Security Risk Management Jamie Sharp CISSP Security Advisor

Security Risk Management Jamie Sharp CISSP Security Advisor Microsoft Australia

Session Overview Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Agenda Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Why Develop a Security Risk Management Process? Security risk management – A process for identifying, prioritizing and managing risk to an acceptable level within the organization A formal security risk management process can address the following: – Threat response time – Regulatory compliance – Infrastructure management costs – Risk prioritization and management

Critical Success Factors Executive sponsorship Well defined list of stakeholders Organizational maturity Open communication and teamwork Holistic view of the organization Security risk management team authority

Risk Management Strategies Reactive – A process that responds to security events as they occur Proactive – A process that reduces the risk of new vulnerabilities in your organization

Risk Assessment Methodologies Benefits Quantitative Qualitative Risks prioritized by financial impact; assets prioritized by their financial values Results facilitate management of risk by return on security investment Results can be expressed in management-specific terminology Enables visibility and understanding of risk ranking Easier to reach consensus Not necessary to quantify threat frequency Not necessary to determine financial values of assets Drawbacks Impact values assigned to risks are based upon subjective opinions of the participants Very time-consuming Can be extremely costly Insufficient granularity between important risks Difficult to justify investing in control as there is no basis for a cost-benefit analysis Results dependent upon the quality of the risk management team that is created

Microsoft Security Risk Management Process 4 3 Measuring Measuring Program Program Effectiveness Effectiveness 1 Assessing Assessing Risk Risk Implementing Implementing Controls Controls 2 Conducting Conducting Decision Decision Support Support

Agenda Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Risk Management vs. Risk Assessment Risk Management Goal Cycle Schedule Alignment Risk Assessment Manage risks across Identify and prioritize business to acceptable level risks Overall program across all four phases Scheduled activity Aligned with budgeting cycles Single phase of risk management program Continuous activity Not applicable

Communicating Risk Asset Threat Vulnerability Mitigation What are you trying to protect? What are you afraid of happening? How could the threat occur? What is currently reducing the risk? Impact What is the impact to the business? Probability How likely is the threat given the controls? Well-Formed Risk Statement (Exposure)

Starting Points NIST http://www.nist.gov – Security Self-Assessment Guide for Information Technology Systems (SP-800-26) IT Governance Institute http://www.isaca.org – Control Objectives for Information and Related Technology (CobiT) ISO http://www.iso.org – ISO 17799 - ISO Code of Practice for Information Security Management SAI Global http://www.standards.com.au – AS/NZS 4360:2004 - Risk Management – AS/NZS 7799.2:2003 - Information Security Management Microsoft Security Risk Management Guide – http://www.microsoft.com/technet/security/guidance/secrisk

Risk Management Maturity SelfAssessment Level 0 1 2 3 4 5 State Non-existent Ad hoc Repeatable Defined process Managed Optimized

Roles and Responsibilities Executive Sponsor “What's important?” Information Security Group “Prioritize risks” IT Group “Best control solution” Determine acceptable risk Assess risks Define security requirements Measure security solutions Design and build security solutions Operate and support security solutions

Agenda Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Overview of the Assessing Risk Phase 4 Measuring Measuring Program Program Effectiveness Effectiveness 1 Assessing Assessing Risk Risk Plan risk data gathering Gather risk data Prioritize risks 3 Implementing Implementing Controls Controls 2 Conducting Conducting Decision Decision Support Support

Understanding the Planning Step The primary tasks in the planning step include the following: – Alignment – Scoping – Stakeholder acceptance – Setting expectations

Facilitated Data Gathering Elements collected during facilitated data gathering include: – – – – – Organizational assets Asset description Security threats Vulnerabilities Current control environment – Proposed controls Keys to successful data gathering include: – Meet collaboratively with stakeholders – Build support – Understand the difference between discussing and interrogating – Build goodwill – Be prepared

Identifying and Classifying Assets An asset is anything of value to the organization and can be classified as one of the following: – High business impact – Moderate business impact – Low business impact

Organizing Risk Information Use the following questions as an agenda during the facilitated discussions: – – – – – – What asset are you protecting? How valuable is the asset to the organization? What are you trying to avoid happening to the asset? How might loss or exposures occur? What is the extent of potential exposure to the asset? What are you doing today to reduce the probability of the extent of damage to the asset? – What are some actions that you can take to reduce the probability in the future?

Estimating Asset Exposure Exposure: The extent of potential damage to an asset Use the following guidelines to estimate asset exposure: – High exposure: severe or complete loss of the asset – Medium exposure: limited or moderate loss – Low exposure: minor or no loss

Estimating Threat Probability Use the following guidelines to estimate probability for each threat and vulnerability identified: – High threat: Likely—one or more impacts expected within one year – Medium threat: Probable—impact expected within two to three years – Low threat: Not probable—impact not expected to occur within three years

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task One: Determining Organizational Assets and Scenarios Interest Calculation Systems Customer Personally Identifiable Information (PII) Reputation Consumer financial data—High Business Impact (HBI)

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Two: Identifying Threats Threat of a loss of integrity to consumer financial data

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Three: Identifying Vulnerabilities Theft of financial advisor credentials by trusted employee abuse using non-technical attacks, for example, social engineering or eavesdropping Theft of financial advisor credentials off local area network (LAN) hosts through the use of outdated security configurations Theft of financial advisor credentials off remote, or mobile, hosts as a result of outdated security configurations

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Four: Estimating Asset Exposure Breach of integrity through trusted employee abuse: – Damaging, but not severe. Each financial advisor can only access customer data that he/she manages. Breach of integrity through credential theft on LAN hosts: – May result in a severe, or high, level of damage. Breach of integrity through credential theft on mobile hosts: – Could have a severe, or high, level of damage. The discussion group notes that the security configurations on remote hosts often lag behind LAN systems.

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Five: Identifying Existing Controls and Probability of Exploit Agreement that their remote hosts, or mobile hosts, do not receive the same level of management as those on the LAN.

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – Task Six: Summarizing the Risk Discussion Risk Assessment Facilitator summarizes the discussion and highlights the assets, threats, and vulnerabilities discussed.

Scenario 1: Facilitating a Risk Discussion at Woodgrove Bank Woodgrove Bank is a consumer financial institution in the process of conducting a Security Risk Management project – – – – – Task One: Determining Organizational Assets and Threats Task Two: Identifying Threats Task Three: Identifying Vulnerabilities Task Four: Identifying Asset Exposure Task Five: Identifying Existing Controls and Probability of Exploit – Task Six: Summarizing the Risk Discussion

Defining Impact Statements Impact data includes the following information:

Scenario 2: Defining an Impact Statement For Woodgrove Bank Asset Name Consumer financial investment data Consumer financial investment data Consumer financial investment data Asset Class HBI HBI HBI DID Level Threat Description Vulnerability Description Host Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials of managed LAN client via outdated security configurations H H Host Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials off managed remote client via outdated security configurations H H Data Unauthorized access to consumer data through theft of Financial Advisor credentials Theft of credentials by trusted employee abuse, via non-technical attacks L M ER IR (H,M,L) (H,M,L)

Understanding Risk Prioritization Start risk prioritization Conduct summarylevel risk prioritization Summary level risk prioritization Review with stakeholders Conduct detailedlevel risk prioritization Detailed level risk prioritization End of risk prioritization

Conducting Summary-Level Risk Prioritization 1 2 High. Likely—one or more impacts expected within one year Medium. Probable—impact expected within two to three years Low. Not probable—impact not expected to occur within three years 4 The summary-level prioritization includes the following: 1. 2. 3. 4. Determine impact level Estimate summary-level probability Complete the summary-level risk list Review with stakeholders 3

Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank Task One: Determine Impact Level – Trusted Employee Theft Impact HBI asset class *Low Exposure Moderate Impact – LAN Host Compromise Impact HBI asset class *High Exposure High Impact – Remote Host Compromise Impact HBI asset class *High Exposure High Impact

Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank Task Two: Estimate Summary-Level Probability – Trusted Employee Theft Probability Low – LAN Host Compromise Probability Medium – Remote Host Compromise Probability High

Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank Task Three: Complete the Summary-Level Risk List – Trusted Employee Theft Risk Moderate Impact *Low Probability Low – LAN Host Compromise Risk High Impact *Medium Probability High – Remote Host Compromise Risk High Impact *High Probability High – Enter Results in the Impact Statement Spreadsheet

Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank Task Four: Review With Stakeholders – Trusted Employee abuse risk is rated as Low in the summary level risk list and does not need to graduate to the detailed level risk prioritization step – LAN and remote host compromise risks are both rated as high and so are then prioritized at the detailed level

Scenario Three: Summary-Level Risk Prioritization at Woodgrove Bank Task One: Determine Impact Level Task Two: Estimate Summary Level Probability Task Three: Complete the Summary-Level Risk List Task Four: Review With Stakeholders

Conducting Detailed-Level Risk Prioritization The following four tasks outline the process for building a detailed-level list of risks: 1. 2. 3. 4. Determine impact and exposure Identify current controls Determine probability of impact Determine detailed risk level Use the Detailed-Level Risk Prioritization template (SRJA3-Detailed Level Risk Prioritization.xls)

Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank Task One: Determine Impact and Exposure – LAN Host Compromise Exposure Rating: 4 (80%) HBI 10 Impact Rating: 10 *80% 8 – Remote Host Compromise Exposure Rating: 4 (80%) HBI 10 Impact Rating: 10 *80% 8 – Impact Range Between 7-10 which compares to High

Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank Task Two: Identify Current Controls – Financial Advisors can only access accounts they own; thus, the exposure is less than 100 percent. – E-mail notices to patch or update hosts are proactively sent to all users. – Antivirus and patch updates are measured and enforced on the LAN every few hours. This control reduces the time window when LAN hosts are vulnerable to attack.

Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank Task Three: Determine Probability of Impact – LAN and remote hosts: Likely that all vulnerability attributes in the High category will be seen inside and outside Woodgrove’s LAN environment in the near future. Vulnerability value 5 for both risks – Control Effectiveness: LAN: Result of Control Effectiveness Questions 1 Remote: Result of Control Effectiveness Questions 5 – Total Probability Rating: (Sum of Vulnerability and Control Effectiveness) LAN 6 Remote 10

Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank Task Four: Determine Detail Risk Level – Impact Rating *Probability Rating LAN: 8 *6 48 Remote Hosts: 8 *10 80 Both rate an overall risk of High

Scenario Four: Detailed-Level Risk Prioritization at Woodgrove Bank Task One: Determine Impact and Exposure Task Two: Identify Current Controls Task Three: Determine Probability of Impact Task Four: Determine Detail Risk Level

Quantifying Risk The following tasks outline the process for determining the quantitative value: – Assign a monetary value to each asset class – Input the asset value for each risk – Produce the single-loss expectancy value (SLE) – Determine the annual rate of occurrence (ARO) – Determine the annual loss expectancy (ALE)

Scenario Five: Quantifying Risk For Woodgrove Bank Task One: Assign Monetary Values to Asset Classes – – – – – Using 5% Materiality Guideline for valuing assets Net Income: 200 Million annually HBI Asset Class: 10 Million (200 *5%) MBI Asset Class: 5 Million (based on past spending) LBI Asset Class: 1 Million (based on past spending)

Scenario Five: Quantifying Risk For Woodgrove Bank Task Two: Identify the Asset Value – Consumer financial data HBI Asset Class – HBI 10 Million – Asset Value 10 Million

Scenario Five: Quantifying Risk For Woodgrove Bank Task Three: Produce the Single Loss Expectancy Value (SLE) Asset Class Value Exposure Rating Exposure Value SLE LAN Host Risk ( in millions) 10 4 80% 8 Remote Host Risk ( in millions) 10 4 80% 8 Risk Description High Business Impact Value M Asset Class Exposure Rating Exposure Factor % 5 100 4 80 HBI Value M 3 60 MBI Value M/2 2 40 LBI Value M/4 1 20 Estimated Risk Value Asset Class Value * Exposure Factor % SLE

Scenario Five: Quantifying Risk For Woodgrove Bank Task Four: Determine the Annual Rate of Occurrence (ARO) – LAN Host ARO: Based on the qualitative assessment of Medium probability, the Security Risk Management Team estimates the risk to occur at least once in two years; thus, the estimated ARO is 5. – Remote Host ARO: Based on the qualitative assessment of High probability, the Security Risk Management Team estimates the risk to occur at least once per year; thus, the estimated ARO is 1. Qualitative Rating Description ARO range Description Examples High Likely 1 Medium Probable .99 to .33 Low Not probable .33 Impact once or more per year At least once every 1-3 years At least once greater than 3 years

Scenario Five: Quantifying Risk For Woodgrove Bank Task Five: Determine the Annual Loss Expectancy (ALE) (SLE *ARO) Risk Description Asset Class Value Exposure Rating Exposure Value SLE ARO ALE LAN Host Risk ( in millions) 10 4 80% 8 0.5 4 Remote Host Risk ( in millions) 10 4 80% 8 1 8

Scenario Five: Quantifying Risk For Woodgrove Bank Task One: Assign Monetary Values to Asset Classes Task Two: Identify the Asset Value Task Three: Produce the Single Loss Expectancy Value (SLE) Task Four: Determine the Annual Rate of Occurrence (ARO) Task Five: Determine the Annual Loss Expectancy (ALE) (SLE *ARO)

Assessing Risk: Best Practices Analyze risks during the data gathering process Conduct research to build credibility for estimating probability Communicate risk in business terms Reconcile new risks with previous risks

Agenda Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Overview of the Decision Support Phase 4 3 Measuring Measuring Program Program Effectiveness Effectiveness Implementing Implementing Controls Controls 1 Assessing Assessing Risk Risk 1. Define functional requirements 2. Identify control solutions 3. Review solution against requirements Conducting Conducting 4. Estimate degree of risk reduction Decision Decision Support Support5. Estimate cost of each solution 6. Select the risk mitigation strategy 2

Identifying Output for the Decision Support Phase Key elements to gather include: – Decision on how to handle each risk – Functional requirements – Potential control solutions – Risk reduction of each control solution – Estimated cost of each control solution – List of control solutions to be implemented

Considering the Decision Support Options Options for handling risk: ATAM – Accept – Transfer – Avoid – Mitigate

Step 1: Define Functional Requirements Security risk management team 1 Mitigation owner 2 Identify control Define functional requirements solutions Security steering committee 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy

Step 2: Identify Control Solutions Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy

Step 3: Review Solutions Against Requirements Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy

Step 4: Estimate Degree of Risk Reduction Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy

Step 5: Estimate Cost of Each Solution Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 Estimate degree of risk reduction Estimate cost of each solution 6 Select the risk mitigation strategy

Step 6: Select the Risk Mitigation Strategy Security risk management team 1 Mitigation owner 2 Security steering committee Define functional requirements Identify control solutions 3 Review solutions against requirements 4 5 6 Estimate degree of risk reduction Estimate cost of each solution Select the risk mitigation strategy

Conducting Decision Support: Best Practices Assign a security technologist to each risk Set reasonable expectations Build team consensus Focus on the amount of risk after the mitigation solution

Agenda Security Risk Management Concepts Security Risk Management Prerequisites Assessing Risk Conducting Decision Support Implementing Controls and Measuring Program Effectiveness

Implementing Controls 4 3 Measuring Measuring Program Program Effectiveness Effectiveness Implementing Implementing Controls Controls Seek a holistic approach Organize by Defensein-Depth 1 Assessing Assessing Risk Risk 2 Conducting Conducting Decision Decision Support Support

Organizing the Control Solutions Critical success determinants to organizing control solutions include: – Communication – Team scheduling – Resource requirements

Organizing by Defense-in-Depth Physical Network Host Application Data

Measuring Program Effectiveness 4 Measuring Measuring Program Program Effectiveness Effectiveness 1 Assessing Assessing Risk Risk Develop scorecard Measure control effectiveness 3 Implementing Implementing Controls Controls 2 Conducting Conducting Decision Decision Support Support

Developing a Security Risk Scorecard for Your Organization A simple security risk scorecard organized by the Defense-in-Depth layers: FY05 Q1 FY05 Q2 Physical H M Network M M Host M M Application M H Data L L FY05 Q3 Risk Levels (H, M, L) FY05 Q4

Measuring Control Effectiveness Methods for measuring the effectiveness of implemented controls include: – Direct testing – Submitting periodic compliance reports – Evaluating widespread security incidents

Summary Decide on risk management methodology Determine your maturity level Conduct risk assessment Conduct decision support Implement controls & measure effectiveness

Next Steps Australia Security Portal http://www.microsoft.com/australia/security Microsoft Security Risk Management Guide http://www.microsoft.com/technet/security/guidance/secrisk MOF - Security Management http://www.microsoft.com/technet/itsolutions/cits/mo/smf/mofsmsmf.mspx Additional security tools and content http://www.microsoft.com/security/guidance