View
569
Download
1
Category
Preview:
DESCRIPTION
Citation preview
© Inovement Spain 2013
ISM-RA
AU IT SB
FAIR
MAGERIT CRAMM
Dutch A&K
EBIOS
ISAMM
ISO27005
MARION
MEHARI
MIGRA
OCTAVE
SP 800-30
ISF Canadian RM Guide
……Etc
ISO27005 Establish Context
Ris
kC
om
mu
nic
atio
n
Ris
kM
on
itorin
ga
nd
Re
vie
w
Risk Treatment
Risk Evaluation
Risk Estimation
Risk Identification
Risk Assessment
Risk Analysis
Risk Acceptance
Accept risk?
Acceptable results?
Establish Context
Ris
kC
om
mu
nic
atio
n
Ris
kM
on
itorin
ga
nd
Re
vie
w
Risk Treatment
Risk Evaluation
Risk Estimation
Risk Identification
Risk Assessment
Risk Analysis
Risk Acceptance
Accept risk?
Acceptable results?
RA Method Design
Threat Taxonomy
Controls/Processes Taxonomy
Model
Scope
Depth
Threat Likelihood
Asset Value
Correct? Useful?
Impact Assets Value
Cost
Threats Frequency
Weaknesses
Countermeasures
RA Method Design
Likelihood
Exposure
Goals Scope (What is in, What is out)
Scope
The more choice on the side of the
certificate aspirant, the less value in
the certification.
The wider the scope, the higher the
cost.
ISM3-RA uses the scope of whole
companies.
Goals Organization Wide
Complexity Likelihood * Threats * Vulnerabilities * Countermeasures *
Asset Value * Exposure = N6
Correct? Useful?
Anyone can create a “correct” RA
method.
But, is it useful?
Utility
HIGH
MEDIUM
LOW
Utility
300
200
100
Utility – Added Value
What are we learning that we don’t know
already? (Non-Banal Analysis)
What are important threats to the
organization?
What should I do?
How safe am I? / How likely is that an
incident will happen?
How much will I lose this year?
How much should I invest this year?
Utility Challenges Lack of real data
Are opinions valid data?
Mixing opinions with arithmetic is a bit
like mixing magic and physics.
The higher the investment, the lower the
risk.
Return of investment is always positive.
Risk Assessment can be difficult and
expensive.
Inherent Limitations
Quantitative
Qualitative
Quantitative RA
Risk = Impact * Probability
Risk
Impact
Pro
ba
bility
Accounting
value of the
company
Expected Loss
[$]
Probability
[% / year] 100
0
0
Last year’s
losses
$ per year
Probability of
discontinuation of
the company per
year
Quantitative RA
Qualitative
Model No Model
Assets (Mostly Technical)
Servers, Databases,
Networks, etc (Purely
Technical)
ISM3-RA uses
Environments and
Business Functions
Depth
(Level
of
Detail)
Depth
The higher the level of detail, the more
complex and costly.
The depth should match the kind of
decisions we want to support.
ISM3-RA uses management-level
depth.
Environments
Management Level
Business
(Components,
Relationships,
States)
Business
Functions
Business Functions
Every business function exist and has a different importance in every company.
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
Business Functions
Every business function exist and has a different importance in every company.
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
Information
Technology
(Components,
Relationships,
States)
Environments
Environment
You can’t model meaningfully a company as a set of servers, applications or “assets”.
On the other hand, an environment has a visible head, someone who will be responsible to carry out the action plan.
Host SSCC
Terceros
SSAA Oficinas
Usuarios
Móviles
Personal
Dependencies
ISM3-RA
Host SSCC Terceros
SSAA Oficinas Usuarios
Móviles
Personal
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
Threats (There is no
widely accepted
list of threats at
any level of
detail)
(There are no reliable
estimations of probability
of threats)
Threat Taxonomy Pretty Long Lists
Magerit: Accidental Natural,
Accidental Industrial, Accidental
Error, Deliberate, etc…
Against Confidentiality, against
Integrity, against Availability et al.
ISM3-RA
1. Destruction, corruption or loss of
valid information.
2. Failure to destroy expired
information.
3. Improper use of authorized access.
4. Improper recording of access.
5. Unauthorized access,
eavesdropping, theft and disclosure
of information.
6. Underperformance, interruption of
service & failure of authorized
access.
7. Aging of information & outdated
systems
Threat Likelihood
Normally there is no data enough to
know how likely is a threat.
The multiplicity and evolution of
threats make likelihood of threats very
difficult to model.
ISM3-RA uses a qualitative scale of
likelihood. (from very high to very low)
Impact (Euros,
High – Medium – Low,
Confidenciality – Integrity – Availability, etc)
Asset Value
Euros
High – Medium – Low
Magerit: Disponibilidad, integridad,
confidencialidad, autenticidad,
trazabilidad.
ISM3-RA uses “The more important
Business Functions depend on
Environments, the more valuable”
Controls
(ISO27001
PCI DSS
NIST
ISM3, etc)
Controls / Process Taxonomy
ISO 27002 Controls
PCI DSS Controls
Cobit Controls
Custom Made Lists
Etc…
ISM3-RA uses ISM3 Processes
Mix
Mix
Results
(7, other number,
“good”, “better”, an
action plan, or a
dashboard)
High
Medium
Low
ISM3-RA
0
20
40
60
80
100
120
Relative Weight of Business Functions
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
0,0000
0,1000
0,2000
0,3000
0,4000
0,5000
0,6000
0,7000
0,8000
Internet SSCC Oficinas Host SSAA Terceros Usuarios Mobiles
Personal
Relative Protection per Environment
ISM3-RA
Host SSCC Terceros
SSAA Oficinas Usuarios
Móviles
Personal
ISM3-RA
0
2000
4000
6000
8000
10000
12000
Internet SSCC Oficinas Host SSAA Terceros Usuarios
Mobiles
Personal
Relative Environment Criticality
Host SSCC Terceros
SSAA Oficinas Usuarios
Móviles
Personal
0,000000
0,200000
0,400000
0,600000
0,800000
1,000000
1,200000
1,400000
1,600000
1,800000
SSCC Oficinas Host SSAA Terceros Usuarios Mobiles Personal
Risk to Environment
ISM3-RA
Host SSCC Terceros
SSAA Oficinas Usuarios
Móviles
Personal
0,00000000
1,00000000
2,00000000
3,00000000
4,00000000
5,00000000
6,00000000
7,00000000
8,00000000
SSCC Oficinas Host SSAA Terceros Usuarios Mobiles
Risk to Technical Environment per Threat Improper recording of access to information or systems /
(anon or otherwise)
Unauthorized access, eavesdropping, theft and disclosure of information or systems AND
Improper use of authorized access to information or systems
Failure to destroy expired information or systems &
Failure to stop systems at will
Underperformance OR Interruption of valid system services &
Failure of authorized access
Aging of information &Outdated systems
Destruction /Corruption /
Loss of valid information or systems
ISM3-RA
Host SSCC Terceros
SSAA Oficinas Usuarios
Móviles
Personal
02000400060008000
10000120001400016000
Relative Reliance on Environments
ISM3-RA
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
0,000000
0,500000
1,000000
1,500000
2,000000
2,500000
Risk per Business Function
Personal
Usuarios Mobiles
Terceros
SSAA
Host
Oficinas
SSCC
ISM3-RA
Researc
h
Fin
ancin
g /
Accountin
g
Legal
Sale
s
Rela
tionship
s
Pro
ductio
n
Main
tenance
Busin
ess
Inte
lligence
Govern
ance
IT
Advertis
ing
Hum
an
Resourc
es
Infra
stru
ctu
re
Adm
inis
tratio
n
Pro
cure
ment
Logis
tics
ISM3-RA
Internal
Network DMZ
Mobile
Users
Internal
Users
WiFi
Networks
Govern
ance
Infra
stru
ctu
re
Hum
an
Resourc
es
Pro
ductio
n
Logis
tics
Adm
inis
tratio
n
IT
Advertis
ing
Researc
h
Pro
cure
ment
Sale
s
Busin
ess
Inte
lligence
Fin
ancin
g /
Accountin
g
Main
tenance
Rela
tionship
s
Legal
ISM3-RA
Internal
Network DMZ
Mobile
Users
Internal
Users
WiFi
Networks
Govern
ance
Infra
stru
ctu
re
Hum
an
Resourc
es
Pro
ductio
n
Logis
tics
Adm
inis
tratio
n
IT
Advertis
ing
Researc
h
Pro
cure
ment
Sale
s
Busin
ess
Inte
lligence
Fin
ancin
g /
Accountin
g
Main
tenance
Rela
tionship
s
Legal
ISM3-RA
Dashboard?
Information Security that makes Business
Sense
inovement.es/oism3
Web www.inovement.es
Video Blog youtube.com/user/vaceituno
Blog ism3.com
Twitter twitter.com/vaceituno
Presentations slideshare.net/vaceituno/presentations
Articles slideshare.net/vaceituno/documents
Recommended