CISSP Domain – Information Security and Risk Management

Milan Vlahović

CISSP, PMP, MCSE, MCSD, MCDBA, ITIL

Privredna komora Beograda

Based on Skillsoft IT Security KC CISSP Roadmap – Only as a course support material

Security Management

• Due to the increasing use of computer and network technology the risk of exposure to information system attacks is increasing

• It is important for the enterprise to protect all its assets, such as resources and information

• It is not possible to ensure complete security of all assets, but the possibility of an attack can be reduced by having security measures in place

• Security management includes– risk management,– information security policies,– procedures, standards, guidelines, baselines,– information classification,– security organization, and– security education

• This components makes the foundation of a corporation’s security program

• The objective of security, and a security program, is to protect the company and its assets

Core aspects of security management

• Restricting access to a computer system or network

• Identifying vulnerability points of the assets of an organization, possible threats that can exploit these vulnerabilities, impact of these threats and strategies that will help mitigate these threats

• Understanding training needs of all employees about these strategies

Goal of security management

• To protect the propriety and confidential information of a company from being unintentionally altered by trusted individuals or intentionally altered by unauthorized individuals

• CIA triad - three main objectives of security management – Confidentiality– Integrity– Availability

• A security program should use a top-down approach,– the initiation, support, and direction come from top

management, work their way through middle management, and then reach staff members

Securityobjectives

ConfidentialityIntegrity

Avialability

The CIA triad

• Security management relies on – properly identifying and valuing a company’s assets, and

then– implementing security policies, procedures, standards, and

guidelines to provide integrity, confidentiality, and availability for those assets.

• Management’s responsibility is to provide protection for the resources (human, capital, hardware, and informational) it is responsible for and the company overall.

• Management must concern itself with ensuring that a security program is set up that recognizes the threats that can affect these resources and be assured that the necessary protective measures are put into effect.

Confidentiality

• Confidentiality ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure

• This level of confidentiality should prevail while data resides on systems and devices within the network, as it is transmitted, and once it reaches its destination

• Attackers can thwart confidentiality mechanisms by network monitoring, shoulder surfing, stealing password files, and social engineering

Confidentiality (continued)

• Shoulder surfing is when a person looks over another person’s shoulder and watches their keystrokes or views data as it appears on a computer screen.

• Social engineering is when one person tricks another person into sharing confidential information such as by posing as someone authorized to have access to that information. Social engineering can take many other forms.

• Confidentiality can be provided by encrypting data as it is stored and transmitted, by using network traffic padding, strict access control, and data classification, and by training personnel on the proper procedures.

Integrity

• Integrity ensures that the accuracy and reliability of the information and systems is provided, and any unauthorized modification is prevented

• The systems and network should be protected from outside interference and contamination

• Strict access controls, intrusion detection, and hashing can combat these threats

Integrity (continued)

• Security should restrict users’ capabilities and give them only certain choices and functionality– system-critical files should be restricted from viewing

and access by users– applications should provide mechanisms that check

for valid and reasonable input values– databases should let only authorized individuals

modify data, and– data in transit should be protected by encryption or

other mechanisms

Availability• Availability ensures that authorized users are able to access

data and resources whenever needed• The systems and networks should provide adequate

capacity in order to perform with an acceptable level of performance.

• They should be able to recover from disruptions in a secure and quick manner so productivity is not negatively affected.

• Single points of failure should be avoided, backup measures should be taken, redundancy mechanisms should be in place when necessary, and the negative effects from environmental components should be prevented.

Availability (continued)• Threats to availability

– Denial-of-service (DoS)• refers to attacks by intruders on network resources so that authorized

users are unable to access them• to protect against such attacks, the network should validate all users

and make available only the necessary resources– Loss of capabilities

• refers to natural disasters such as flood and earthquake; human actions such as bombs and strikes; or malicious code that compromise the data processing capabilities of networks

– Environmental issues • heat, cold, humidity, static electricity, and contaminants can also affect

system availability

• To ensure availability of data and provide an alternate means of processing, data should be backed up on a regular basis and a disaster recovery plan should be in place

Types of controls• Confidentiality, integrity, and availability (CIA) are the three main

principles of security• To meet the CIA triad objectives, three types of controls can be

used:– administrative

• creating and publishing of security policies, standards, procedures, and guidelines; educating individuals about these policies and guidelines; risk management; conducting security-awareness training; implementing change control procedures and screening all individuals that will use the information system

– physical• physically restricting access to a company's resources to only authorized

individuals, protecting a company's assets from environmental factors such as fire and water, locking systems and removing unnecessary floppy or CD-ROM drives, protecting the perimeter of the facility and monitoring for intrusion

– technical (or logical)• restricting access to a company's resources to only authorized individuals by

using passwords, identification and authentication methods, security devices, configuration of the infrastructure and other logical access control mechanisms

Physical controls: Facility protection, security guards, locks, monitoring, environmental controls, intrusion detection

Technical controls: Logical access controls,encryption,security devices, identification and authentication

Administrative controls: Policies, standards,procedures, guidelines, screening personnel,

security-awareness training

Company data and assets

Change control management• Changes in the production phase can occur because of new

requirements of products or systems, or because newly released patches or upgrades need to be installed

• To avoid any loss of data and ensure smooth functioning of all tasks, the changes should be approved, documented, and tested

• This can be achieved by having a change control management process in place– help deal with the changes effectively– ensures that all changes made in production systems, including

system or application software, will be integrated compatibly

Change control management process

• Includes:– submitting a change request form to the management– analyzing the validity of the change request– analyzing the ways to implement the change– analyzing the cost of implementing the change– documenting the change recommendations– obtaining final approval from the change control

board – making the accepted changes and documenting them– approving the changes by quality control

Organizational Security Model• An organizational security model– framework made up of many entities, protection

mechanisms, logical, administrative, and physical components, procedures, business processes, and configurations that all work together to provide a security level for an environment

• All models work in layers– one layer provides support for the layer above it, and

protection for the layer below it. • Companies can use different types of

technologies, methods, and procedures to accomplish the necessary protection level for their environment

Total security

Data integrity Confidentiality Availability

Cost-effective solutions Safeguards Countermeasures

Legalliabilities

Security awareness

System reliability

Policy andprocedures

Protectionrequirements

Dataclassification

Functionalityevaluation

Risks andthreats

identification

Riskanalysis

Quantitative and qualitative risk assessment

Vulnerabilityassessment

Penetrationtesting

Businessobjectives

Integrated pieces of the security model

Security goals• A security model has various layers, but it also has

different types of goals to accomplish in different timeframes

• Depending on the length of time that security model projects into the future, security goals can be broken into three categories (planning horizon)– operational goals (short-term goals)

• include daily tasks to ensure proper functioning of the operational environment (perform security risk assessment, maintain and implement controls, ...)

– tactical goals (mid-term goals)• include milestones within a project or projects that need to be

completed within a year – strategic goals (long-term goals )

• include long-term goals that are generally broad statements (compliance with laws and regulations, create a maturity model, ...)

Security Frameworks• CobiT (Control Objectives for Information and related

Technology)– framework developed by the Information Systems Audit and

Control Association (ISACA) and the IT Governance Institute (ITGI)

– It defines goals for the controls that should be used to properly manage IT and ensure IT maps to business needs

• CobiT is broken down into four domains: – Plan and Organize,– Acquire and Implement, – Deliver and Support, and – Monitor and Evaluate

• Each category is broken down into subcategories• CobiT framework provides goals and guidance to

companies when they purchase, install, test, certify, and accredit IT products

• COSO (developed by the Committee of Sponsoring Organizations of the Treadway Commission)– framework, which was developed in 1985 to deal

with fraudulent financial activities and reporting– COSO is a model for corporate governance while

CobiT is a model for IT governance– COSO deals more at the strategic level while CobiT

focuses more at the operational level• COSO deals with non-IT items also, as in

company culture, financial accounting principles, board of director responsibility, and internal communication structures

• The COSO framework is made up of the following components:– Control Environment

• Management’s philosophy and operating style• Company culture as it pertains to ethics and fraud

– Risk Assessment• Establishment of risk objectives• Ability to manage internal and external change

– Control Activities• Policies, procedures, and practices put in place to mitigate risk

– Information and Communication• Structure that ensures that the right people get the right

information at the right time

– Monitoring• Detecting and responding to control deficiencies

Standard ISO 17799• Internationally recognized Information Security

Management Standard that provides high-level conceptual recommendations on enterprise security

• Derived from the de facto standard: British Standard 7799 (BS7799)

• The British Standard actually has two parts: – BS7799 Part 1, which outlines control objectives and a

range of controls that can be used to meet those objectives; and

– BS7799 Part II, which outlines how a security program can be set up and maintained

• BS7799 Part II also served as a baseline that organizations could be certified against

• An organization would choose to be certified against the ISO 17799 standard to provide confidence to their customers and partners and be used as a marketing tool

• To become certified, an authorized third party would evaluate the organization against the requirements in ISO 17799 Part II

• The organization could be certified against all of ISO 17799 Part II or just a portion of the standard

• It is some kind of the benchmark used to indicate a correct IT infrastructure

• It is made up of ten domains, which are very close to the CISSP Common Body of Knowledge (CBK)

• ISO 17799 domains– Information security policy for the organization– Creation of information security infrastructure – Asset classification and control– Personnel security– Physical and environmental security– Communications and operations management– Access control– System development and maintenance– Business continuity management– Compliance

• ISO 27000 Series– ISO 17799 was renumbered to ISO 27002 in 2005,

to make it consistent with the 27000 series of ISO security standards

– ISO 27001 is a related standard, formally called ISO/IEC 27001:2005

– ISO 27001 was based on BS 7799 Part 2– ISO 27002 describes information security best

practices (techniques), and ISO 27001 describes a process for auditing (requirements) those best practices

• ITIL (Information Technology Infrastructure Library)– the de facto standard of best practices for IT Service

Management– framework for providing best services in IT Service

Management– ITIL was created because of the increased

dependence on information technology to meet business needs

– ITIL contains five core publications:• Service Strategy• Service Design• Service Transition• Service Operation• Continual Service Improvement

Classifying Data

Classifying Data • Different organizations create and maintain different types

of data. To be able to effectively secure data, without overspending time and money, you need to understand each data type and its importance to the organization.

• Data classification– means identifying the types of data and grouping them into

different categories based on various criteria, such as value and age

• Data-classification scheme– enable a company to identify the number of resources needed

to protect the various types of data and identify protection mechanisms and recovery processes for each type

Objectives of a data-classification scheme

• Identify measures to ensure CIA for each type of data– to provide the appropriate level of security to the data in

an organization, it is necessary to classify that data– data classification organizes data according to its level of

availability and sensitivity to loss or disclosure• Identify the right protection mechanisms for various

categories of data– after data is classified, appropriate security controls are

applied to the data, according to its importance– more expensive measures are used to protect confidential

data and the less expensive measures are used to secure public information

Objectives of a data-classification scheme (cont.)

• Each class of data should have unique characteristics and there should be just the right number of classes – not too many and not too few

• After classifying the data, the measures need to be identified that will secure each type of data

• The data itself can have security identification or its security level can be defined by the location of its storage

• Data owners are responsible for defining the security level of their data

Different organizations -different security models

• Security models selected by a military organization will be different from that defined by a private sector business– military organization - more concerned with the

confidentiality of data– private sector business - more concerned with the

integrity and availability of data• To address these different security concerns,

private sector businesses and military organizations adopt different data-classification schemes

Classes that most private-sector businesses use

• confidential– information that should be used only within the organization– disclosure of information outside the organization is not allowed to avoid adverse affects– examples : trade secrets, source code, competition strategies, and employee information

• private– personal data of employees– examples : work history, salary information, and medical information intended for use within

the organization• sensitive

– data that requires a higher than normal level of integrity, confidentiality, and accuracy to protect it from unauthorized modifications and loss of data

– examples : project details and financial information, such as profit earnings and forecasts• public

– data that will not affect an organization adversely if disclosed– examples : number of people working on a project, information about upcoming projects, ...

Classes that most military organizations use

• top secret– highly critical data, the disclosure of which will cause grave damage to national security– examples : blueprints of new weapons, spy satellite information, and espionage data

• secret– data that is less critical than that included in the top secret class, but the disclosure of secret

data will also damage national security– examples : deployment plans of troops and bomb placements

• confidential– information for use within the organization, and the disclosure of information is not allowed

to avoid adverse affects– examples : information about military personnel– private sector uses this class too

• sensitive but unclassified– minor secret data, the disclosure of which might cause serious damage– examples : medical data of employees and answers to tests

• unclassified– data that is not sensitive– examples : data pertaining to device manuals and recruiting information

Data-classification scheme requirements

• List of criteria against which data will be checked• Data can be classified based on the department it belongs

to, the number of projects it caters to, or its validity period• All stakeholders in an organization need to agree on the

criteria scheme• After gathering and analyzing the criteria scheme, the

company needs to determine how many classes are needed, create their definitions, and determine the controls needed

• After the criteria and classification levels have been finalized, data owners need to analyze their data and identify the level it will fit into.

Common data-classification criteria parameters

• age of data• data owners or manipulators• data storage location• effects of data on national security• encryption status for the data• individuals who have permission to backup data• monetary value of the data• regulatory laws required for specific data• repercussion if data was altered or corrupted• repercussion if data was disclosed• separation of duties status for the data• usefulness of data

Data classification controls

• strict and granular access control• identification and labeling • encryption of data when stored or in

transmission• auditing and monitoring• identifying if separation of duties is required• providing backup and recovery• deploying change control procedures• defining file access permissions

Classification scheme will be effective only if :

• the scheme has the right number of classes– too many classes make them confusing and difficult to maintain while

too few classes imply the low value of data• the classes can be easily distinguished from each other

– classes should be unique and not have any overlapping criteria• the scheme addresses how both information and software are

handled – the scheme should outline how applications are controlled and

handled through their life cycles, this helps evaluate the level of protection applicable to them.

• the scheme reduces the cost of protecting information– too much money should not be spent on protecting trivial information

Data classification criteria• Data classification provides a company with an understanding of the

different types of data the company has and the value the data holds for the company

• Different companies have different criteria, based on which they classify data

– value• valuable data have to be classified and protected

– age• with the passage of time, the value of data might decrease

– useful life• outdated data does not usually need protection at all

– personal association• data that contains the personal information of individuals need to be

classified for situations arising because of court orders, government contracts, and senior-level approvals

Protection of data - methods• encryption

– by public or private key algorithms so that the data can be accessed only by authorized users

• review and approve– any change in data is reviewed and approved by an authorized person, and

this person should be different from the person who has performed this change

• backup and recovery– all data including critical data should be backed up

• separation of duties– ensures that no individual has complete control over a process, which avoids

fraudulent activities• access control

– defines different access levels for different processes such as reading, updating, altering, and deleting data

– administration defines access rights for protected resources

Information classification roles

• Three major roles that are applicable to any type of organization:– Owner– Custodian– User

• Depending on the type of organization, an individual may be required to perform the responsibilities of multiple roles

• In a small organization, an individual may be required to perform the tasks of an owner as well as a custodian

• For larger organizations, it is advisable to assign a role with each level of security

Information classification roles (cont.)

• Owner– usually part of an organization's management and is responsible

for the protection and use of a particular set of data– responsibile for :

• deciding the classification levels of data and for altering them according to changing business needs

• defining security controls as per the data classification to ensure data protection

• defining the access rights applicable to data as per the data classification and the value of the data

– delegates these tasks:• approval of access requests• backup and recovery tasks• approval for data disclosure• security violation notification dealings

Information classification roles (cont.)

• Custodian– an IT person responsible for maintaining the integrity

and availability of data for the data owner– responsibile for :

• backing up data regularly according to the backup specifications provided by the data owner

• restoring lost or corrupted data to provide normal functioning in case of system failure

• ensuring that data is available for performing business activities

• maintaining records of activity for the analysis of data to meet security policies and standards for data protection

Information classification roles (cont.)

• User– an employee or vendor of a company who uses

data to perform work-related tasks– responsibile for :• maintaining the confidentiality of passwords and

ensuring the security of the data used by him• following all security procedures and guidelines and

promptly reporting any security violation to the company• using the data only to perform official duties and not

for any personal gain

Policies, Standards, and Guidelines

Role of a security group• The objectives of a security management program implemented by

an organization are defined by the CIA triad• Various threats affect the objectives of the security management

program of an organization• A security management program consists of policies, standards,

baselines, and guidelines that help the organization lay down stringent security measures and secure the organization as a whole

• It is necessary for each employee to understand the corporate security strategies laid down by the organization

• The responsibility of drafting the security management program of an organization lies with the security group, led by the information security officer

Duties of security officer • Duty of loyalty

– ensures that the senior management (including security officer) of an organization does not reveal or use the organization's protected information for personal gain

• Duty of care– ensures that the organization is responsible for taking care of its employees

and resources by developing and implementing security policies, procedures, and standards

• Some legal concepts associated with the duty of loyalty and the duty of care– conflict of interest– confidentiality– duty of fairness– corporate opportunity (requires an individual not to divulge any company

information related to mergers, acquisitions, or patents for personal gain)

Security management program• The security officer and the top management need to identify and

evaluate the possible threats and risks within the organization and take proper remedial action. This process of risk assessment forms a part of due diligence

• To avoid threats and risks, the security officer and the top management need to specify functions to address these issues

• Basic functions in most security programs

– establishing policies, standards, and guidelines for employees– educating all employees about these policies, standards, and guidelines– appointing a high-level manager to ensure that these policies, standards, and

guidelines are complied with by the employees– adopting appropriate disciplinary measures to enforce the policies, standards,

and guidelines– verifying that compliance policies are being implemented– implementing rectification procedures in case of violations– exercising care when authorizing employees

Security management program components

• The security management program of an organization needs to be well defined and documented by the security officer along with the top management

• It is the duty of the top management to ensure that all the employees in the organization are aware of the security management program

• Core components – Policies– Standards– Baselines– Guidelines

• To implement the security management program effectively within an organization, each employee should be aware of and be able to easily access the organization's policies, standards, baselines, and guidelines

Policies• A policy contains a company's directives, created by the top

management, to protect the company's assets by implementing security measures and assigning responsibilities to meet security-related objectives

• Effective security policy should be – based on the business objectives of the company– clear and acceptable to all the employees– aimed to integrate security with all business processes– upgraded regularly to include all parameters related to organizational

changes– dated and have a version number for every change– aimed to eliminate the need of reading the entire policy material– accurately defined to outline resources and assign organizational

responsibilities and authorities

Policy types • Advisory

– define the behavioral requirements of employees and state ramifications in case of noncompliance

– example : a banking organization expects its employees to not disclose any bank account details to any person other than the particular customer - if the employees do so, they will be held accountable for their actions

• Informative– are not enforceable and are meant for information purposes

only• Regulatory

– include laws, bills, and regulations, specific to a type of industry, which are enforced to meet compliance with local, state, and federal laws

Standards

• Standards– mandatory rules and actions that support and

reinforce a policy• Policies state measures, without providing

solutions to implement those measures. Standards define solutions to implement the measures stated in the policy.

• Policies remain relevant until they need to be updated in case of changes in an organization's operations. Standards are mandatory regulations that support a policy

Baselines

• Baselines– define the minimum level of security measures

required by an organization to protect itself from internal and external threats

• Baselines are established before standards are developed

• Baselines provide platform-specific implementations for the standards

Guidelines

• Guidelines– general statements that recommend actions to be

followed in case a standard does not apply

• Guidelines are the recommended actions to be followed when a specific standard does not apply

• Guidelines are general approaches while standards are specific mandatory activities

Security management program components

Components of a security framework

• People– this deals with roles and responsibilities, skills and training,

organization, attitudes, and culture• Technology– this includes applications, tools, hardware, and software

• Processes– this includes procedures, standards, metrics, and

performance monitoring• Successful security framework requires all the

components – people, processes, and technology – to work together to achieve optimal levels of security

Employment Policies and Practices

Securing your workplace• Basic steps

– Background checks• the first line of defense in securing the workplace• checking the background of an employee ensures that the employee is qualified and reliable

– Security clearance• procedure to authorize access to classified information• can be issued to individuals or groups working in the government, private industry, or

information technology• there can be multiple levels of security clearance in some organizations, based on the types of

information• different levels of security clearance have different access requirements, which become more

stringent for higher levels– Signing the employee agreement document

• an employee agreement document clearly outlines the expectation of the organization from its employees, details of the job description, rules, regulations, and the security policy

• when an employee joins an organization, the employee needs to sign the employee agreement document

• this document ensures that the employee will not violate the rules and regulations that affect the interest of the organization

Background check of an employee

Employee agreement document

Hiring and terminating

• All the rules and guidelines related to hiring and terminating an employee should be approved by the top management

• An organization should thoroughly evaluate a candidate's credentials to ensure that the candidate is appropriate for a particular job

• After terminating an employee, the organization should ensure that it has revoked the employee's access to all company information and resources

Good security practices after hiring a new employee

• Provide the end-user document– what is expected from all the employees for a particular role– lists all the schemes, rules, and policies related to security and behavior– includes the acceptable-use policy (an outline of the access privileges, rules for behavior, and

any possible consequence of breaking rules when dealing with network resources, computers, or any other company resources)

• Inform about the need to know security policies– this helps the organization safeguard its information from potential threats, such as loss or

misrepresentation of business data or damaging or removing business assets, intentionally or accidentally

• Educate about the security program– security awareness program (the organization needs to ensure that all new employees are

trained and educated on the security policies drafted by the top management)• Inform about password creation and access rights

– the IT security officer should inform the employees about ways to create strong passwords and about access rights

– information on how to create strong passwords and about the access rights is specified in the security policy document of the organization

– access rights are granted based on job description

Security awareness program

Good security practices after hiring a new employee (cont.)

• The organization needs to explain roles and responsibilities to the new employee

• This is done by providing a job description to the employee• Based on the job description, the security department assigns

appropriate permissions and grants access rights to employees• Job descriptions help the human resources department advertise

for jobs with similar roles and responsibilities• Periodic audit check for monitoring users need to be followed by

an organization to validate the access controls for various roles and responsibilities based on job descriptions

• To ensure information security, a job description should always be formally and officially changed

• Any change in the job description should be accompanied by relevant changes to the access control requirements and mechanisms defined for that role

Good security practices when terminating an employee

• restrict employees who will be terminated from accessing sensitive information

• revoke the access of terminated employees to the network

• disable the accounts of terminated employees• delete terminated employees after a specific period of

time• make terminated employees surrender all the keys and

company supplies they were using• ensure that terminated employees immediately leave

the facility

Roles and job rotations

• Every organization should define distinct roles and assign responsibilities pertaining to each role

• Based on roles and the security policies set by the organization for these roles, restrictions and permissions should be granted for each role

• This ensures that each employee is responsible for maintaining the security of information that the employee has the right to access and use

Typical roles and responsibilities • senior management

– has the overall and ultimate responsibility for security• infosec officer

– responsible for the functional aspect of security• owner

– classifies information for implementing security• custodian

– helps preserve the CIA of information• user

– performs according to the security policy defined by the organization

• auditor– examines if security is implemented properly in the organization

Separation of duties

• To implement security effectively in an organization, it is important to define a structure that helps in the separation of duties and responsibilities

• Separation of duties assigns access to information according to job role

• Benefits– introduces transparency in an organization (making it clear

who does what in a situation) – ensures that no individual is solely responsible for a critical

task (this prevents collusion and reduces the possibility of mistakes)

– restricts access to information by job role (this helps prevent computer crimes)

Job rotation

• purpose - to limit the time spent by an individual on a task so that the individual does not have complete control over it

• helps protect against frauds and misuse of information

• benefits– a person does not have complete control over a task

(reduces the security risk to information)– people working in sensitive areas are forced to take

vacations (helps detect any fraudulent activities)

Risk Management

Risk management principles

• Risk management is the process of identifying and assessing risk, identifying the cost of securing the environment, and implementing appropriate risk-reducing measures

• The risk manager should be able to foresee risks and take appropriate measures to reduce those risks to a level that is acceptable by the organization

• This can be achieved by following risk management principles

Principles of risk management

• identify risks• analyze the damage that can occur• plan and implement security measures to

mitigate risk to an acceptable level• analyze the cost of implementing the security

measures for mitigating risk

Risk categories • Risks are categorized based on various risk factors• Categorizing risks helps the risk manager identify, monitor, and calculate the

impact of the potential loss that might occur due to a risk factor• Risk categories

– application errors (computing errors, input errors, and buffer overflows, causing an application or operating system to fail)

– damage (physical damage caused to an asset because of natural disasters, fire, water, sabotage, or power failure)

– disclosure (disclosure of critical information to unauthorized users)– equipment malfunctions (to system, network, or peripheral failure)– human errors (intentional or accidental human actions that adversely affect

output)– internal and external attacks (misuse of data by hackers or crackers or

unauthorized data access by internal users)– loss of data (permanent or temporary data loss or the data inaccessibility

occurring due to unauthorized modifications)

Security Definitions• Vulnerability– software, hardware, or procedural weakness that may

provide an attacker the open door to enter a computer or network and have unauthorized access to resources within the environment

– a vulnerability characterizes the absence or weakness of a safeguard that could be exploited

– examples:• a service running on a server,• unpatched applications or operating system software,• unrestricted modem dial-in access,• an open port on a firewall,• lax physical security that allows anyone to enter a server

room, or• nonenforced password management on servers and

workstations

• Threat– any potential danger to information or systems– the threat is that someone, or something, will identify

a specific vulnerability and use it against the company or individual

• Threat agent – the entity that takes advantage of a vulnerability – examples:

• an intruder accessing the network through a port on the firewall,

• a process accessing data in a way that violates the security policy,

• a tornado wiping out a facility, or• an employee making an unintentional mistake that could

expose confidential information or destroy a file’s integrity

• Risk– the likelihood of a threat agent taking advantage of a

vulnerability and the corresponding business impact– example:

• if a firewall has several ports open, there is a higher likelihood that an intruder will use one to access the network in an unauthorized method

• if users are not educated on processes and procedures, there is a higher likelihood that an employee will make an intentional or unintentional mistake that may destroy data

• if an intrusion detection system (IDS) is not implemented on a network, there is a higher likelihood an attack will go unnoticed until it is too late

– Risk ties the vulnerability, threat, and likelihood of exploitation to the resulting business impact

• Exposure– an instance of being exposed to losses from a

threat agent– a vulnerability exposes an organization to possible

damages• if password management is lax and password rules are

not enforced, the company is exposed to the possibility of having users’ passwords captured and used in an unauthorized manner• if a company does not have its wiring inspected and

does not put proactive fire prevention steps into place, it exposes itself to potentially devastating fires

• Countermeasure (safeguard)– is put into place to mitigate the potential risk– may be

• a software configuration,• a hardware device, or• a procedure that eliminates a vulnerability or reduces the

likelihood a threat agent will be able to exploit a vulnerability

– examples• strong password management,• a security guard,• access control mechanisms within an operating system,• the implementation of basic input/output system (BIOS)

passwords, and• security-awareness training.

Threatagent

Threat

Risk

Vulnerability

Asset

Exposure

Safeguard

Gives rise to

Exploits

Leads to

Can damage

And causes an

Can be countermeasured by a

Directly affects

The relationships among the different security components

Threat analysis

• Threat is an event that causes harm to an organization's assets

• Threat analysis– the process of identifying threats and developing a

cost-effective mitigation strategy for the identified threat to lower the risk level in an organizational environment

– should be conducted during early system developmental stages and continually through the development lifecycle to facilitate change and problem management

Threat analysis (cont.)

• Threat analysis involves– mapping assets

• involves identifying all the assets of the company and mapping them to their business functions

• assets whose business functions are more critical, are given priority.

– threat modeling• involves identifying the assets an application uses to

evaluate the possible threats to that application, reducing vulnerability.

– developing a mitigation plan• involves developing appropriate security measures to reduce

the risk level

Vulnerabilities and asset valuation• Vulnerability - A point of weakness in a system, caused by a loophole or

an error, exposing the system to threats• An organization needs to conduct a vulnerability analysis because most

computer crimes are committed by people working in the organization• The use of the Internet within the organization exposes the organization

to more attackers• Once the company's assets and relevant threats and vulnerabilities have

been identified, the risk manager needs to determine the value of those assets to determine the replacement cost and how best to safeguard them

• Asset valuation process– determines the value of an asset– asset can be valued as high, medium, or low (considering the

organization's total cost incurred for the life cycle of the asset in terms of production, research and development, and criticality to the tangibles and intangibles in a business)

Vulnerability analysis techniques

• validating network access control rules• using hacker tools• testing platform misconfiguration• using security penetration report

Risk Analysis and Evaluation • Risks are associated with potential loss and cannot be eliminated

from any business• Risk analysis - method of identifying risks and assessing the

possible damage that could be caused in order to justify security safeguards

• Goals of risk analysis – Identify assets and their values– Identify vulnerabilities and threats– Quantify the probability and business impact of these potential

threats– Provide an economic balance between the impact of the threat and

the cost of the countermeasure• Risk analysis provides a cost/benefit comparison, which compares

the annualized cost of safeguards to the potential cost of loss.– A safeguard, in most cases, should not be implemented unless the

annualized cost of loss exceeds the annualized cost of the safeguard itself

Risk assessment

• Process of measuring risk by assigning value to assets, calculating annualized threat frequency, consequence, and other elements of chance

• Techniques to assess risks– Quantitative– Qualitative

Methodologies for Risk Assessment• NIST SP 800-30 and 800-66– methodologies that can be used by the general public, but

their initial creation was designed to be implemented in the healthcare field (HIPAA clients ) or other regulated industries

• The NIST SP 800=30 Risk Management methodology is commonly used by security consultants, security officers and internal IT departments, and focuses mainly on computer systems

• An individual or small team collects data from network and security practice assessments, and from people within the organization. This data is used as input values to the risk analysis steps

• The NIST approach is specific to IT threats and how they relate to information security risks

• The steps of NIST approach:– System characterization– Threat identification– Vulnerability identification– Control analysis– Likelihood determination– Impact analysis– Risk determination– Control recommendations– Results documentation

• FRAP (Facilitated Risk Analysis Process)– Designed with the intention of exploring a qualitative

risk assessment process in a manner that allows for tests to be conducted on different aspects and variations of the methodology

– The intent of this methodology is to provide an organization with the means of deciding what course and actions must be taken in specific circumstances to deal with various issues (not only for IT)

– This will allow, through the use of a prescreening process, users to determine the areas that really demand and need risk analysis within an organization

• OCTAVE – created by Carnegie Mellon University’s Software

Engineering Institute– methodology that is intended to be used in

situations where people manage and direct the risk evaluation for information security within their company

– the people are able to make the decisions regarding what is the best approach for evaluating the security of their organization

– idea• the people working in these environments best

understand what is needed and what kind of risks they are facing

• AS/NZS 4360 – takes a much broader approach to risk management

(both the NIST and OCTAVE methodologies focus on IT threats and information security risks)

– can be used to understand a company’s financial, capital, human safety, and business decisions risks

– although it can be used to analyze security risks, it was not created specifically for this purpose

• Spanning Tree Analysis – methodology that develops a tree of all the potential

threats and faults that can disrupt a system– each of the branches is a general topic or category,

and as the risk analysis is conducted, the branches that do not apply can be removed

• FMEA (Failure and Fault Analysis)– method for determining functions, identifying

functional failures, and assessing the causes of failure and their failure effects through a structured process

– the application of this process to a chronic failure enables the determination of where exactly the failure is most likely to occur

– FMEA was first developed for systems engineering– its purpose is to examine the potential failures in

products and the processes involved with them– this approach proved to be successful and has been

more recently adapted for use in evaluating of risk management priorities and mitigating known threat-vulnerabilities

• Fault tree analysis– a more useful approach to identifying failures that

can take place within more complex environments and systems

– follows this general process• first, an undesired effect is taken as the root or top

event of a tree of logic. • then, each situation that has the potential to cause that

effect is added to the tree as a series of logic expressions. • fault trees are then labeled with actual numbers

pertaining to failure probabilities. • this is typically done by using computer programs that

can calculate the failure probabilities from a fault tree.

Failure Event A

Failure Event C

Failure Event F

Failure Event DFailure Event B

Failure Event E

OR

AND

Fault tree and logic components

Top-level failure event isbroken down into possiblecontributory failure events

Quantitative risk assessment • Is done by assigning real numbers to

– the cost of countermeasures– the amount of damage caused by the risk– all other elements of risk assessment

• Advantages– the CIA of information and loss are better understood because

of statistical data– a cost/benefit assessment of countermeasures can be done,

which helps decide the security budget– the evaluation and tracking of the risk management process can

be performed– the analyst need not be an expert but can use his basic

knowledge and formulae to identify the financial loss

Quantitative risk assessment (cont.)

• Disadvantages– calculations are complex and need to be explained to

understand the results– an automated risk assessment tool is required

because manual calculations are time consuming– a lot of information regarding the object and its

environment needs to be collated to decipher risk points

– there is no standard threat knowledgebase; as a result users need to entirely depend on their threat research

Qualitative risk assessment • Is a subjective analysis of risk, which is not based on assigning

monetary values but is done by ranking threats, countermeasures, and damage caused

• Qualitative risk assessment determines risk relative to its environment, based on surveys, interviews, and group discussions

• Advantages– calculations are simple and easily understood– the monetary values of the CIA of information are usually not required– threat frequency and impact of threat do not need quantification– the cost of countermeasures does not need to be calculated because

the process is not quantitative; so a cost/benefit analysis is not required

– information about significant risk areas is provided

Qualitative risk assessment (cont.)

• Disadvantages– there is a high degree of guesswork because the

assessment data is subjective and based on the opinion of experts

– the subjective interpretation of risk may not reveal the actual value of the risk to assets

– a cost/benefit analysis of risk mitigation measures cannot be done; and as a result, determining the cost of countermeasures required to safeguard is not possible

– the objective tracking of the risk management process cannot be done because of subjective processes and metrics

Risk Analysis Matrix• The Risk Analysis Matrix uses a quadrant to map the likelihood of a

risk occurring against the consequences (or impact) that risk would have

• The Risk Analysis Matrix allows you to perform Qualitative Risk Analysis based on likelihood (from “rare” to “almost certain”) and consequences (or impact), from “insignificant” to “catastrophic”

• The resulting scores are– Low (L), Medium (M), High (H), and Extreme Risk (E)

• Low risks are handled via normal processes; moderate risk require management notification; high risks require senior management notification, and extreme risks require immediate action including a detailed mitigation plan (and senior management notification)

• The goal of the matrix is to identify high likelihood/high consequence risks (upper right quadrant of Table), and drive them down to low likelihood/low consequence risks (lower left quadrant of Table)

Risk Analysis MatrixConsequences

Like

lihoo

d

5. Almost CertainH H E E E

4. LikelyM H H E E

3. PossibleL M H E E

2. UnlikelyL L M H E

1. RareL L M H H

Insignificant1

Minor2

Moderate3

Major4

Catastrophic5

Performing risk assessment• Terms

– Exposure Factor (EF)• expressed as a percent• represents the magnitude of asset loss caused by the identified

threat– Single Loss Expectancy (SLE)

• represents the amount of loss incurred because of a single type of identified threat

– Annualized Rate of Occurrence (ARO)• represents the annual frequency of the occurrence of a threat

– Annualized Loss Expectancy (ALE)• gives the value of loss that will be incurred annually in case of a

threat• this value helps an organization decide the amount it needs to

spend on protection against the threat

Performing risk assessment - Calculations

• Exposure Factor (EF) (%)– exposure factor = percentage of asset loss caused by the identified

threat• Single Loss Expectancy (SLE) ($)

– single loss expectancy = asset value * exposure factor• Annualized Rate of Occurrence (ARO)

– annualized rate of occurrence = annual frequency of occurrence of a threat

– The range can be from 0.0 (never) to 1.0 (at least once a year) to greater than one (several times a year) and anywhere in between

• Annualized Loss Expectancy (ALE) – annualized loss expectancy = single loss expectancy * annualized rate

of occurrence

Example 1

• Data warehouse has the asset value of $150,000; it was estimated that if a fire were to occur, 25 percent of the warehouse would be damaged (and not more, because of a sprinkler system and other fire controls, proximity of a firehouse, and so on). What is the value of single loss expectancy (SLE) ?

• If the frequency of a fire taking place has an annualized rate of occurrence (ARO) value of 0.1 (indicating once in ten years), then what is the value of annualized loss expectancy (ALE) ?

Answer

• SLE = asset value * EF• SLE = $150,000 * 0.25 = $37,500

• SLE * annualized rate of occurrence (ARO) = ALE• ALE = $37,500 * 0.1 = $3750

• The ALE value tells the company that if it wants to put in controls or safeguards to protect the asset from this threat, it can sensibly spend $3750 or less per year to provide the necessary level of protection

Delphi method• Group discussion technique that requires each member to

express his honest comments about a particular risk on a piece of paper

• All these anonymous comments are then handed over to the analysis group and are compiled and redistributed again for further comments until consensus is reached

• Can be used to– assess the impact of company growth– educate participants on all the different aspects of a topic– explore assumptions and discrete information, which leads to

different judgments– develop a number of alternatives– gather information for forming the basis of future agreements

Modified Delphi technique

• Silent form of brainstorming• Participants develop ideas individually and

silently with no group interaction• The ideas are submitted to a group of decision

makers for consideration and action

Selecting countermeasures• The outcome of risk assessment helps the risk manager find

countermeasures to safeguard the organization from identified risks• The risk manager needs to ensure that the cost incurred to safeguard

the company from the identified risks is not greater than the potential loss

• Cost/benefit analysis (CBA)• process of finding out the most cost-effective countermeasures• compares the ALE without the countermeasure, with the cost of

protection, to the ALE after installing the countermeasure• the formula to find the cost of a countermeasure :

– Value of countermeasure = ALE (without countermeasure) – (annual) Cost (safeguard) - ALE (with countermeasure)

Example 2

• If the ALE of the threat of a hacker bringing down a web server is $12,000 prior to implementing the suggested safeguard

• the ALE is $3000 after implementing the safeguard• the annual cost of maintenance and operation of the

safeguard is $650• Value of countermeasure = ALE (without

countermeasure) – (annual) Cost (safeguard) - ALE (with countermeasure

• $12,000 - $650 - $3000 = $8350• the value of this safeguard to the company is $8350

each year

Full cost of a countermeasure• Product costs• Design/planning costs• Implementation costs• Environment modifications• Compatibility with other countermeasures• Maintenance requirements• Testing requirements• Repair, replacement, or update costs• Operating and support costs• Effects on productivity• Subscription costs• Extra man-hours for monitoring and responding to alerts

Total Risk and Residual Risk• Total risk

– the risk a company faces if it chooses not to implement any type of safeguard– a company may choose to take on total risk if the cost/benefit analysis results

indicate this is the best course of action– total risk = threats * vulnerability * asset value

• Residual risk– the value of the risk after implementing a countermeasure– a company implements countermeasures to reduce its overall risk to an

acceptable level– there is always some risk left over to deal with– controls gap

• protection the control cannot provide– residual risk = total risk * controls gap

• Conceptual formulas– f( threats, vulnerability, and asset value ) = total risk– total risk – countermeasures = residual risk

Risk handling• After completing the risk assessment process and finding the cost of

countermeasures to safeguard the organization from the risks, it is time to decide how to handle identified risks

• Options for handling the identified risk– risk acceptance

• accept the risk and the loss incurred due to the risk and will not act at all to protect against the risk

– risk reduction• adopt countermeasures to reduce the risk

– risk transfer• purchase insurance policies against the risk to transfer the loss

incurred due to damage to the insurance company– risk avoidance

• terminate the activity that is introducing the risk

PLAN1.Identify team2.Identify scope3.Identify method4.Identify tools5.Understand acceptablerisk level

COLLECT INFORMATION1.Identify assets2.Assign value to assets3.Identify vulnerabilitiesand threats4.Calculate risks5.Cost/benefit analysis6.Uncertainty analysis

DEFINE RECOMMENDATIONS1.Risk mitigation2.Risk transference3.Risk acceptance4.Risk avoidance

Management

RISK MITIGATION•Control selection•Implementation•Monitoring

RISK TRANSFERENCE•Purchase insurance

RISK ACCEPTANCE•Do nothing

RISK AVOIDANCE•Discontinue activity

Risk management program

Roles and Responsibilities

• The management is not only responsible for creating security policies but also for educating employees about the security policies

• Security awareness training– educates employees on the importance of security policies

and makes them aware of their roles and responsibilities in securing the organization as a whole

– should be realistic and achievable– communication plays a crucial role in the security

awareness training program– a trainer should be appointed who can clearly understand

the security policies of the organization and cen communicate them to the employees with ease

Roles and Responsibilities (cont. 1)

• Examples of different types of security awareness training programs– advanced infosec training for information system

security officers and auditors– awareness training for employees holding security-

sensitive positions or for training employees on new applications

– security-related job training for security personnel– security training for senior, functional, and business

managers– technical support training for IT personnel

Roles and Responsibilities (cont. 2)

• Organizational roles– security awareness training program should be

first targeted at three specific groups of employees within the organization because these groups are often present in every organization

• Individuals• Stewards (Application owners)• Custodians

Individuals

– Each individual in an organization is responsible for protecting the organization's assets

– An individual can perform different roles within the organization

– data owner• usually part of the senior management who is responsible

for – classifying data– reviewing data to meet changing business needs– ensuring the implementation of security controls– determining access rights, security, and backup requirements for

data– acting on security violation notifications

Individuals (cont.)• security administrator

– responsible for • configuring security access controls according to data environments• creating or deleting system user accounts and issuing passwords • assigning access control privileges• implementing and testing security software and patches

• security professional– holds the functional responsibility of security and performs the sensitive operations stated by

his immediate manager

• security analyst – is not part of the implemention team for security but determines the strategies and guidelines

for the overall security design of the organization

• senior manager – holds the responsibility of multiple departments for protecting the company's assets by

performing a cost/benefit analysis of the security practices followed by the company.

Stewards • The user is any person who uses data for performing job-related

activities• The user is responsible for protecting the data by adhering to the

security policies and maintaining the confidentiality, integrity, and availability of data

• Steward– senior business managers responsible for the creation, maintenance,

and performance of information systems related to specific business units

– responsibilities• categorizing data based on the data-classification scheme• classifying critical data effectively to meet contingencies • defining validation rules for correct data input• ensuring the training of data users• understanding the uses and risks associated with data in order to provide

appropriate data access permissions

Custodians

• Custodian– IT personnel responsible for the security and maintenance

of the information provided to them by stewards• Responsibilities– protecting information from unauthorized access and

modifications– performing backups or restoring data according to the

requirements specified by the organization– monitoring information systems to ensure compliance with

company policies and standards– providing stewards with reports about information system

usage

Other roles in an organization• change control analyst

– takes care of all the changes that take place in the organization's information system

– responsibilities• approving or rejecting change requests• analyzing the impact of changes• ensuring that changes do not lead to vulnerabilities• testing all changes before they are rolled out

• data analyst– ensures that an organization's data is properly structured and comprehensible– responsibilities

• designing data structures and data models in compliance with business objectives• designing the physical database structure• helping the data owner develop data architectures• recording metadata to manage databases

Other roles in an organization (cont.)

• process owner– ensures that all processes in an organization are well defined to meet business

needs– responsibilities

• defining data requirements and improving data quality for business processes• defining, improving, and monitoring processes to make the processes effective• resolving the data issues related to complex processes and the processes associated with

different application types

• product line manager– ensures that all products meet the business requirements of the organization– responsibilities

• translating business requirements into product requirements• evaluating the need for product enhancement • planning and implementing new releases• ensuring that products comply with license agreements• monitoring production performance per business objectives• analyzing product usage and the technology required for product usage

Other roles in an organization (cont.)

• solution provider– works with the business managers to develop and deploy

solutions for improving business processes or solving problems– responsibilities

• ensuring that applications and data work together to meet business needs

• giving technical requirements to improve the process

• system owner– incorporates security considerations into applications, purchase

decisions, and projects– responsibilities

• assessing systems for vulnerabilities• ensuring that proper security measures are adopted• reporting security incidents to the data owner

Other roles in an organization (cont.)

• supervisor– also called the user manager– holds the complete responsibility of employee activities and the assets

used by the employees– also takes care of nonemployee activities and the company assets

used by these individuals– responsibilities

• informing the security administration for revoking the user IDs of terminated employees

• informing the administration about the transfer of an employee• reporting security violation incidents• receiving and assigning user IDs to new employees• ensuring that the user ID and account information of an employee are

synchronized• educating the employees about the security policies they are accountable for

Questions

• 1. Who has the primary responsibility of determining the classification level for information?– A. The functional manager– B. Senior management– C. The owner– D. The user

C. A company can have one specific data owner or different data owners whohave been delegated the responsibility of protecting specific sets of data. Oneof the responsibilities that goes into protecting this information is properlyclassifying it.

• 2. Which group causes the most risk of fraud and computer compromises?– A. Employees– B. Hackers– C. Attackers– D. Contractors

A. It is commonly stated that internal threats comprise 70–80 percent ofthe overall threat to a company. This is because employees already haveprivileged access to a wide range of company assets. The outsider who wantsto cause damage must obtain this level of access before she can carry outthe type of damage internal personnel could dish out. A lot of the damagescaused by internal employees are brought about by mistakes and systemmisconfigurations.

• 3. If different user groups with different security access levels need to access the same information, which of the following actions should management take?– A. Decrease the security level on the information to

ensure accessibility and usability of the information.– B. Require specific written approval each time an

individual needs to access the information.– C. Increase the security controls on the information.– D. Decrease the classification label on the

information.

C. If data is going to be available to a wide range of people, more granularsecurity should be implemented to ensure that only the necessary people access the data and that the operations they carry out are controlled. The security implemented can come in the form of authentication and authorization technologies, encryption, and specific access control mechanisms.

• 4. What should management consider the most when classifying data?– A. The type of employees, contractors, and

customers who will be accessing the data.– B. Availability, integrity, and confidentiality.– C. Assessing the risk level and disabling

countermeasures.– D. The access controls that will be protecting the

data.B. The best answer to this question is B, because to properly classify data,the data owner must evaluate the availability, integrity, and confidentialityrequirements of the data. Once this evaluation is done, it will dictate whichemployees, contractors, and users can access the data, which is expressed inanswer A. This assessment will also help determine the controls that shouldbe put into place.

• 5. Who is ultimately responsible for making sure data is classified and protected?– A. Data owners– B. Users– C. Administrators– D. Management

D. The key to this question is the use of the word “ultimately.” Thoughmanagement can delegate tasks to others, it is ultimately responsible foreverything that takes place within a company. Therefore, it must continuallyensure that data and resources are being properly protected.

• 6. What is a procedure?– A. Rules on how software and hardware must be

used within the environment– B. Step-by-step directions on how to accomplish a

task– C. Guidelines on how to approach security

situations not covered by standards– D. Compulsory actions

B. Standards are rules that must be followed; thus, they are compulsory.Guidelines are recommendations, while procedures are step-by-step instructions.

• 7. Which factor is the most important item when it comes to ensuring security is successful in an organization?– A. Senior management support– B. Effective controls and implementation methods– C. Updated and relevant security policies and

procedures– D. Security awareness by all employees

A. Without senior management’s support, a security program will not receivethe necessary attention, funds, resources, and enforcement capabilities.

• 8. When is it acceptable to not take action on an identified risk?– A. Never. Good security addresses and reduces all

risks.– B. When political issues prevent this type of risk from

being addressed.– C. When the necessary countermeasure is complex.– D. When the cost of the countermeasure outweighs

the value of the asset and potential loss.

D. Companies may decide to live with specific risks they are faced with if thecost of trying to protect themselves would be greater than the potential lossif the threat were to become real. Countermeasures are usually complex to adegree, and there are almost always political issues surrounding different risks, but these are not reasons to not implement a countermeasure.

• 9. What are security policies?– A. Step-by-step directions on how to accomplish

security tasks– B. General guidelines used to accomplish a specific

security level– C. Broad, high-level statements from the

management– D. Detailed documents explaining how security

incidents should be handled

C. A security policy captures senior management’s perspectives and directiveson what role security should play within the company. Security policies areusually general and use broad terms so they can cover a wide range of items.

• 10. Which is the most valuable technique when determining if a specific security control should be implemented?– A. Risk analysis– B. Cost/benefit analysis– C. ALE results– D. Identifying the vulnerabilities and threats

causing the risk

B. Although the other answers may seem correct, B is the best answer here.This is because a risk analysis is performed to identify risks and come up withsuggested countermeasures. The ALE tells the company how much it couldlose if a specific threat became real. The ALE value will go into the cost/benefit analysis, but the ALE does not address the cost of the countermeasure and the benefit of a countermeasure. All the data captured in answers A, C, and D are inserted into a cost/benefit analysis.

• 11. Which best describes the purpose of the ALE calculation?– A. Quantifies the security level of the environment– B. Estimates the loss possible for a

countermeasure– C. Quantifies the cost/benefit result– D. Estimates the loss potential of a threat in a span

of a year

D. The ALE calculation estimates the potential loss that can affect one assetfrom a specific threat within a one-year time span. This value is used to figureout the amount of money that should be earmarked to protect this asset from this threat.

• 12. Tactical planning is:– A. Midterm– B. Long term– C. Day-to-day– D. Six months

A. Three types of goals make up the planning horizon: operational, tactical,and strategic. Tactical goals are midterm goals that must be accomplishedbefore the overall strategic goal is accomplished.

• 13. What is the definition of a security exposure?– A. An instance of being exposed to losses from a

threat– B. Any potential danger to information or systems– C. An information security absence or weakness– D. A loss potential of a threat

A. An exposure is an instance of being exposed to losses from a threat agent.A vulnerability can cause an organization to be exposed to possible damages.For example, if password management is lax and password rules are notenforced, the company can be exposed to the possibility of having users’passwords captured and used in an unauthorized manner.

• 14. An effective security program requires a balanced application of:– A. Technical and nontechnical methods– B. Countermeasures and safeguards– C. Physical security and technical controls– D. Procedural security and encryption

A. Security is not defined by a firewall, an access control mechanism, asecurity policy, company procedures, employee conduct, or authenticationtechnologies. It is defined by all of these and how they integrate togetherwithin an environment. Security is neither purely technical nor purelyprocedural, but rather a mix of the two.

• 15. The security functionality defines the expected activities of a security mechanism, and assurance defines:– A. The controls the security mechanism will enforce– B. The data classification after the security mechanism

has been implemented– C. The confidence of the security the mechanism is

providing– D. The cost/benefit relationship

C. The functionality describes how a mechanism will work and behave. Thismay have nothing to do with the actual protection it provides. Assuranceis the level of confidence in the protection level a mechanism will provide.When systems and mechanisms are evaluated, their functionality andassurance should be examined and tested individually.

• 16. Which statement is true when looking at security objectives in the private business sector versus the military sector?– A. Only the military has true security.– B. Businesses usually care more about data integrity and

availability, whereas the military is more concerned with confidentiality.

– C. The military requires higher levels of security because the risks are so much higher.

– D. The business sector usually cares most about data availability and confidentiality, whereas the military is most concerned with integrity.

B. Although answer C may seem correct to you, it is a subjective answer.Businesses will see their threats and risks as being more important thananother organization’s threats and risks. The military has a rich historyof having to keep its secrets secret. This is usually not as important in thecommercial sector relative to the military.

• 17. How do you calculate residual risk?– A. Threats × risks × asset value– B. (Threats × asset value × vulnerability) × risks– C. SLE × frequency = ALE– D. (Threats × vulnerability × asset value) × controls

gap

D. The equation is more conceptual than practical. It is hard to assign anumber to a vulnerability and a threat individually. This equation enablesyou to look at the potential loss of a specific asset, as well as the controls gap(what the specific countermeasure cannot protect against). What remainsis the residual risk, which is what is left over after a countermeasure isimplemented.

• 18. Which of the following is not a purpose of doing a risk analysis?– A. Delegating responsibility– B. Quantifying the impact of potential threats– C. Identifying risks– D. Defining the balance between the impact of a

risk and the cost of the necessary countermeasure

A. The other three answers are the main reasons to carry out a risk analysis. An analysis is not carried out to delegate responsibilities. Management will take on this responsibility once the results of the analysis are reported to it and it understands what actually needs to be carried out.

• 19. Which of the following is not a management role in the process of implementing and maintaining security?– A. Support– B. Performing risk analysis– C. Defining purpose and scope– D. Delegating responsibility

B. The number one ingredient management must provide when it comes tosecurity is support. Management should define the role and scope of securityand allocate the funds and resources. Management also delegates who doeswhat pertaining to security. It does not carry out the analysis, but rather isresponsible for making sure one is done and that management acts on theresults it provides.

• 20. Why should the team that will perform and review the risk analysis information be made up of people in different departments?– A. To make sure the process is fair and that no one is left out.– B. It shouldn’t. It should be a small group brought in from

outside the organization because otherwise the analysis is biased and unusable.

– C. Because people in different departments understand the risks of their department. Thus, it ensures the data going into the analysis is as close to reality as possible.

– D. Because the people in the different departments are the ones causing the risks, so they should be the ones held accountable.

C. An analysis is only as good as the data that goes into it. Data pertaining torisks the company faces should be extracted from the people who understandbest the business functions and environment of the company. Each department understands its own threats and resources, and may have possible solutions to specific threats that affect its part of the company.