© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson.

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Learning Objectives  Identify assets and activities to protect within an organization.  Identify threats, vulnerabilities, and exploits.  Identify and analyze risk mitigation security controls.

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Key Concepts  Identification of key activities and assets  Recognize value of data  Basic planning steps of a BIA  Techniques used to identify relevant threats, vulnerabilities, and exploits  Identify and compare procedural, technical, physical, and functional controls

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Activities System Access System Availability System Functions: Manual and Automated Identifying Activities  Eliminate single points of failure (SPOF) Part of a system that can cause entire system to fail If SPOF fails, entire system fails

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. System Access and Availability  Goal: 99.999 percent up time  Failover cluster  RAID

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Identifying Assets  People can also be single points of failure Hire additional personnel Cross train Job rotation Assets Hardware Assets Software Assets Personnel Assets

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Identifying Data Assets  Protect data  Ensure methods are available to retrieve data Data warehousing Data mining Data and Information Customer Intellectual Property Data bases

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Types of Assessments Threat AssessmentVulnerability AssessmentsExploits Assessments

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Threat Assessments  Identifies and evaluates threats Determines i mpact on confidentiality Determines i mpact on integrity Determines i mpact on availability

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Vulnerability Assessments  Vulnerabilities are any weaknesses in an IT infrastructure.  Assessments identify vulnerabilities within an organization: Servers Networks Personnel  Entire networks can be vulnerable if access controls aren’t implemented

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Internal/External Vulnerability Assessments Security professionals exploit internal systems to learn about vulnerabilities Internal assessments Personnel outside the company exploit systems to learn about vulnerabilities External assessments

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Intrusion Detection System Outputs  IDS uses logs  Logs can be used in assessments

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Verifying Rights and Permissions  Verify user rights and permissions Principle of least privilege

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Exploit Assessments  Exploit assessments attempt to exploit vulnerabilities They simulate an attack to determine if attack can succeed  An exploit test: Uually starts with a vulnerability test to determine vulnerabilities Follows with an attempt to exploit the vulnerability

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. In-Place Controls  Installed in an operational system  Replace in-place controls that don’t meet goals  Three primary objectives of controls: Prevent Recover Detect

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Planned Controls  Those that have been approved but not yet installed  Identify planned controls before approving others  Vulnerabilities that planned controls mitigate still exist  Evaluate effectiveness of a planned control through research

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Functional Controls Controls Based on Function Being Performed Preventive Hardening Patching Detective Audit trails IDS Corrective Backups File Recovery

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. NIST SP 800-53 Control Families  Access Control (AC)  Audit and Accountability (AU)  Awareness and Training (AT)  Configuration Management (CM)  Contingency Planning (CP)  Identification and Authentication (IA)  Incident Response (IR)  Maintenance (MA)  Media Protection (MP)  Personnel Security (PS)

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. NIST SP 800-53 Control Families (Cont.)  Physical and Environment Protection (PE)  Planning (PL)  Program Management (PM)  Risk Assessment (RA)  Security Assessment and Authorization (CA)  System and Communications Protection (SC)  System and Information Integrity (SI)  System and Services Acquisition (SA)

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Procedural Control Examples Policies and proceduresSecurity plansInsurance and bondingBackground and financial checks

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Procedural Control Examples (Cont.) Data loss prevention programAwareness trainingRules of behaviorSoftware testing

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Technical Control Examples Login identifierSession timeoutSystem logs and audit trailsData range and reasonableness checks Firewalls and routers EncryptionPublic key infrastructure (PKI)

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Firewalls and Routers  Filters traffic Access control lists (ACLs)

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Physical Control Examples Locked doors, guards, CCTVFire detection and suppressionWater detectionTemperature and humidity detectionElectrical grounding and circuit breakers

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Business Impact Analysis (BIA) A Business impact analysis (BIA) differentiates critical (urgent) and non- critical (non-urgent) organization functions/activities. Critical functions are those whose disruption is regarded as unacceptable. Perceptions of acceptability are affected by the cost of recovery solutions. A function may also be considered critical if dictated by law. For each critical (in scope) function, two values are then assigned: Recovery Point Objective (RPO) – the acceptable latency of data that will not be recovered. For example is it acceptable for the company to lose 2 days of data Recovery Time Objective (RTO) – the acceptable amount of time to restore the function. The recovery point objective must ensure that the maximum tolerable data loss for each activity is not exceeded. The recovery time objective must ensure that the Maximum Tolerable Period of Disruption (MTPoD) for each activity is not exceeded. http://en.wikipedia.org/wiki/Business_continuity_planning#Business_impact_analysis_.28BIA.29

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. BIA Planning Introduction  Identifies impact of sudden loss Define the scopeIdentify objectives Identify mission-critical functions and processes Map functions and processes to IT systems

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Assessing Vulnerabilities Documentation reviewReview logsVulnerability scansAudits and personnel interviewsProcess and output analysisSystem testing

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Process Analysis and Output Analysis  Firewall has five rules Use process analysis  Firewall has 100 rules Use output analysis

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Procedure for Assessing Exploits IdentificationMitigationImplementationRemediation

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Suggested Steps for Implementing Security Controls  Selection of security control  Documentation of each control  Implementation of each control Insurance Avoidance Reduction Retention

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Data and Information Assets  Data protected by: Access controls Backups

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Data Classifications  Organization Classifications Proprietary Private Public Freely available Protected Internally Highest Level of Protection Government  Top Secret  Secret  Confidential

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Data and Information Asset Categories OrganizationCustomer Intellectual property Data warehousing Data mining

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Internal Threats  Internal threats Users with unintentional access Users responding to phishing attempts Users forwarding viruses Disgruntled ex-employees Equipment failure Data loss Attacks

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. External Threats  Attack public-facing servers  Weather conditions and natural disasters

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Risk Mitigation Functions  Senior management  IT management  Functional management and employees  Contractors/vendors

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Identify Assets  First step in risk management You can’t plan the protection if you don’t know what you’re protecting  When do you want to identify a single point of failure? Before it fails? Or after if fails?

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Threat Modeling  What system are you trying to protect?  Is the system susceptible to attacks?  Who are the potential adversaries?  How might a potential adversary attack?  Is the system susceptible to hardware or software failure?  Who are the users?  How might an internal user misuse the system?

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Key to Risk Management  Risk = Threat X Vulnerability Threat assessments -Help reduce impact of threats Vulnerability assessments -Help reduce vulnerabilities Exploit assessments -Help validate actual threats and vulnerabilities

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Controls Mitigate Risk  Controls reduce impact of threats  Controls reduce vulnerabilities to an acceptable level  Hundreds of controls Best to evaluate based on categories

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Identify Valuable Assets  Ask a system owner How much downtime can you accept? -Answer: “None” How much data loss can you accept? -Answer: “None”  Then ask “How much money are you willing to spend?”

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. System Testing  Functionality testing ~ Defining requirements  Access controls ~ Verifying user rights and allocations  Penetration testing ~ Verifying security countermeasures  Tests transactions with applications

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Variety of Controls Needed  What is missed if only technical controls are used?  What is missed if only procedural controls are used?  What is missed if only physical controls are used?

Managing Risk in Information Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Summary  Identification of key activities and assets  Recognize value of data  Basic planning steps of a BIA  Techniques used to identify relevant threats, vulnerabilities, and exploits  Identify and compare procedural, technical, physical, and functional controls

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson.

Similar presentations

Presentation on theme: "© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson.

Similar presentations

Presentation on theme: "© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Managing Risk in Information Systems Lesson."— Presentation transcript:

Similar presentations

About project

Feedback