Fundamental Concepts of InfoSec Risk Management (Part 3 of 8)

Difference between between "analysis", "assessment" and "management"

It is important to understand risk activities and its distinctions.
Sometimes security consultants or auditors will focus on business controls in their own context, bypassing the fact that controls exist for the purpose of managing risk.

Often other non-auditing managers don’t perceive management responsibilities in terms of controls or risks. Or, they may characterize controls as safeguards or countermeasures without recognizing that the issue is risk management. They may think of risk as just another element of the processes and activities they manage. However, although they may not think explicitly about how they manage risk, they certainly have an intuitive position on risk management. For example, "If we don’t get this project done on time and on budget, we’re going to be in deep trouble."

Q: How do you distinguishing between "analysis", "assessment" and "management" activities?

In relation to information systems;

• Risk analysis is an examination of information to identify the risk to an information system.
• Risk assessment is the formal description and evaluation of risk to an information system.
• Risk management is the process of identifying and applying countermeasures commensurate with the value of the assets protected based on a risk assessment.

Risk analysis action consists of identifying and analyzing the elements of risk and their relationships. It is "A systematic use of available information to determine how often specified events may occur and the magnitude of their consequences."

Therefore, risk analysis should produce a risk profile that assigns a significance rating to each risk and provides a tool for prioritizing risk reduction (often called treatment) actions to give a view of the relative importance.

Risk assessment action means establishing the consequences of risk realization and determining risk mitigation strategies on a cost/benefit basis.

It is also described as " The overall process of risk analysis and risk evaluation."

Risk evaluation is "The process used to determine risk management priorities by comparing the level of risk against predetermined standards, target risk levels or other criteria."


Q: How do you explain the difference between "risk analysis" and "risk asessment"?
The dictionary definition of "Assessment" is simply:
"the classification of someone or something with respect to its worth"

The dictionary definition of "Analysis" is:

"an investigation or abstract seperation of an intellectual or material, and
the separation of whole into its constituent parts,
for for individual study of such constituent parts,
and their interrelationships in making up a whole."

The terms assessment and analysis are related, but sometimes (erronously) used interchangeably.

During an assessment of a business problem or opportunity, we ask the questions:

• What is the problem?
• How important is it?
• What happens if we ignore the problem?

During the analysis of the cause of a business problem (cause analysis), we may ask the questions such as the following (to study the components):

• What caused the problem?
• What does it affect?
• How much does the problem cost?
• Who is responsible for fixing it?
• What will fix the problem?
• Is the “fix” worth the investment?
• Are the underlying issues ones of ineffective business processes, poor business management, or insufficient employee capability?

In terms of information security risks, risk analysis involves the identification and estimation of risks. This forms part of the risk assessment - which is the evaluation of the risk.

The individual risk components which can be analysed can include a variety of items such as threats, vulnerabilities and impacts that cause, or result in events, the probabilities of the events, and its consequences to business assets and resources.

However, it should always be done as part of the whole (the entire organization and the related business processes) and not in isolation.

Q: What is the difference between "risk assessment" and "risk management"?
The terms "risk management" and "risk assessment" are related, but they are not interchangeable.

Risk management is the overall effort to manage risk to an acceptable level across the business. It is comprised of four primary phases: Assessing Risk, Conducting Decision Support, Implementing Controls, and Measuring Program Effectiveness.

ISO/IEC Guide 73:2002, defines risk management as: "coordinated activities to direct and control an organization with regard to risk"

Note: Risk management typically includes risk assessment, risk treatment, risk acceptance and risk communication.

Risk Management is defined in AS/NZS 4360:1999 as " the culture, processes and structures that are directed towards the effective management of potential opportunities and adverse effects". and " the systematic application of management policies, procedures and practices to the tasks of establishing the context, identifying, analysing, evaluating, treating, monitoring and communicating risk. "

Risk assessment is defined as the process to identify and prioritize risks to the business. It refers mainly to the "Assessing Risk phase" within the larger risk management cycle.

Another distinction between risk management and risk assessment is the frequency of initiation of each process. Risk management is defined as an ongoing cycle, but it is typically re-started at regular intervals to refresh the data in each stage of the management process. The risk management process is normally aligned with an organization's fiscal accounting cycle to align budget requests for controls with normal business processes. An annual interval is most common for the risk management process to align new control solutions with annual budgeting cycles.

I hope that clears up some of the confusion around these different concepts.

Regards,

Ciske

Fundamental Concepts of InfoSec Risk Management (Part 2 of 8)

Understanding Risk Analysis and Management

It is important that the information-security profession speak the essential language of business when communicating the risks and the ROI of risk-management measures to management. The profession also must ensure that its audience understands what information-security and audit professionals are saying. By using a consistent language to convey risk, it becomes possible to establish effective channels of communication among information-security practitioners, auditors, business managers, and governance officials.

To continue our previous discussion on understanding and agreeing on the basic concepts...

Q: What is "Risk Analysis"?
ISO/IEC Guide 73:2002, defines risk analysis as: "systematic use of information to identify sources and to estimate the risk".

Risk Analysis is the process of examining a system and its operational context to determine possible exposures and the possible harm they can cause.

• A study of risk that a business or system is subject to.
• A process to determine exposure and potential loss.

Risk Analysis can also be described as "The process of gathering and analyzing risk-related information in the preparation of a risk assessment."

The FERMA Risk Management Standard, (pp. 6-9.) specifies that Risk analysis include the following:
Risk identification - this sets out to identify an organisation’s exposure to uncertainty.
This needs to cover the organisation itself, its market and the environment in which it operates.

Risk description - display(ing) the identified risks in a structured format.
Risk estimation monitoring - covering both opportunities and threats in a structured manner.
This can involve quantitative, semi-quantitative and qualitative approaches.

Risk analysis methods and techniques - the Standard offers a range of techniques, covering both ‘upside’ and ‘downside’ risks.

Risk profile: This assigns a significance to each risk and provides a tool for prioritising risk assessment effort.

Q: What are the two risk analysis technique options?
"Quantitative analysis" and "Qualitative analysis".
In short,

• Qualitative relates to that which is characteristic of something and which makes it what it is.

• Quantitative relates to, concerning, or based on the amount or number of something, capable of being measured or expressed in numerical terms.

Q: What is "Quantitative Risk Analysis"?
This approach employs two fundamental elements;

• the probability of an event occurring and
• the likely loss should it occur.

Quantitative risk analysis makes use of a single figure produced from these elements. This is called the 'Annual Loss Expectancy (ALE)' or the 'Estimated Annual Cost (EAC)'. This is calculated for an event by simply multiplying the potential loss by the probability. It is thus theoretically possible to rank events in order of risk (ALE) and to make decisions based upon this.

The problems with this type of risk analysis are usually associated with the unreliability and inaccuracy of the data. Probability can rarely be precise and can, in some cases, promote complacency

Q: What is "Qualitative Risk Analysis"?
This is by far the most widely used approach to risk analysis. Probability data is not required and only estimated potential loss is used.

Most qualitative risk analysis methodologies make use of a number of interrelated elements:
Threats

These are things that can go wrong or that can 'attack' the system. Examples might include fire or fraud. Threats are ever present for every system.

Vulnerabilities

These make a system more prone to attack by a threat or make an attack more likely to have some success or impact. For example, for fire a vulnerability would be the presence of inflammable materials (e.g. paper).

Controls
These are the countermeasures for vulnerabilities. There are four types:

• Deterrent controls reduce the likelihood of a deliberate attack

• Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact

• Corrective controls reduce the effect of an attack

• Detective controls discover attacks and trigger preventative or corrective controls.

Q: What is "Risk Evaluation"?
ISO/IEC Guide 73:2002, defines risk evaluation as: "the process of comparing the estimated risk against given risk criteria to determine the significance of the risk" and "judgement, on the basis of risk analysis, of whether the risk reduction objectives have been achieved"

The FERMA Risk Management Standard describes Risk evaluation as
"comparing the estimated risks against the risk criteria that the organisation has established. Risk criteria may include associated costs and benefits, legal requirements, socio-economic and environmental factors […]"


Q: What is "Risk Assessment"?
ISO/IEC Guide 73:2002, defines risk assessment as: "the overall process of risk analysis and risk evaluation"

Risk assessment is a detailed articulation of the risks associated with the information assets and supporting IT&C resources at risk, threats that could adversely impact those assets, and vulnerabilities that could allow those threats to occur with greater frequency or impact. See: risk analysis.

The Institute of Internal Auditors (IIA) Standards define risk assessment as "a systematic process for assessing and integrating professional judgments about probable adverse conditions and/or events. The risk assessment process should provide a means of organizing and integrating professional judgments for development of the audit work schedule."

Q: What are three different "Risk Assessment" approaches?
According to the ISO 13335-2 standard, the three risk assessment approaches are:

• high-level risk assessment,
• detailed risk assessment, and
• iterative process

High-level Assessment Process

The high-level assessment serves to scope the task and to identify threats, vulnerabilities and risks with information that is immediately available. From this, it should be possible to identify the appropriate controls to treat the risks. The first decision point occurs following the high-level assessment.

At this decision point, if sufficient information has been available for a satisfactory assessment, then risks can be treated, and the assessment process considered to be completed.

Detailed Risk Assessment Process

If, however, insufficient information has been available, for any of the context, threat, and vulnerabilities, then at this first decision point, it should be decided to begin again and conduct a detailed risk assessment. For this detailed risk assessment, additional information will need to be gathered, to expand the scope, to establish a more definitive context, considering for example external influences and constraints, and to research applicable threats and vulnerabilities.

Iterative Risk Assessment Process
The risk treatment process can be also iterative (repetition and recurrence).

Depending on the outcome of the risk treatment, it might be necessary to go back to the starting point and refining the context, or repeat risk treatment process.

Risk treatment process is considered as complete when all unaccepted risks are addressed.

In summary, the iterative risk management process:

• carries out an initial high-level risk assessment to identify the most valuable and critical information, processes and systems and the risks to which they are exposed;
• treats risks with baseline controls for processes and systems that are either at low risk or of low value or criticality;
• after the initial high-level assessment, determines what additional information could be needed to assess risks, especially for information and systems considered to be high risk or high value or criticality;
• conducts a detailed risk assessment for these systems;
• continues the iterative process until acceptable risk management decisions have been made for all information processes and systems.
  

Q: What is the difference between initial and continous 'risk identification'?
The identification of risk can be separated into two distinct phases. There is:
- initial risk identification

for an organisation which has not previously identified its risks in a structured way, or for a new organisation, or perhaps for a new project or activity within an organisation, and there is;

- continuous risk identification

which is necessary to identify new risks which did not previously arise, changes in existing risks, or risks which did exist ceasing to be relevant to the organisation (this should be a routine element of the conduct of business).

Q: What is "Residual Risk"?
Risk that remains after safeguards have been implemented. (Risk that remains to an information asset even after an existing control has been applied.)

Equation:
(threats x vulnerability x asset value) x control gap = residual risk

To express it another way, (Trygstad, 2005) “Residual Risk is a combined function of
(1) a threat less the effect of some threat reducing safeguards;
(2) a vulnerability less the effect of some vulnerability reducing safeguards and
(3) an asset less the effect of some asset value reducing safeguards.”

No control can ever offer absolute assurance, there will always be a residual risk.


Q: What is "Total Risk"?
Total risk - when a company chooses not to implement any type of safeguard. Reasoning for this would be because of the cost/benefit analysis results.

Threats x vulnerability x asset value = total risk


Q: What is "Inherent Risk"?

Care should also be taken to capture information about the inherent risk. If this is not done the organisation will not know what its exposure will be if control should fail. Knowledge about the inherent risk also allows better consideration of whether there is over-control in place - if the inherent risk is within the risk appetite, resources may not need to be expended on controlling that risk.

Q: What is “Risk Appetite”?

Risk appetite is the degree of risk, on a broad-based level, that a company or other entity is willing to accept in pursuit of its goals. Management considers the entity’s risk appetite first in evaluating strategic alternatives, then in setting objectives aligned with the selected strategy and in developing mechanisms to manage the related risks.

When considering vulnrabilities and threats, the concept of risk appetite embraces the level of exposure which is considered tolerable and justifiable should it be realised. In this sense it is about comparing the cost (financial or otherwise) of constraining the risk with the cost of the exposure should the exposure become a reality and finding an acceptable balance.

Risk appetite has three key elements, (CAREY, 2005) which I often develop and use in a tabular format:
1. Impact -helps the user to identify and measure the potential consequences of a risk/event to the organization.
2. Likelihood -measures the probability that the risk/event will come to fruition and will actually result in a loss.
3. Risk Response Table -a scorecard that directs mitigating action based on the overall risk level the organization faces for each risk/event.

Various types of impacts should be identified so that your full range of risk events can be assessed on a level playing field against each other. Each risk level should have a corresponding response, commensurate to the existing risk exposure. The responses can include escalation pathways and levels, timeframes, other parties that must be informed, etc. The risk appetite approach and response approach must be communicated throughout the organization.

Q: What is the difference between "Risk Appetite" and "Risk Tolerance"?

Both risk appetite and risk tolerance set boundaries of how much risk an entity is prepared to accept. Risk appetite is a higher level statement that considers broadly the levels of risks that management deems acceptable while risk tolerances are more narrow and set the acceptable level of variation around objectives.

For instance, a company that says that it is does not accept risks that could result in a significant loss of its revenue base is expressing appetite. When the same company says that it does not wish to accept risks that would cause revenue from its top-10 customers to decline by more than 10% it is expressing tolerance. Operating within risk tolerances provides management greater assurance that the company remains within its risk appetite, which, in turn, provides a higher degree of comfort that the company will achieve its objectives. (IIA, n.d.)

The IEC definition for tolerable risk is:
"risk which is accepted in a given context based on the current values of society"

Tolerable risk is the result of a balance between the ideal of absolute safety, the demands to be met by a product, process or service, and factors such as benefit to the user, suitability of purpose, cost effectiveness, risk evaluation, conventions of the society concerned, and the state of the art.

Refer: http://std.iec.ch/terms/terms.nsf/0/9845B4A982C8E8DAC1256F5F004BC1A2?OpenDocument



Q: What is "Operational Risk"?

Operational risk is defined as the risk of loss resulting from inadequate or failed processes, people, and systems or from external events. The definition includes legal risk, which is the risk of loss resulting from failure to comply with laws as well as prudent ethical standards and contractual obligations. It also includes exposure to litigation from all aspects of an institutions activities.

Traditionally, operational risk can be associated with the following:

• People: losses associated with intentional violation of internal policies by current or past employees.

• Process: losses that have been incurred due to a deficiency in an existing procedure, or the absence of a procedure. Losses can result from human error or unintentional failure to follow an existing procedure.

• Systems: losses that are caused by unintentional breakdowns in existing systems or technology.

• External: losses occurring as a result of natural or man-made forces, or the direct result of a third party's action.

Q: What is "Risk Mitigation Analysis"?

Risk Mitigation Analysis is the process of identifying safeguards or controls that suitably prevent threat events, detect threat events for subsequent corrective action, or contain the loss that may arise from threat events. Risk mitigation analysis also includes applicable cost/benefit and ROI analysis. For example, is the annualized safeguard or control cost less than the annualized expected risk loss, and is the resulting ROI acceptable?

By quantifying the risk, we can justify the benefit of spending money to implement controls;: RISK = LOSS ($) x PROBABILITY.


Q: What is "Risk Audit"?

Risk Audit is an audit that provide an independent assessment of the risk management practices of a company, and verifies that the company has appropriate risk management controls, and that it adheres to these to controls and mitigates risk in compliance with approved policies and procedures.

Q: What is the criteria used when evaluating risk?
Risks of an organization are evaluated by three distinguishing characteristics:
- A loss associated with an event, e.g., disclosure of confidential data, lost time, lost revenues.
- The likelihood that the event will occur, i.e.probability of occurrence of event
- The degree to which the risk outcome can be influenced, i.e. controls that will influence the event.


Q: What is "Risk Response" ? (also referred to as "risk reduction strategies")
Risk response fall within the categories of risk avoidance, reduction, sharing, and acceptance.
Avoidance responses take action to exit the activities that give rise to the risks.

Reduction responses reduce the risk likelihood, impact, or both.

Sharing responses (also sometimes referred to as "Transferring the risk"), reduces risk likelihood or impact by transferring or otherwise sharing a portion of the risk - allocating the risk to other systems, people, organizations assets or by buying insurance.

Acceptance responses take no action to affect likelihood or impact, but attempts to control it with available resources.

As part of enterprise risk management, for each significant risk an entity considers potential responses from a range of response categories. This gives sufficient depth to response selection and also challenges the “status quo.”

Q: What is "Risk Exposure"?
The extent of potential damage is defined as "risk exposure" or "asset exposure". The Business Owner is responsible for both identifying assets and estimating potential loss to asset or the organization. As a review, the asset class, exposure, and the combination of threat and vulnerability define the overall impact to the organization. The impact is then combined with probability to complete the "risk statement"; Risk-impact x Risk-probability = Risk-exposure.

Quantifying the effects of a risk by multiplying the risk impact by the risk probability yields risk exposure.
i.e. Risk-exposure = Risk-impact x Risk-probability
e.g., if the likelihood of virus attack is 0.3 and the cost to clean up the affected systems and files is $10,000, then the risk exposure is $3,000.
$3,000 = $10,000 x 0.3

Example 1 : A Hard Disk Failure on your PC.
Hard Disks fail about every three years.
So, the Likelihood/Probability is 1/3 per year .
The hardware cost is $300 to buy a new disk .
But also, add 10 hours of effort to reload the OS, software, and restore from the last backup.
And 4 more hours to recreate things since the backup.
Assume $10.00 per hour for your effort
Total loss = $300 + 10 x (10 + 4) = $440
Annual loss expectancy: (440 x 1/3) $pa = $147 pa


Example 2: A virus attack on the same system
You frequently swap files with other people, but have no ant-viral software running.
Assume an attack every 6 months
That’s a Probability of 2 per annum
No need to buy a new disk
Rebuild effort (10 + 4) hours,
Total loss = 10 x(10+4) = $140
ALE = ( 140 x 2 ) $pa = $280 pa



Q: What is a "Risk Baseline"?

Baselining is the analysis of measures against established standards. A baseline approach to risk treatment requires the establishment of a minimum set of controls to safeguard all or some of the agency’s information against the most common threats.

In information security, baselining is the comparison of security activities and events against the organization’s future performance. These baseline controls are compared with existing or planned safeguards for the context being considered. Those that are not in place, and are applicable, should be implemented. An early step in the baseline approach may be a gap analysis of existing controls against a baseline.

When baselining it is useful to have a guide to the overall process. The risk in the baseline approach is that there may be unidentified assets, ‘non-standard’ threats or vulnerabilities that is missed by gap analysis and/or baseline controls. Lack of an Information Security Policy exacerbates this risk.

Q: What is a "Risk analyst"?
Risk analyst: an individual whose primary task is the identification and evaluation of risks during the risk review.


Q: What is a "Risk custodian"?
Risk custodian: an individual who has responsibility for monitoring, controlling and minimising the project’s residual risks.


Q: What is a "Risk assessment table"?
Risk assessment tables: tables that may be used to allocate ‘scores’ to risks, to help in prioritising them.

That's it for today, folks! I have covered quite a bit of risk terms and concepts.

Regards,

Ciske

References:
IIA - Institute of Internal Auditors (IIA) the international professional association - Online: http://www.theiia.org/?doc_id=4883

CAREY, M (2005) DelCreo, Inc. - Enterprise Risk Management: How To Jumpstart Your Implementation Efforts
Online: http://www.irmi.com/Expert/Articles/2005/Carey02.aspx#1

TRYGSTAD, R. (2005) , Risk Management I and II, Illionois Institute of Technology, ITM 578. Online: www.itm.iit.edu/578/lesson4/lesson04.ppt

Fundamental Concepts of InfoSec Risk Management. (Part 1 of 8)

There seems to be a general lack of awareness among information security professionals about the importance, and the need to thoroughly understand the fundamental concepts of Risk Management.

Nearly all companies today are living under the well-known Chinese curse: 'May you live in interesting times'. They face increasing demands for performance from shareholders and other stakeholders. Their markets are globalizing while their industries are consolidating.

But our experience with clients suggests that they are not always certain about what they should be doing to manage risks strategically or how to do it.

But, we are making some progress. During recent engagements at major financial institutions in Europe, I noted that there are more organizations that do realize the value of risk management being a a line management function, and not a staff function. It is a management
activity and is integral with decision-making. As Peter Drucker, celebrated “father of modern
management” puts it, “a decision that does not involve risk, probably is not a decision.”

"All business is risky business. It's no wonder, then, that senior managers are paying greater attention to risk management as a strategic function." (MICCOLIS, 2000)

Risk is inevitable within business environments. Taking and managing risk is part of what organisations must do to create profits and shareholder value.
Risk management is a discipline for dealing with uncertainty. Every organization faces uncertainty and risk. Few, if any, operate in risk-free environments.

No matter how small or large, any company needs to understand risk. Owners, directors and managers who have a good practical knowledge of risk management are better able to take advantage of opportunities - and to protect their businesses from events that might otherwise cause them serious damage

The reasons organizations undertake risk management projects are both external and internal.
External motivation comes from corporate governance studies (such as the reports from the Cadbury, Hampel, and Turnbull Committees in the United Kingdom, the Dey Report in Canada, and the Peters Report in the Netherlands), mandatory bills (such as the KonTraG in Germany), and pressure from institutional investors-all of whom insist that risk management be a board-level responsibility and the scope be all-encompassing.

During the coming months, I will explore the concept of "risk management" within the context of information security management.

Let's start with some basic definitions around the common risk terms and definitions.

Q: What is "Uncertainty"?
Uncertainty: a source of risk derived from a lack of sufficient knowledge about the underlying probabilities of adverse events and/or their consequences.

"Uncertainty" is the central issue of risk and risk metrics. It can be reflected as the level of confidence, from zero to 100 percent, that the associated numbers - and derived results - are credible and useful. Failure to integrate uncertainty into risk analysis/assessment approaches substantially reduces the credibility and utility of their results.

In many risk methodologies, uncertainty is represented using likelihood of occurrence, or probability.


Understandng the relationship between "Uncertainty" and "Risk"

Q: What is the essential difference between "Uncertainty" and "Risk"?
The concepts of "Uncertainty" and "Risk" go hand in hand, but they are not identical. Uncertainty is an objective feature of the universe while risk is in the eye of the beholder. Uncertainty is the same for all observers.
For example: The risk to you is that revenues will be less than $200,000, forcing you out of business. The risk to your competitors is that revenues will be greater than $200,000, forcing them to continue to contend with you.


Q: What is an "Asset"?
An asset is anything of value (people, information, hardware, software, facilities, reputation, activities, and operations). Assets are what an organization needs to get the
job done-to carry out the mission. The more critical the asset is to an organization accomplishing its mission, the greater the effect of its damage or destruction. An example is the loss of an organization’s file and print server. This loss would significantly reduce an organization’s ability to access and move data. The loss would have greater consequences if it occurred during a key operation or the server could not be repaired or replaced for several days.

It is important to note the key aspects from which value are derived:
a.) The assets impact on the business mission, and critical operations
b.) The time aspect that can significantly affect the value of the asset.

Individual personnel is likely to each assign a different value for any particular asset. For a security consultant, it is necessary to consider the value f the asset in hollisticly; i.e. in its relation to the overall mission of the organization, as well as its operational use.
The reliance on the asset can be measure by analysis the frequency of use, its interaction with other business resources and processes, the impact unavailability or loss may have on those processes, or the potential result of unauthorized disclosure on the organization.


Q: What is "Risk"?
Risk is the likelihood of variation in the occurrence of an event, which may have either positive or negative consequences.

The NIST 800-30 standard defines risk as:
Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization.

In other words, "risk" is the probability that a specific threat will successfully exploit a vulnerability causing a loss.

According to the ISO/IEC Guide 73:2002, risk is defined as a “combination of the probability of an event and its consequences” and a “combination of the extent to which an occurrence of a particular set of circumstances is likely to occur and its outcome.”

The ISO/IEC guide notes that “consequences can range from positive to negative” and “in some situations, risk arises from the possibility of deviation from the expected outcome or event”.

So risk has three components;
1) an event,
2) probability of occurance of the event, and
3) consequences of the event.

The consequences can be positive or negative but there must be some negative events. It is noted that “there can be more than one consequence
from one event”.

This definition links the concept of risk in the safety areas with the concept of risk in business through the notes on “deviation from expected” and the idea that positive consequences are considered.

Note that the key element of risk is uncertainty, without which, there is no “risk.”

In information security terms, risk is the possibility that a particular threat will adversely impact an information system by exploiting a particular vulnerability.


Q: What is the difference between "risk" and "hazard"? (IRGC)
Hazards describe the potential for harm or other consequences of interest. These potentials may never even materialise if, for example, people are not exposed to the hazards or if the targets are made resilient against the hazardous effect (such as immunisation).
In conceptual terms, hazards characterise the inherent properties of the risk agent and related processes, whereas risks describe the potential effects that these hazards are likely to cause on specific targets such as buildings, ecosystems or human organisms and their related probabilities.


Q: What are the requirements for risk to exist?
The risk exists because of the combination of threats, vulnerability and asset value.


Q: What is "Risk Identification"?
The process of identifying risks considering business objectives, threats and vulnerabilities as the basis for further analysis.


Q: What is an "Information system"?
An information system is the entire infrastructure, organization, personnel, and components for the collection, processing, storage, transmission, display, dissemination, and disposition of information.


Q: What is a "Vulnerability"?
The Concise Oxford dictionary defines the term Vulnerability: "is susceptible to damage".
Vulnerability has been defined as follows: (Vidalis, 2003)

• A point where a system is susceptible to attack
• A weakness in the security system that might be exploited to cause harm or loss
• Some weakness of a system that could allow security to be violated .

A vulnerability can also be described as "a lack or inadequate application of a safeguard or control that allows a threat event to occur with greater frequency or impact."

However for the purpose of a threat assessment we require a definition that is more general to information security and encompasses both, information technology, communication systems and business processes. Therefore we will use the following definition: "Vulnerability is a measure of the exploitability of a weakness".
Even more accurately, the ISO/IEC 13335-1:2004 standard defines vulnerability as "a weakness of an asset or group of assets that can be exploited by one or more threats"

It is a weakness of an asset or group of assets that a threat may exploit, or a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

In simplified terms, vulnerabilities provide the mechanism or the how threats may occur. For additional reference, NIST defines vulnerability as a condition or weakness in (or absence of) security procedures, technical controls, physical controls, or other controls that could be exploited by a threat. As an example, a common vulnerability for hosts is the absence of security updates. Incorporating the threat and vulnerability examples previously given produces the following statement: "Unpatched hosts may lead to a breach of the integrity of financial information residing on those hosts."

It is important to note that: (Harold, 2004)
A vulnerability that cannot be exploited by a threat is not harmful to the asset. Vulnerability is a characteristic of an information asset or group of information assets that can be exploited by a threat.

Vulnerability is often a consequence of a poor management decision, flawed procedures, underskilled staff, incorrectly configured systems, defective technology, and so on. For a vulnerability to be exploitable, it must be known to or discoverable by a threat. Thus, it is important to monitor access control regarding information security and apply it to both people and technology.


Q: What is a "Threat"?
The Concise Oxford dictionary defines the word Threat:
"Declaration of intention to punish or hurt; menace of bodily hurt or injury to reputation or property, such as may restrain a person’s freedom of action indication of something undesirable coming."

Other dictionary definitions define it as: "something that is a source of danger; i.e. 'earthquakes are a constant threat in Japan' "

A threat to a system can also be defined as: "A circumstance or event that has the potential to cause harm by violating security." (Vidalis, 2003)
The ISO/IEC 13335-1:2004 standard defines threat as: "a potential cause of an unwanted incident, which may result in harm to a system or organization"

The potential need to exist for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability.

A "threat-source" is either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.

For the purposes of understanding the concept of threat in context of information security; threat is a function of a threat agent’s motivation, their capability, the opportunity, and the impact that a successful attack would have on an organization.
Threat = Function (Motivation, Capability, Opportunity, Impact)


Q: What is a "Threat-analysis"?
Threat analysis is the examination of threat-sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment.


Q: What is a "Threat statement"?
A threat assessment is a statement of threats that are related to vulnerabilities of company assets and threat agents, and also a statement of the believed capabilities that those threat agents possess.


Q: What is "Impact"?
Impact - The loss or harm attributable to a threat event, quantitatively derived in monetary terms as Asset Value X Exposure Factor = Impact, or single loss exposure, and qualitatively expressed by a variety of metrics ranging from ordinal ranking to terms such as “minimal,” “acceptable,” and “unacceptable.”


Q: What is a "Propability"?
"Probability" measures the chance or likelihood of an outcome or event occurring within a finite universe of possibilities or time, from zero (no chance) to 1.0 (certainty).

In other words, it is the chance, or in some cases, the mathematical certainty that a given event will occur; the ratio of the number of outcomes in an exhaustive set of equally likely outcomes that produce a given event to the total number of possible outcomes.

The following are common major "Probability Factors":
Conditions and sets of conditions that will worsen or increase asset exposure to risk of loss can be divided into the following major categories:
1. Physical environment (construction, location, composition, configuration)
2. Social environment (demographics, population dynamics)
3. Political environment (type and stability of government, local law enforcement resources
4. Historical experience (type and frequency of prior loss events)
5. Procedures and processes (how the asset is used, stored, secured)
6. Criminal state-of-art (type and effectiveness of tools of aggression)

Application of Probability Factors Analyses
The practical value of loss risk analysis depends upon the skill and thoroughness with which the basic risks to an enterprise are identified. This is the first and most important step in the entire process. Every aspect of the enterprise or facility under review must be examined to isolate those conditions, activities, and relationships
that can produce a loss. For an effective analysis, the observer must take into account the dynamic nature of the enterprise on each shift and between daylight and darkness. The daily routine must be understood, because the loss-producing causes can vary from hour to hour. [Asis, 2002]


Five categories of probability can establish useful (quantitative) distinctions among events, as follows:
(A) Virtually Certain
Given no changes, the event will occur. For example, given no changes, a closed intake valve on a sprinkler riser will prevent water flow in event of fire.

(B) Highly Probable
The likelihood of occurrence is much greater than that of nonoccurrence. For example, unprotected currency lying visible on a counter is very likely to be taken.

(C) Moderately Probable
The event is more likely to occur than not to occur.

(D) Less Probable
The event is less likely to occur than not to occur. This does not imply impossibility, merely improbability.

(E) Probability Unknown
Insufficient data are available for an evaluation.

This approximate system of ratings contains wide latitude for variation. Two observers could assign different probabilities to the same risk, based upon different evaluations of the circumstances. But an advantage of this technique is that absolute precision is not important. If the correct general label can be attached, it doesn’t
matter that a highly probable risk might have a ratio of .751 or .853. What is important is to be able to segregate all risks of virtually certain probability from all others, and to make similar distinctions for each other general class. Even competent professionals may disagree on what is highly probable and what is moderately probable. To compensate for inexactness, if a rating is in doubt after all available information has been gathered and evaluated, then the higher of two possible ratings should be assigned.


Q: What is the relationship between "likelihood" and "impact"?
Likelihood represents the possibility that a given event will occur, while impact represents its effect should it occur.
Estimates of risk likelihood and impact often are determined using data from past observable events, which may provide a more objective basis than entirely subjective estimates.


Q: What is "Assurance"?
Assurance is defined as: "Performance of appropriate activities or processes to instil confidence that a deliverable meets objectives."
The ISO/IEC 15408-1 standard defines it as: "Grounds for confidence that an entity meets its security objectives"

Assurance is grounds for confidence that the other four security goals (integrity, availability, confidentiality, and accountability) have been adequately met by a specific implementation. “Adequately met” includes (1) functionality that performs correctly, (2) sufficient protection against unintentional errors (by users or software), and (3) sufficient resistance to intentional penetration or bypass.


Q: What is "Assurance level"?
Aassurance level: The amount of assurance obtained according to the specific scale used by the assurance method.
1. the assurance level may not be measurable in quantitative terms.
2. The amount of assurance obtained is generally related to the effort expended on the activities performed.

Q: What is "risk management"?
Risk Management has been described as 'all the things you need to do to make the future sufficiently certain'.

Risk management ‘refers to planning, monitoring and controlling activities which are based on information produced by risk analysis activity.
Together, the process of risk analysis followed by the process of risk management can be considered part of the overall management of risk.

NASA defines risk management as:
"An organized, systematic decision-making process that efficiently identifies risks, assesses or analyzes risks, and effectively reduces or eliminates risks to achieving the program goals." (Greenfield, 1998)

The ISO 13335-2 standard describes Information security risk management as a process that identifies the context, assesses the risks, treats the risk and proposes a security plan to implement the recommendations and decisions.
Risk management analyses in depth what can happen and what damage can be before defining what should be done (and when) to reduce the damage to an acceptable level. The implementation, operation and monitoring of these solutions is part of security management.
Risk management should be applied in all information security management processes. The information

The information security risk management process consists of two main elements: risk assessment and risk treatment.


Q: What are the common definitions of 'risk management'?
Risk management is the process of identifying and evaluating risks and selecting and managing techniques to adapt to risk exposures. - http://www.risk-glossary.com/
It has also been defined as "the process of managing risks identified in the risk review using the risk mitigation strategy and the risk response plan."

There are several definitions and descriptions for risk management:
Simply stated, risk management is a systematic and analytical process by which an organization identifies, reduces, and controls its potential risks and losses. This process allows organizations to determine the magnitude and effect of the potential loss, the likelihood of such a loss actually happening, and countermeasures that could lower the probability or magnitude of loss.

Whereas a single countermeasure may seem intuitive to an analyst or security manager, alternative countermeasures should be identified and evaluated to select those which offer an optimal trade-off between risk reduction and cost. Organizations seek an “acceptable” level of risk that reflects the best combination of security and cost.

Risk management principles acknowledge that while risk generally cannot be eliminated, enhancing protection from known or potential threats can reduce it. As described in this paper, a risk management approach has several elements: an assessment of assets, an assessment of threats, an assessment of vulnerabilities as well as countermeasures and continuous assessment.

Successful risk management organizations have senior management who support and are involved in the process, employ the concept of “Risk Acceptance Authority” and create procedures for establishing and tracking accountability. - Information Solutions Division of Veridian (course on Continuous Risk Management).


Q: What is the definition of "Enterprise Risk Management"?
Enterprise risk management is defined [by COSO] as follows:
Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

This definition reflects certain fundamental concepts.
Enterprise risk management:

• Is a process - it's a means to an end, not an end in itself
• Is effected by people - it's not merely policies, surveys and forms, but involves people at every level of an organization
• Is applied in strategy setting
• Is applied across the enterprise, at every level and unit, and includes taking an entity-level portfolio view of risks
• Is designed to identify events potentially affecting the entity and manage risk within its risk appetite
• Provides reasonable assurance to an entity's management and board
• Is geared to the achievement of objectives in one or more separate but overlapping

Q: What are the characteristics of "Active risk management"?
Active risk management involves:
identifying possible risks in advance and putting mechanisms in place to minimise the likelihood of their materialising with adverse effects;
having processes in place to monitor risks, and access to reliable, up-to-date information about risks;
the right balance of control in place to mitigate the adverse consequences of the risks, if they should materialise; and
decision-making processes supported by a framework of risk analysis and evaluation.


Q: What are the benefits of risk management?
Effective risk management helps the achievement of wider aims, such as: effective change management; the efficient use of resources; better project management; minimising waste and fraud; and supporting innovation. (HM Treasury, 2003)


Q: What is "information security risk management processes"?
The processes which are usually included in risk management, include:

• Establishing Context
• Risk Analysis (identification, estimation) and Assessment (evaluation)
• Risk Treatment
• Risk Acceptance
• Risk Communication
• Risk monitoring and review

I welcome your comments and further discussion on these, to broaden the collective understanding and gain agreement on these definitions.

Regards,

Ciske
email: ciske@infosecrisks.com

References:
Asis (2002) General Security Risk Assessment Guideline - Asis International.
Internet: www.asisonline.org/guidelines/guidelinesgsra.pdf
Accessed on 11 June 2007

HM Treasury (2003) Greenbook - Annex 4: Risk and Uncertanty
Internet: http://greenbook.treasury.gov.uk/annex04.htm
Accessed on 11 June 2007

GREENFIELD, M.A. Dr. (1998) NASA - Langley Research Center. Risk Management “Risk As A Resource”
Internet: http://www.hq.nasa.gov/office/codeq/risk/risk.pdf
Accessed on 11 June 2007

IRGC - International risk governance council (IRGC) (2005) A Whitepaper on Risk Governance Towards an Integrative Approach. Online: http://www.irgc.org/_cgidata/mhscms/_images/12326-3-2.pdf

VIDALIS, S (2003) A Critical Discussion of Risk and Threat Analysis Methods and Methodologies
Internet: www.glam.ac.uk/socschool/research/publications/technical/CS-04-03.pdf

HEROLD, R. (2004) The Practical Guide To Managing Risks, NetiQ
Internet: http://download.netiq.com/Library/eBooks/Practical/Chapter3.pdf

MICCOLIS, J. (2000) Tillinghast-Towers Perrin - Enterprise Risk Management: What's Beyond the Talk?
Internet: http://www.irmi.com/Expert/Articles/2000/Miccolis05.aspx