Internal systems including databases, servers and workstations
ASSET(S) DESCRIPTION
Confidentiality and Availability
LOSS TYPE
Malicious attack by cyber criminals, general hackers and internal privileged users
Non-malicious incident by internal privileged users
THREAT(S) DESCRIPTION
CONFIDENTIAL - FAIR INSTITUTE 2016

3. ANALYSIS SCOPING Analysis Approach IT Hygiene
Internal Threats (Malicious / Non-Malicious)
External Threats (Malicious)
Servers
Confidentiality Events
Availability Events
included
Databases
Workstations
CONFIDENTIAL - FAIR INSTITUTE 2016

4. CONFIDENTIAL - FAIR INSTITUTE 2016
ANALYSIS SCOPING
Questions to Answer
How much risk is associated with IT hygiene as a whole
How much risk is associated with each asset type (server, database, workstation)
How much risk is associated with confidentiality and availability
What percentage of the overall risk is driven by the different actors
CONFIDENTIAL - FAIR INSTITUTE 2016

5. ANNUALIZED REDUCTION IN LOSS EXPOSURE (RISK)
ANALYSIS RESULTS
RISK = Frequency x Magnitude of future loss. We express risk in terms of loss exposure.
ANNUALIZED REDUCTION IN LOSS EXPOSURE (RISK)
Analysis
Minimum *
Average
Maximum *
Current State
$3.2M
$14.5M
$45.0M
*Min represents the more probable 10th percentile of simulation results. *Max represents the more probable 90th percentile of simulation results.
CONFIDENTIAL - FAIR INSTITUTE 2016

6. ANNUALIZED LOSS EXPOSURE (RISK)
ANALYSIS RESULTS
RISK = Frequency x Magnitude of future loss. We express risk in terms of loss exposure.
ANNUALIZED LOSS EXPOSURE (RISK)
60% related to Confidentiality, 40% related to Availability
CONFIDENTIAL - FAIR INSTITUTE 2016

7. CONFIDENTIAL - FAIR INSTITUTE 2016
ANALYSIS RESULTS
Average Loss Exposure
Concentrations of Risk
Relevant Threats
CONFIDENTIAL - FAIR INSTITUTE 2016

8. ANALYSIS LEVERAGED THE FAIR MODEL
Risk
Loss Event Frequency
Loss Magnitude
Threat Event Frequency
Vulnerability
Primary Loss
Secondary Loss
Contact Frequency
Probability of Action
Threat Capability
Resistance Strength
Loss Event Frequency
Loss Magnitude
CONFIDENTIAL - FAIR INSTITUTE 2016

9. Threat Event Frequency
THE FAIR MODEL
Risk
Loss Event Frequency
Loss
Magnitude
Threat Event Frequency
Vulnerability
Primary Loss
Secondary Loss
Contact Frequency
Probability of Action
Threat Capability
Resistance Strength
Loss Event Frequency
Loss Magnitude
CONFIDENTIAL - FAIR INSTITUTE 2016

10. ANALYSIS CONSIDERATIONS
Configuration Management
Consistency of authentication controls
Consistency of access privileges
Consistency of configuration standards
Vulnerability Management
Consistency or state of patch levels
Additionally, estimated threat event frequency
CONFIDENTIAL - FAIR INSTITUTE 2016

11. Threat Event Frequency
THE FAIR MODEL
Risk
Loss Event Frequency
Loss Magnitude
Threat Event Frequency
Vulnerability
Primary Loss
Secondary Loss
Contact Frequency
Probability of Action
Threat Capability
Resistance Strength
Loss Event Frequency
Loss Magnitude
CONFIDENTIAL - FAIR INSTITUTE 2016

12. CONFIDENTIAL - FAIR INSTITUTE 2016
ANALYSIS INPUT
Incident response
Investigation
PRIMARY LOSSES
Notification / credit monitoring
Regulatory notification
Possible fines / judgments
Customer service requests
Potential litigation
Loss of current/future customers (reputation)
Card replacement
SECONDARY LOSSES
CONFIDENTIAL - FAIR INSTITUTE 2016

13. CONFIDENTIAL - FAIR INSTITUTE 2016
DECISION SUPPORT / ROI
DATA LOSS CONSIDERATIONS
Confidentiality
Estimated the amount of data stored or processed across population of assets
Availability
Estimated the productivity costs associated with loss of system availability
THE CIO/CISO WAS ABLE TO UNDERSTAND
Where this top risk issue stands among other priorities
Where the team should focus next
This analysis will be revisited bi-annually to assess reductions of risk associated with IT hygiene and determine the value that the team is providing to the organization.
CONFIDENTIAL - FAIR INSTITUTE 2016