1. Controlling Risk
Welcome to IST-456 Topic 9 – Controlling Risk

2. Objectives Upon completion of this chapter, you should be able to:
Recognize and select from the risk mitigation strategy options to control risk
Evaluate risk controls and formulate a cost-benefit analysis using existing conceptual frameworks
Explain how to maintain and perpetuate risk controls
Describe the OCTAVE Method and other approaches to managing risk

3. Introduction
To keep up with the competition, organizations must design and create a safe environment in which business processes and procedures can function
This environment must maintain confidentiality and privacy and assure the integrity and availability of organizational data
These objectives are met via the application of the principles of risk management
In the early days of IT, its use was intended to give business a ‘competitive advantage’
However – today most organizations have integrated IT into their processes and the goal is not to lose advantage by failing to integrate the most current technologies and approaches – this is the concept of ‘competitive disadvantage’

4. Risk Control Strategies
An organization must choose one of four basic strategies to control risks
Avoidance
Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability
Transference
Shifting the risk to other areas or to outside entities
Mitigation
Reducing the impact if the vulnerability is exploited

5. Risk Control Strategies (cont’d.)
An organization must choose one of four basic strategies to control risks (cont’d.)
Acceptance
Understanding the consequences and accepting the risk without control or mitigation
Acceptance is always the least desirable alternative.

6. Avoidance
The risk control strategy that attempts to prevent the exploitation of the vulnerability
Avoidance is accomplished through:
Application of policy
Application of training and education
Countering threats
Implementation of technical security controls and safeguards
Application of policy allows all levels of management to mandate that certain procedures always be followed
Training and education are intended to assure compliance with new or revised policies
It may not always be possible to eliminate threats but it may be possible to limit exposure
An example of a technical control would be use of a virtual private network for telecommuting employees

7. Transference
The control approach that attempts to shift the risk to other assets, other processes, or other organizations
May be accomplished by rethinking how services are offered
Revising deployment models
Outsourcing to other organizations
Purchasing insurance
Implementing service contracts with providers
However – it is important that service level agreements and contracts explicitly detail how security is to be accomplished
and that providers be certified
For example – outsourcing customer data to a cloud provider does not eliminate your organizations primary responsibility for
compliance with data protection laws

8. Mitigation
The control approach that attempts to reduce the damage caused by the exploitation of vulnerability
Using planning and preparation
Depends upon the ability to detect and respond to an attack as quickly as possible
Types of mitigation plans
Disaster recovery plan (DRP)
Incident response plan (IRP)
Business continuity plan (BCP)
Mitigation plans were covered in topic 3

9. Mitigation (cont’d.) Table 9-1 Summaries of mitigation plans
Source: Course Technology/Cengage Learning

10. Acceptance The choice to do nothing to protect an information asset
To accept the loss when it occurs
This control, or lack of control, assumes that it may be a prudent business decision to examine the alternatives and conclude that the cost of protecting an asset does not justify the security expenditure
for example – protecting a given server may cost $100,000 whereas replacing the server, its information and recovery costs may only
total $50,000 – so the risk will be accepted and the funds used to mitigate risk elsewhere

11. Acceptance (cont.)
Before using the acceptance strategy, the organization must:
Determine the level of risk to the information asset
Assess the probability of attack and the likelihood of a successful exploitation of a vulnerability
Approximate the ARO of the exploit
Estimate the potential loss from attacks
Perform a thorough cost benefit analysis
ARO – annual rate of occurrence

12. Acceptance (cont.)
Before using the acceptance strategy, the organization must: (cont’d.)
Evaluate controls using each appropriate type of feasibility
Decide that the particular asset did not justify the cost of protection

13. Managing Risk Risk appetite (also known as risk tolerance)
The quantity and nature of risk that organizations are willing to accept
As they evaluate the trade-offs between perfect security and unlimited accessibility
The reasoned approach to risk is one that balances the expense (in terms of finance and the usability of information assets) against the possible losses if exploited
An inherent danger is that some organizations may take on risk because they are ignorant of its existence or impact

14. Managing Risk (cont’d.)
Residual risk
When vulnerabilities have been controlled as much as possible, there is often remaining risk that has not been completely removed, shifted, or planned for
Residual Risk is a combined function of:
Threats, vulnerabilities and assets, less the effects of the safeguards in place

15. Managing Risk (cont’d.)
The goal of information security is not to bring residual risk to zero
Bring it in line with an organization’s risk appetite
If decision makers have been informed of uncontrolled risks and the proper authority groups within the communities of interest decide to leave residual risk in place, then the information security program has accomplished its primary goal

16. Managing Risk (cont’d.)
Once a control strategy has been selected and implemented:
The effectiveness of controls should be monitored and measured on an ongoing basis
To determine its effectiveness and the accuracy of the estimate of the residual risk

17. Managing Risk (cont’d.)
Risk control involves selecting one of the four risk control strategies
For the vulnerabilities present
If the loss is within the range of losses the organization can absorb, or if the attacker’s gain is less than expected costs of the attack, the organization may choose to accept the risk
Otherwise, one of the other control strategies will have to be selected

18. Managing Risk (cont’d.)
Figure 9-2 Risk-handling action points
Source: Course Technology/Cengage Learning

19. Managing Risk (cont’d.)
Guidelines for risk control strategy selection
When a vulnerability exists
Implement security controls to reduce the likelihood of a vulnerability being exercised
When a vulnerability can be exploited
Apply layered controls to minimize the risk or prevent occurrence
When the attacker’s potential gain is greater than the costs of attack
Apply technical or managerial controls to increase the attacker’s cost, or reduce his gain

20. Managing Risk (cont’d.)
Guidelines for risk control strategy selection (cont’d.)
When potential loss is substantial
Apply design controls to limit the extent of the attack, thereby reducing the potential for loss
at a minimum – each information asset-threat pair should have a documented control strategy that clearly identifies
any residual risk that remains after the proposed strategy has been executed

21. Managing Risk (cont’d.)
Figure 9-3 Risk control cycle
Source: Course Technology/Cengage Learning

22. Feasibility and Cost-Benefit Analysis
Before deciding on the strategy for a specific vulnerability
All readily accessible information about the consequences of the vulnerability must be explored
Ask “what are the advantages of implementing a control as opposed to the disadvantages of implementing the control?”
cost avoidance is the money saved by avoiding, via the implementation of a control, the financial ramifications of an incident

23. Feasibility and Cost-Benefit Analysis (cont’d.)
There are a number of ways to determine the advantage or disadvantage of a specific control
The primary means are based on the value of the information assets that it is designed to protect

24. Cost-Benefit Analysis
Economic feasibility
The criterion most commonly used when evaluating a project that implements information security controls and safeguards
Begin a cost-benefit analysis by:
Evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised
This decision-making process is called
Cost-benefit analysis or economic feasibility study

25. Cost-Benefit Analysis (cont’d.)
As it is difficult to determine the value of information
So it is also difficult to determine the cost of safeguarding it
Factors that affect the cost of a safeguard
Cost of development or acquisition of hardware, software, and services
Training fees
Cost of implementation
Service and maintenance costs
however, while difficult – it is not impossible
Cost-benefit analysis is a powerful method used to determine relative risk and to prioritize controls and
explain their need to management

26. Cost-Benefit Analysis (cont’d.)
The value to the organization of using controls to prevent losses associated with a specific vulnerability
Usually determined by valuing the information assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset
This is expressed as the annualized loss expectancy (ALE)

27. Cost-Benefit Analysis (cont’d.)
Asset valuation
The process of assigning financial value or worth to each information asset
The value of information differs within and between organizations
Based on the characteristics of information and the perceived value of that information
Involves estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against loss and litigation

28. Cost-Benefit Analysis (cont’d.)
Asset valuation components
Value retained from the cost of creating the information asset
Value retained from past maintenance of the information asset
Value implied by the cost of replacing the information
Value from providing the information
Value acquired from the cost of protecting the information

29. Cost-Benefit Analysis (cont’d.)
Asset valuation components (cont’d.)
Value to owners
Value of intellectual property
Value to adversaries
Loss of productivity while the information assets are unavailable
Loss of revenue while information assets are unavailable

30. Cost-Benefit Analysis (cont’d.)
An organization must be able to place a dollar value on each information asset it owns, based on:
How much did it cost to create or acquire?
How much would it cost to recreate or recover?
How much does it cost to maintain?
How much is it worth to the organization?
How much is it worth to the competition?

31. Cost-Benefit Analysis (cont’d.)
Potential loss is that which could occur from the exploitation of vulnerability or a threat occurrence
Ask these questions:
What loss could occur, and what financial impact would it have?
What would it cost to recover from the attack, in addition to the financial impact of damage?
What is the single loss expectancy for each risk?

32. Cost-Benefit Analysis (cont’d.)
A single loss expectancy (SLE)
The calculation of the value associated with the most likely loss from an attack
SLE is based on the value of the asset and the expected percentage of loss that would occur from a particular attack
SLE = asset value (AV) x exposure factor (EF)
Where EF is the percentage loss that would occur from a given vulnerability being exploited
This information is usually estimated
Industry organizations can often help with these estimates
example -
asset value of a company Web site is 1,000,000
exposure factor from hacker defacement scenario is 0.10 (ten percent)
SLE = $100,000

33. Cost-Benefit Analysis (cont’d.)
In most cases, the probability of a threat occurring is the probability of loss from an attack within a given time frame
This value is commonly referred to as the annualized rate of occurrence (ARO)
ALE = SLE * ARO
in prior example – if the given hacker defacement is estimated to occur once every 2 years
the ARO is 0.5
so the annualized Loss Expectancy is $50,000

34. Cost-Benefit Analysis (cont’d.)
CBA determines whether or not a control alternative is worth its associated cost
CBAs may be calculated before a control or safeguard is implemented
To determine if the control is worth implementing
Or calculated after controls have been implemented and have been functioning for a time

35. Cost-Benefit Analysis (cont’d.)
Cost-benefit analysis formula
CBA = ALE(prior) – ALE(post) – ACS
ALE (prior to control) is the annualized loss expectancy of the risk before the implementation of the control
ALE (post-control) is the ALE examined after the control has been in place for a period of time
ACS is the annual cost of the safeguard
If the prior ALE is $50,000, and the post ALE is determined to be $10,000
and the cost of the control is $10,000
then the CBA value is $30,000
since the CBA is positive, the control is worth implementing

36. Other Methods of Establishing Feasibility
Organizational feasibility analysis
Examines how well the proposed information security alternatives will contribute to the operation of an organization
Operational feasibility
Addresses user and management acceptance and support
Addresses the overall requirements of the organization’s stakeholders
- an organization should not adopt a control that will hinder its ability to move in desired strategic directions
- Operational feasibility is also known as behavioral feasability

37. Other Methods of Establishing Feasibility (cont’d.)
Technical feasibility
Examines whether or not the organization has or can acquire the technology to implement and support the alternatives
Political feasibility
Defines what can and cannot occur based on the consensus and relationships between the communities of interest
TF includes the skill level of IT and security staff
PF may include budgetary considerations

38. Alternatives to Feasibility Analysis
Benchmarking
Due care and due diligence
Best business practices
Gold standard
Government recommendations
Baseline

39. Recommended Risk Control Practices
Organizations typically look for a more straightforward method of implementing controls
This preference has prompted an ongoing search for ways to design security architectures that go beyond the direct application of specific controls for specific information asset vulnerability
This is in recognition of the problem is that implementing one control (say a firewall)
may affect other asset-threat pairs (perhaps by lowering their ALE) such that it is difficult to arrive
at a simple total

40. Qualitative and Hybrid Measures
Quantitative assessment
Performs asset valuation with actual values or estimates
May be difficult to assign specific values
Qualitative assessment
Use scales instead of specific estimates
Hybrid assessment
Tries to improve upon the ambiguity of qualitative measures without using an estimating process
Hybird assessments use numerical scales that can be applied in a quantitative way

41. A Single Source Approach to Risk Management
The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Method
Defines the essential components of a comprehensive, systematic, context-driven, self-directed information security risk evaluation
an InfoSec risk evaluation methodology that allows organizations to balance the protection of critical
information assets against the costs of providing protective and detection controls
developed by Carnegie-Mellon University

42. A Single Source Approach to Risk Management (cont’d.)
The OCTAVE method (cont’d.)
Allows an organization to make information-protection decisions based on risks to the confidentiality, integrity, and availability of critical information technology assets
The operational or business units and the IT department work together to address the information security needs of the organization

43. The OCTAVE Methods Three variations of the OCTAVE method
The original OCTAVE method, (forms the basis for the OCTAVE body of knowledge)
Was designed for larger organizations with 300 or more users
OCTAVE-S
For smaller organizations of about 100 users
OCTAVE-Allegro
A streamlined approach for information security assessment and assurance
For more information:

44. Microsoft Risk Management Approach
Microsoft Corporation also promotes a risk management approach
Four phases in the Microsoft InfoSec risk management process:
Assessing risk
Conducting decision support
Implementing controls
Measuring program effectiveness
Microsoft asserts that risk management is not a stand-alone subject and should be part of a general governance program to allow the organizational general management community of interest to evaluate the organization’s
operations and make better, more informed decisions

45. Microsoft Risk Management Approach (cont’d.)
Assessing Risk: Identification and prioritization of risks facing the organization
Plan data gathering – discuss keys to success and preparation guidance
Gather risk data – outline the data collection process and analysis
Prioritize risks – outline prescriptive steps to qualify and quantify risks

46. Microsoft Risk Management Approach (cont’d.)
Conducting Decision Support: Identify and evaluate available controls
Define functional requirements – create the necessary requirements to mitigate risks
Select possible control solutions – outline approach to identify mitigation solutions
Review solution – evaluate proposed controls against functional requirements

47. Microsoft Risk Management Approach (cont’d.)
Identify and evaluate available controls (cont’d.)
Estimate risk reduction – endeavor to understand reduced exposure or probability of risks
Estimate solution cost – evaluate direct and indirect costs associated with mitigation solutions
Select mitigation strategy – complete cost-benefit analysis to identify the most cost-effective mitigation solution

48. Microsoft Risk Management Approach (cont’d.)
Implementing controls: deployment and operation of the controls selected from the cost-benefit analyses and other mitigating factors from the previous step
Seek holistic approach – incorporate people, process, and technology in mitigation solution
Organize by defense-in-depth – arrange mitigation solutions across the business

49. Microsoft Risk Management Approach (cont’d.)
Measuring program effectiveness: ongoing assessment of the effectiveness of the risk management program
Develop risk scoreboard – understand risk posture and progress
Measure program effectiveness – evaluate the risk management program for opportunities to improve

50. Figure A-1 Security Risk Management Guide
Microsoft Risk Management Approach (cont’d.)
Figure A-1 Security Risk Management Guide
Source: Course Technology/Cengage Learning

51. Microsoft Risk Management Approach (cont’d.)
Additional information is available at:

52. FAIR
The Factor Analysis of Information Risk (FAIR) framework includes:
A taxonomy for information risk
Standard nomenclature for information risk terms
A framework for establishing data collection criteria
Measurement scales for risk factors
A computational engine for calculating risk

53. FAIR (cont’d.)
The Factor Analysis of Information Risk (FAIR) framework includes: (cont’d.)
A modeling construct for analyzing complex risk scenarios
See

54. FAIR (cont’d.)
Basic FAIR analysis is comprised of ten steps in four stages
Stage 1 - Identify scenario components
1. Identify the asset at risk
2. Identify the threat community under consideration
Stage 2 - Evaluate loss event frequency
3. Estimate the probable threat event frequency
4. Estimate the threat capability (TCap)

55. FAIR (cont’d.) Stage 2 - Evaluate loss event frequency (cont’d.)
5. Estimate Control strength (CS)
6. Derive Vulnerability (Vuln)
7. Derive Loss Event Frequency (LEF)
Stage 3 - Evaluate probable loss magnitude (PLM)
8. Estimate worst-case loss
9. Estimate probable loss

56. FAIR (cont’d.) Stage 4 - Derive and articulate Risk
Unlike other risk management frameworks, FAIR relies on the qualitative assessment of many risk components using scales with value ranges, for example very high to very low

57. FAIR (cont’d.) Figure 9-4 Factor analysis of information risk (FAIR)
Source: Course Technology/Cengage Learning (Based on concepts from Jack A. Jones)

58. ISO 27005 Standard for Information Security Risk Management
The ISO series includes a standard for the performance of Risk Management
ISO 27005
See

59. ISO 27005 Standard for Information Security Risk Management (cont’d.)
The document includes a five-stage risk management methodology
Information security risk assessment (ISRA)
Information security risk treatment
Information security risk acceptance
Information security risk communication
Information security risk monitoring and review