Introduction to MONARC

Optimised Risk Analysis Method

Security Made In Lëtzebuerg / CASES

Cyberworld Awareness and Security Enhancements Services

February 12, 2020

Team CASES Introduction to MONARC February 12, 2020 1 / 31

 Who we are

Security Made In Lëtzebuerg (SMILE)

Our timeline

2003: Cyberworld Awareness and Security Enhancements Services

(CASES);
2007: Computer Incident Response Center Luxembourg (CIRCL);
2010: SMILE is a GIE (Groupement d’Intérêt Économique);
2017: Cyber security Competence Center (C3).

Team CASES Introduction to MONARC February 12, 2020 2 / 31

 Who we are

CASES

Mission
Promote information security by supporting Luxembourg administrations and
SMEs.

Services:

awareness: article publications;

trainings: introduction to cyber security for different audiences 1 ;
software: MONARC, Fit4Cybersecurity, MOSP, TACOS, etc.2

1
https://www.cases.lu/services/trainings.html
2
https://github.com/CASES-LU
Team CASES Introduction to MONARC February 12, 2020 3 / 31
 Who we are

Content at glance

1 What is MONARC?

2 The method

3 The tool

Team CASES Introduction to MONARC February 12, 2020 4 / 31

 What is MONARC?

Summary

1 What is MONARC?
An open source software
A community
A method

2 The method

3 The tool

Team CASES Introduction to MONARC February 12, 2020 5 / 31

 What is MONARC? An open source software

An open source software

Web application (SaaS, self-hosted, virtual machine, etc.);

source code3 under GNU Affero General Public License version
3;
data under CC0 1.0 Universal (CC0 1.0) - Public Domain
Dedication.

For many users, it started with a spreadsheet.

3
https://github.com/monarc-project
Team CASES Introduction to MONARC February 12, 2020 6 / 31
 What is MONARC? A community

A community

sharing of risk models and all kind of objects (assets, threats,

vulnerabilitties, recommendations, referentials, etc.);
data available via a sharing platform: MOSP4 ;
more than 130 organizations on https://my.monarc.lu.

4
https://objects.monarc.lu/organization/MONARC
Team CASES Introduction to MONARC February 12, 2020 7 / 31
 What is MONARC? A method

A method
Based on ISO/IEC 27005:2011, but optimized

Team CASES Introduction to MONARC February 12, 2020 8 / 31

 The method

Summary

1 What is MONARC?

2 The method
Management of risk
An optimized method

3 The tool

Team CASES Introduction to MONARC February 12, 2020 9 / 31

 The method Management of risk

A Structured, Iterative and Qualitative method

Structured: 1, 2, ..., n.
Iterative: Plan, Do, Check, Act
Qualitative: Values / Consequence
Impact/Consequence, Threat,
Vulnerability;
reputation, image;
operation;
legal;
financial;
person (to the).

Team CASES Introduction to MONARC February 12, 2020 10 / 31

 The method Management of risk

Automated and simplified management

Method based on ISO/IEC 27005

Team CASES Introduction to MONARC February 12, 2020 11 / 31

 The method Management of risk

Automated and simplified management

Sub-stages provided by the method are also in line with ISO/IEC 27005

Team CASES Introduction to MONARC February 12, 2020 12 / 31

 The method Management of risk

ISO/IEC 27005:2011
Information risks

Formula

R = I ×T ×V

impact on Confidentiality Integrity Availability;

on secondary assets.

Team CASES Introduction to MONARC February 12, 2020 13 / 31

 The method Management of risk

ISO/IEC 27005:2011
Operational risks

Formula

R = I ×P

impact on ROLFP;
on primary assets.

Team CASES Introduction to MONARC February 12, 2020 14 / 31

 The method An optimized method

Optimizations

MONARC is an optimized method:

inheritance;
scope of objects;
models;
deliverables.

Team CASES Introduction to MONARC February 12, 2020 15 / 31

 The method An optimized method

Inheritance
Modelling

Team CASES Introduction to MONARC February 12, 2020 16 / 31

 The method An optimized method

Inheritance
Formalisation of the modelling

Team CASES Introduction to MONARC February 12, 2020 17 / 31

 The method An optimized method

Inheritance
Formalisation of an asset

Example with OV BATI

Team CASES Introduction to MONARC February 12, 2020 18 / 31

 The method An optimized method

Scope of objects
Global or local assets

Team CASES Introduction to MONARC February 12, 2020 19 / 31

 The method An optimized method

Inheritance of impacts

Team CASES Introduction to MONARC February 12, 2020 20 / 31

 The method An optimized method

Deliverables

Shareable templates of deliverables.

Team CASES Introduction to MONARC February 12, 2020 21 / 31

 The tool

Summary

1 What is MONARC?

2 The method

3 The tool
Architecture
Workshop
Modules
Roadmap

Team CASES Introduction to MONARC February 12, 2020 22 / 31

 The tool Architecture

Team CASES Introduction to MONARC February 12, 2020 23 / 31

 The tool Workshop

Le’ts work a little!

training instance: https://formation.monarc.lu;

login: user en X@monarc.lu, where 01 ≤ X ≤ 15;
password: Password1234!

Preferably use Firefox, alternatively Chrome. But not Internet Explorer.

Team CASES Introduction to MONARC February 12, 2020 24 / 31

 The tool Modules

Dashboard

provide different visualizations of the current analysis state;

visualizations are exportable (.png, .csv, .pptx).

Team CASES Introduction to MONARC February 12, 2020 25 / 31

 The tool Modules

Statement of Applicabitity

Statement of Applicability (SOA) and compliance level for a referential security.

Team CASES Introduction to MONARC February 12, 2020 26 / 31

 The tool Modules

Record of processing activities

Register of the information treatment for processing activities.

Team CASES Introduction to MONARC February 12, 2020 27 / 31

 The tool Roadmap

Latest notable developments

port of the backend to Zend Framework 3 (MONARC 2.9.1);

records of processing activities for the GDPR (MONARC 2.9.0);
management of set of recommendations (MONARC 2.9.0);
connection with MOSP (MONARC 2.8.2);
statement of applicability (MONARC 2.7.0).

Team CASES Introduction to MONARC February 12, 2020 28 / 31

 The tool Roadmap

Future developments

LDAP;
single sign-on;
improvements of the dashboard towards a security weather forecast;
enhancements to the sharing of MONARC objects (via MOSP5 );
link between GDPR module and some objects in MONARC;
new front-end.

Idea → Feature request

5
https://objects.monarc.lu
Team CASES Introduction to MONARC February 12, 2020 29 / 31
 Services

Services related to MONARC

help at deploying;
help at using;
trainings;
developments, feature requests.

Team CASES Introduction to MONARC February 12, 2020 30 / 31

 End of the presentation

End of the presentation

Thank you for listening.

Contact: info@cases.lu
https://github.com/monarc-project
https://www.monarc.lu

Team CASES Introduction to MONARC February 12, 2020 31 / 31