INFORMATION SECURITY MANAGEMENT
This lecture focuses on the crucial aspects of risk management within information security. We explore the process of identifying and assessing risks, including terminologies, asset importance, threat identification, and vulnerability assessment. Drawing insights from Yogi Berra, we emphasize the need for clarity in risk management goals to avoid potential pitfalls. Key techniques such as weighted ranks of threats, the TVA worksheet, and qualitative risk assessments are examined, providing a foundation for developing effective risk mitigation strategies.
INFORMATION SECURITY MANAGEMENT
E N D
Presentation Transcript
INFORMATION SECURITY MANAGEMENT Lecture 7: Risk Management Identifying and Assessing Risk You got to be careful if you don’t know where you’re going, because you might not get there. – Yogi Berra
Risk Management “The process of determining the maximumacceptable level of overall risk to and from a proposed activity, then using risk assessment techniques to determine the initial level of risk and, if this is excessive, developing a strategy to ameliorate appropriate individual risks until the overall level of risk is reduced to an acceptable level.”
Risk Identification Figure 8-1 Risk identification process Source: Course Technology/Cengage Learning
Threat Identification (cont’d.) Source: Adapted from M. E. Whitman. Enemy at the gates: Threats to information security. Communications of the ACM, August 2003. Reprinted with permission Weighted ranks of threats to information security
Vulnerability Assessment Table 8-4 Vulnerability assessment of a DMZ router Management of Information Security, 3rd ed. Source: Course Technology/Cengage Learning
The TVA Worksheet (cont’d.) Table 8-5 Sample TVA spreadsheet Source: Course Technology/Cengage Learning
Introduction to Risk Assessment • The goal is to create a method to evaluate the relative risk of each listed vulnerability Figure 8-3 Risk identification estimate factors Source: Course Technology/Cengage Learning
Risk Determination – Example 1 Asset A has a value of 50 and has one vulnerability, which has a likelihood of 1.0 with no current controls. Your assumptions and data are 90% accurate
Risk Determination – Example 2 Asset B has a value of 100 and has two vulnerabilities: • vulnerability #1 has a likelihood of 0.5 with a current control that addresses 50% of its risk • vulnerability # 2 has a likelihood of 0.1 with no current controls. Your assumptions and data are 80% accurate
