1. CMGT400 Intro to Information Assurance and Security (University of Phoenix) Lecture, Week 5 Tom Olzak, MBA, CISSP

2. Source  Chapter 2 – Risk Management in Olzak, T. (2012). Enterprise security: A practitioner's guide. Chicago, Illinois: InfoSec Institute.

3. Threat Modeling

4.  Requires a baseline assessment  ISRM Process Steps  Assess  System Definition  Threat identification  Vulnerability identification  Attack path controls assessment  Impact analysis  Risk determination  Controls recommendations

5. Threat Modeling  ISRM Process Steps (cont’)  Mitigate  Action plan and proposal creation/presentation  Implement controls  Manage  Measure and adjust

6. Attack Trees  Trace probable attack path for a threat (new or existing)  Check for existing vulnerabilities along the path  Determine risk  Design controls or processes to reduce risk  Apply controls and processes  Verify with attack tree analysis

7. Attack Tree Example

10. Software Testing

11. Types of Testing Unit Development team Usually use “buddy checking” Quality Assurance (QA) Formal test plan Test against functional requirements User Acceptance Users verify that they will get what they expect Post Implementation Check Verify that all technical requirements, including security, were met

12. Audits

13. Purpose of Audits  Not the same as risk assessments, penetration tests, or vulnerability scans  Ensure outcomes match management’s expectations as specified in policy, standards, and guidelines  Auditors and security personnel must work together; avoid adversarial relationship  Internal audits often only check financial issues (e.g., SOX compliance).

14. Sample Termination Audit 1.Select a target application (financials, Active Directory, etc.). 2.Obtain from the HR system a list of all job terminations since the last audit. (A terminated employee is one who left the company for any reason.) 3.Randomly select 25% of the termination set. 4.Check to ensure terminations were properly managed according to policy for the target application 5.If more than n terminations were missed, mark the key control for the target application as failed. (The value of n depends on the size of the tested population set. The larger the test population, the more failures audit teams will accept.)

15. Audit Frequency  Frequency depends on  Data classification  Results of past audits  Management’s appetite for risk

16. And again…  Be sure to read ALL assigned reading. Your success in this class depends on it.