FM-AA-CIA-15 Rev.

0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

4
STUDY GUIDE FOR MODULE NO. ___

PRINCIPLES OF INFORMATION SECURITY

(RISK MANAGEMENT)

MODULE OVERVIEW

Information security risk management, or ISRM, is the process of managing risks associated with the use of
information technology. It involves identifying, assessing, and treating risks to the confidentiality, integrity, and
availability of an organization’s assets. The end goal of this process is to treat risks in accordance with an
organization’s overall risk tolerance. Businesses shouldn’t expect to eliminate all risks; rather, they should seek
to identify and achieve an acceptable risk level for their organization.

MODULE LEARNING OBJECTIVES

At the end of this learning activity, you should be able to:

1. Define risk management: risk identification, and risk control.
2. Understand how risk is identified and assessed.
3. Describe the risk mitigation strategy options for controlling risks.
4. Evaluate risk controls and formulate a cost benefit analysis.
5. Understand how to maintain and perpetuate risk controls.

LEARNING CONTENTS | INTRODUCTION

• Risk management: process of identifying and controlling risks facing an organization

• Risk identification: process of examining an organization’s current information technology security
situation
• Risk control: applying controls to reduce risks to an organizations data and information systems

Components of Risk Management

Figure 1

PANGASINAN STATE UNIVERSITY 1

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Competitiveness

• Information Technology Role

• Began as an advantage
• Now falling behind is a disadvantage

• Availability is a necessity

An Overview of Risk Management

• Know yourself
• Understand the technology and systems in your organization
• Know the enemy
• Identify, examine, understand threats
• Role of Communities of Interest
• Information Security
• Management and Users
• Information Technology

The Roles of the Communities of Interest

• Information security, management and users, information technology all must work together.

• Management review:
• Verify completeness/accuracy of asset inventory
• Review and verify threats as well as controls and mitigation strategies
• Review cost effectiveness of each control
• Verify effectiveness of controls deployed

LEARNING CONTENTS | RISK IDENTIFICATION

Risk identification is the process of identifying and assessing threats to an organization, its operations, and its
workforce. For example, risk identification may include assessing IT security threats such as malware and
ransomware, accidents, natural disasters, and other potentially harmful events that could disrupt business
operations. Companies that develop robust risk management plans are likely to find they’re able to minimize
the impact of threats, when and if they should occur.

• Assets are targets of various threats and threat agents.

• Risk management involves identifying organization’s assets and identifying threats/vulnerabilities.
• Risk identification begins with identifying organization’s assets and assessing their value.

PANGASINAN STATE UNIVERSITY 2

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

FIGURE 2. Components of Risk Identification

Asset Identification and Valuation

• Iterative process; begins with identification of assets, including all elements of an organization’s system
(people, procedures, data and information, software, hardware, networking)
• Assets are then classified and categorized

Traditional System SecSDLC and risk management system components

Components

People Employee Trusted employees

Other staff

Non-employees People at trusted organizations / Strangers

Procedures Procedures IT & business standards procedures

IT & business standards procedures

Data Information Transmission, Processing, Storage

Software Software Applications, Operating systems, Security

components

Hardware System devices and Systems and peripherals

peripherals Security devices

Networking components Intranet components

Internet or DMZ components

PANGASINAN STATE UNIVERSITY 3

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

People, Procedures, and Data Asset Identification

• Human resources, documentation, and data information assets are more difficult to identify
• People with knowledge, experience, and good judgment should be assigned this task
• These assets should be recorded using reliable data-handling process
• Asset attributes for people: position name/number/ID; supervisor; security clearance level; special skills
• Try to avoid names
• Asset attributes for procedures
• Intended purpose
• Relationship to software, hardware, network elements
• Storage location
• Asset attributes for data
• classification; owner/creator/manager; data structure size; data structure used; online/offline;
location; backup procedures employed

Hardware, Software, and Network Asset Identification

• What information attributes to track depends on:

• Needs of organization/risk management efforts
• Management needs of information security/information technology communities
• Asset attributes to be considered are:
• Name (device or program name)
• IP address
• Media access control (MAC) address
• Element type – server, desktop, etc. Device Class, Device OS, Device Capacity
• serial number
• manufacturer name; model/part number
• software versions
• physical or logical location
• Software version, update revision
• Physical location
• Logical location
• Where on network
• Controlling entity
• Organization unit to which it belongs

Information Asset Classification

• Many organizations have data classification schemes (e.g., confidential, internal, public data)
• Classification must be specific enough to allow determination of priority
• Comprehensive – all info fits in list somewhere
• Mutually exclusive – fits in one place
• Questions help develop criteria for asset valuation: which information asset
• is most critical to organization’s success?
• generates the most revenue?
• generates the most profit?
• would be most expensive to replace?
• Questions help develop criteria for asset valuation: which information asset
• would be most expensive to protect?
• would be most embarrassing or cause the greatest liability is revealed?

PANGASINAN STATE UNIVERSITY 4

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Table 1. Example Worksheet for the Asset Identification on Information Systems

Listing Assets in Order of Importance

• Weighted factor analysis

• Calculate the relative importance of each asset
• Each info asset assigned score for each critical factor (0.1 to 1.0)
• Impact to revenue
• Impact to profitability
• Impact to public image
• Each critical factor is assigned a weight (1-100)
• Multiply and add

Table 2. Example of a Weighted Factor Analysis Worksheet

PANGASINAN STATE UNIVERSITY 5

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Data Classification and Management

• Variety of classification schemes used by corporate and military organizations

• Georgia-Pacific Corporation (G-P) scheme
• Confidential, sensitive or proprietary
• Internal, G-P employee, authorized contractors
• External, public
• U.S. military classification scheme
• Unclassified Data
• Sensitive by unclassified data
• Confidential data
• Secret data
• Top secret data
• Information owners responsible for classifying their information assets
• Information classifications must be reviewed periodically
• Most organizations do not need detailed level of classification used by military or federal agencies.
Organizations may need to classify data to provide protection
• Public
• For official use only
• Sensitive
• classified
• Assign classification to all data
• Grant access to data based on classification and need
• Devise some method of managing data relative to classification

Security Clearances

• Security clearance structure: each data user assigned a single level of authorization indicating
classification level
• Before accessing specific set of data, employee must meet need-to-know requirement
• Extra level of protection ensures information confidentiality is maintained

Management of Classified Data

• Storage, distribution, portability, and destruction of classified data

• Information not unclassified or public must be clearly marked as such
• Clean desk policy requires all information be stored in appropriate storage container daily; unneeded
copies of classified information are destroyed
• Dumpster diving can compromise information security

LEARNING CONTENTS | RISK ASSESSMENT

Risk assessments are used to identify, estimate and prioritize risks to organizational operations and assets
resulting from the operation and use of information systems.

Risk assessment is primarily a business concept and it is all about money. You have to first think about how
your organization makes money, how employees and assets affect the profitability of the business, and what
risks could result in large monetary losses for the company. After that, you should think about how you could
enhance your IT infrastructure to reduce the risks that could lead to the largest financial losses to organization.

Basic risk assessment involves only three factors: the importance of the assets at risk, how critical the threat is,
and how vulnerable the system is to that threat. Using those factors, you can assess the risk—the likelihood of
money loss by your organization. Although risk assessment is about logical constructs, not numbers, it is useful
to represent it as a formula:

PANGASINAN STATE UNIVERSITY 6

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Risk = (likelihood of occurrence of vulnerability * value of the information asset) – [(likelihood of occurrence of
vulnerability * value of the information asset)* (% of risk mitigated by current controls)] + [(likelihood of
occurrence of vulnerability * value of the information asset) * (uncertainty of current knowledge of vulnerability)]

Likelihood

• Probability that a specific vulnerability within an organization will be successfully attacked

• Assign number between 0.1 – 1
• Data is available for some factors
• Likelihood of fire
• Likelihood of receiving infected email
• Number of network attacks

Valuation of Information Assets

• Using info from asset identification assign weighted score for the value
• 1 -100
• 100 – stop company operations
• May use broad categories
• NIST has some predefined

Identify Possible Controls

• For each threat and associated vulnerabilities that have residual risk, create preliminary list of control
ideas
• Residual risk – risk remaining after controls are applied

Access Controls

• Mandatory
• Gives user and data owners limited control over access to information
• Lattice-based
• Users are assigned a matrix of authorizations for particular areas of access
• Nondiscretionary
• Role or task based controls
• Centralized
• Discretionary
• Option of the user

Vulnerability Identification

• Identify each asset and each threat it faces

• Create a list of vulnerabilities
• Examine how each of the threats are likely to be perpetrated

Problem

1. Information asset A has a value score of 50 and has one vulnerability. Vulnerability 1 has a likelihood
of 1.0 with no current controls, & you estimate the assumptions and data are 90% accurate. Assess the
risk.
2. Information asset B has a value score of 100 and has 2 vulnerability. Vulnerability 2 has a likelihood of
0.5 with current controls address 50% of its risk, vulnerability 3 has a likelihood of 0.1 with no current
controls, & you estimate the assumptions and data are 80% accurate. Assess the risk.

PANGASINAN STATE UNIVERSITY 7

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Solution

Risk = (likelihood of occurrence of vulnerability * value of the information asset) – [(likelihood of occurrence of
vulnerability * value of the information asset)* (% of risk mitigated by current controls)] + [(likelihood of
occurrence of vulnerability * value of the information asset) * (uncertainty of current knowledge of vulnerability)]

1. Given: Value of the asset = 50; likelihood = 1; current control = 0; accuracy = 90%

Risk of Asset A = (50 X 1.0) – [(50 X 1.0) X0%] + [(50 X 1.0) X10%]

= 50 – 0 + 5

= 55

2. Given: Value of the asset = 100; likelihoodv2 = 0.5; likelihoodv3 = .1; current controlv2 = 50%; current
controlv3 = 0; accuracy = 80%

Risk of Asset B (V2) = (100 X .5) – [(100 X .5) *50%] + [(100 X .5) *20%]
= 50- 25 + 10
= 35

Risk of Asset B (V3) = (100 X .1) – [(100 X .1) *0%] + [(100 X .1) *20%]
= 10 – 0 + 2
= 12

Risk Identification and Assessment Deliverables

Deliverables Purpose

Information assess Assembles information about information assets and their

classification worksheet impact on or value to the organization

Weighted criteria analysis Assigns ranked value or impact weight to each information
worksheet asset

Ranked vulnerability risk Assigns ranked value of risk rating for each uncontrolled
worksheet asset-vulnerability pair

LEARNING CONTENTS | RISK CONTROL STRATEGIES

• Once ranked vulnerability risk worksheet complete, must choose one of four strategies to control each
risk:
• Apply safeguards that eliminate or reduce residual risks (avoidance)
• Transfer the risk to other areas or outside entities (transference)
• Reduce the impact should the vulnerability be exploited (mitigation)
• Understand the consequences and accept the risk without control or mitigation (acceptance)

PANGASINAN STATE UNIVERSITY 8

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Avoidance

• Attempts to prevent exploitation of the vulnerability

• Preferred approach; accomplished through countering threats, removing asset vulnerabilities, limiting
asset access, and adding protective safeguards
• Three common methods of risk avoidance:
• Application of policy
• Training and education
• Applying technology

Transference

• Control approach that attempts to shift risk to other assets, processes, or organizations
• Rethinking how services are offered
• Revising deployment models
• Outsourcing
• Purchasing insurance
• Implementing service contracts
• In Search of Excellence
• Concentrate on what you do best

Mitigation

• Attempts to reduce impact of vulnerability exploitation through planning and preparation

• Approach includes three types of plans:
• Incident response plan (IRP)
• Disaster recovery plan (DRP)
• Business continuity plan (BCP)
• Disaster recovery plan (DRP) is most common mitigation procedure
• The actions to take while incident is in progress is defined in Incident response plan (IRP)
• Business continuity plan (BCP) encompasses continuation of business activities if catastrophic event
occurs

Acceptance

• Doing nothing to protect a vulnerability and accepting the outcome of its exploitation
• Valid only when the particular function, service, information, or asset does not justify cost of protection
• Risk appetite describes the degree to which organization is willing to accept risk as trade-off to the
expense of applying controls

Selecting a Risk Control Strategy

• Level of threat and value of asset play major role in selection of strategy
• When a vulnerability exists--implement security control to reduce likelihood
• When a vulnerability can be exploited -- apply layered protections, architectural designs, and
administrative controls
• When attacker’s cost is less than potential gain -- apply protection to increase attackers costs
• When potential loss is substantial -- redesign, new architecture, controls

PANGASINAN STATE UNIVERSITY 9

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

FIGURE 2. Risk Control Cycle

Categories of Controls

1. Control function
• Preventive & detective

2. Architectural layer
• Organizational policy, external networks, intranets, network devices, systems

3. Strategy layer
• Avoidance, mitigation, or transference

4. Information security principle

• Classified by characteristics: Confidentiality, integrity, availability, authentication, authorization,
accountability, privacy

Feasibility Studies

• Compare cost to potential loss

• Cost avoidance is the process of avoiding the financial impact of an incident

Cost Benefit Analysis

• Evaluate worth of asset

• Loss of value if asset compromised
• Items affecting cost of control
• Cost of development or acquisition
• Cost of implementation
• Services costs

PANGASINAN STATE UNIVERSITY 10

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

• Cost of maintenance
• Benefits – value gained by using controls
• Assess worth of asset
• Calculate the single loss expectance
• SLE = asset value * exposure factor
• Exposure factor = % loss from exploitation
• Calculate Annualized loss expectancy
• ALE = SLE * ARO (annualized rate of occurrence)

Cost Benefit Analysis Formula

• CBA determines whether or not control alternative being evaluated is worth cost incurred to control
vulnerability
• CBA = ALE (prior) – ALE (post) – ACS
• ALE(prior) is annualized loss expectancy of risk before implementation of control
• ALE(post) is estimated ALE based on control being in place for a period of time
• ACS is the annualized cost of the safeguard

Benchmarking

• An alternative approach to risk management

• Benchmarking is process of seeking out and studying practices in other organizations that one’s own
organization desires to duplicate
• One of two measures typically used to compare practices:
• Metrics-based measures
• Process-based measures

Metrics-based measures

• Metrics-based measures are comparisons based on numerical standards:

• Number of successful attacks,
• staff-hours spent of systems protection,
• dollars spent on protection,
• number of security personnel,
• estimated value of info lost in attacks,
• loss in productivity hours
• Performance gap is the difference between an organization’s measures and those of
others.

Process-based measures

• Less focus on numbers

• More strategic than metrics-based measures
• Examine activities an individual company performs
• Focus on methods to accomplish a particular process
• Rather than the outcome

• Standard of due care: when adopting levels of security for a legal defense, organization shows it has
done what any prudent organization would do in similar circumstances
• Due diligence: demonstration that organization is diligent in ensuring that implemented standards
continue to provide required level of protection
• Failure to support standard of due care or due diligence can leave organization open to legal liability

PANGASINAN STATE UNIVERSITY 11

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

Benchmarking – Best Practices

• Best business practices: security efforts that provide a superior level protection of information
• Available Resources
• Federal Agency Security Project:
http://fasp.nist.gov
• CERT web site:
www.cert.org/security-improvement/

Seven Key Areas of Best Practice from Microsoft

1. Use antivirus software

2. Use strong passwords
3. Verify your software security settings
4. Update product security
5. Build personal firewalls
6. Back up early and often
7. Protect against power surges and loss

Problems with Applying Benchmarking and Best Practices

• Organizations don’t talk to each other (biggest problem)

• No two organizations are identical
• Best practices are a moving target
• Knowing what was going on in information security industry in recent years through benchmarking
doesn’t necessarily prepare for what’s next

Baselining

• Analysis of measures against established standards

• In information security, baselining is comparison of security activities and events against an
organization’s future performance.
• The information gathered for an organization’s first risk assessment becomes the baseline for future
comparison.

KEY

• “the goal of information security is not to bring residual risk to zero; it is to bring residual risk into line
with an organization’s comfort zone or risk appetite”

Summary

• Risk control: process of taking carefully reasoned steps to ensure the confidentiality, integrity, and
availability of components in organization’s information system
• Risk identification
• A risk management strategy enables identification, classification, and prioritization of
organization’s information assets
• Residual risk: risk that remains to the information asset even after the existing control is applied
• Risk control: four strategies are used to control risks that result from vulnerabilities:
• Apply safeguards (avoidance)
• Transfer the risk (transference)
• Reduce impact (mitigation)
• Understand consequences and accept risk (acceptance)

PANGASINAN STATE UNIVERSITY 12

 FM-AA-CIA-15 Rev. 0 10-July-2020

Study Guide in Information Assurance and Security Module No. 4

LEARNING ACTIVITY

If an organization has three information assets to evaluate for risk management, as shown in the
accompanying data, which vulnerability should be evaluated for additional controls first? Which one
should be evaluated last?

Data for Exercise:

• Switch L47 connects a network to the Internet. It has two vulnerabilities: it is susceptible to
hardware failure at a likelihood of 0.2, and it is subject to an SNMP buffer overflow attack at
a likelihood of 0.1. This switch has an impact rating of 90 and has no current controls in place.
You are 75 percent certain of the assumptions and data.
• Server WebSrv6 hosts a company Web site and performs e-commerce transactions. It has a
Web server version that can be attacked by sending it invalid Unicode values. The likelihood
of that attack is estimated at 0.1. The server has been assigned an impact value of 100, and a
control has been implanted that reduces the impact of the vulnerability by 75 percent. You are
80 percent certain of the assumptions and data.
• Operators use an MGMT45 control console to monitor operations in the server room. It has no
passwords and is susceptible to unlogged misuse by the operators. Estimates show the
likelihood of misuse is 0.1. There are no controls in place on this asset; it has an impact rating
of 5. You are 90 percent certain of the assumptions and data.

REFERENCES

Books

Principles of Information Security, 6th Edition, Michael E. Whitman; Herbert J. Mattord

Andress, J. The Basics of Information Security: Understanding the fundamentals of InfoSec in Theory and

Practice. Elsevier Inc.

Online materials

https://www.rapid7.com/fundamentals/information-security-risk-

management/#:~:text=What%20is%20Information%20Security%20Risk,availability%20of%20an%20organizat

ion's%20assets

https://safetymanagement.eku.edu/blog/risk-

identification/#:~:text=There%20are%20five%20core%20steps,risk%20treatment%2C%20and%20risk%20mo

nitoring

https://www.netwrix.com/information_security_risk_assessment_checklist.html

PANGASINAN STATE UNIVERSITY 13