RISK MANAGEMENT:

CONTROLLING RISK
Weakness is a better teacher than strength. Weakness must be learned to understand
the obstacles that strength brushes aside. – Mason Cooley, U.S. aphorist
 Objectives
• Upon completion of this lecture, you should be able to:
– Recognize and select from the risk mitigation strategy
options to control risk
– Evaluate risk controls and formulate a cost-benefit analysis
using existing conceptual frameworks
– Explain how to maintain and perpetuate risk controls
– Describe the OCTAVE Method and other approaches to
managing risk
 Introduction
• To keep up with the competition, organizations must design and
create a safe environment in which business processes and
procedures can function
– This environment must maintain confidentiality and privacy and assure
the integrity and availability of organizational data
• These objectives are met via the application of the principles of risk management
 Risk Control Strategies
• An organization must choose one of four basic
strategies to control risks
– Avoidance
• Applying safeguards that eliminate or reduce the remaining
uncontrolled risks for the vulnerability
– Transference
• Shifting the risk to other areas or to outside entities
– Mitigation
• Reducing the impact if the vulnerability is exploited
 Risk Control Strategies (cont’d.)

• An organization must choose one of four basic strategies to

control risks (cont’d.)

– Acceptance
• Understanding the consequences and accepting the risk without
control or mitigation
 Avoidance

• The risk control strategy that attempts to prevent the

exploitation of the vulnerability

• Avoidance is accomplished through:

– Application of policy

– Application of training and education

– Countering threats

– Implementation of technical security controls and safeguards

 Transference

• The control approach that attempts to shift the risk to other

assets, other processes, or other organizations

• May be accomplished by rethinking how services are offered

– Revising deployment models

– Outsourcing to other organizations

– Purchasing insurance

– Implementing service contracts with providers

 Mitigation

• The control approach that attempts to reduce the damage caused

by the exploitation of vulnerability
– Using planning and preparation

– Depends upon the ability to detect and respond to an attack as quickly as

possible

• Types of mitigation plans

– Disaster recovery plan (DRP)

– Incident response plan (IRP)

– Business continuity plan (BCP)

 Mitigation (cont’d.)

Table1 Summaries of mitigation plans

 Acceptance

• The choice to do nothing to protect an information asset

– To accept the loss when it occurs

• This control, or lack of control, assumes that it may be a

prudent business decision to examine the alternatives and
conclude that the cost of protecting an asset does not justify the
security expenditure
 Acceptance (cont.)

• Before using the acceptance strategy, the organization must:

– Determine the level of risk to the information asset

– estimate the probability of attack and the likelihood of a

successful exploitation of a vulnerability

– Approximate the ARO of the exploit

– Estimate the potential loss from attacks

– Perform a thorough cost benefit analysis

 Acceptance (cont.)

• Before using the acceptance strategy, the organization

must: (cont’d.)
– Evaluate controls using each appropriate type of feasibility

– Decide that the particular asset did not justify the cost of
protection
 Managing Risk

• Risk appetite (also known as risk tolerance)

– The quantity and nature of risk that organizations are willing to
accept
• As they evaluate the trade-offs between perfect security and
unlimited accessibility

• The reasoned approach to risk is one that balances the expense

(in terms of finance and the usability of information assets)
against the possible losses if exploited
 Managing Risk (cont’d.)

• Residual risk ‫المخاطر المتبقيه‬

– When vulnerabilities have been controlled as much as possible, there is
often remaining risk that has not been completely removed, shifted, or
planned for

• Residual Risk is a combined function of:

– Threats, vulnerabilities and assets, less the effects of the safeguards in
place ‫ مطروحا منها آثار الضمانات القائمة‬،‫التهديدات ومواطن الضعف واألصول‬
 Managing Risk (cont’d.)

• The goal of information security is not to bring residual risk to

zero
– Bring it in line with an organization’s risk appetite

• If decision makers have been informed of uncontrolled risks

and the proper authority groups within the communities of
interest decide to leave residual risk in place, then the
information security program has accomplished its primary goal
 Managing Risk (cont’d.)

• Once a control strategy has been selected and

implemented:
– The effectiveness of controls should be monitored and
measured on an ongoing basis
• To determine its effectiveness and the accuracy of the estimate of the
residual risk
 Managing Risk (cont’d.)

Figure 1 Residual risk

 Managing Risk (cont’d.)

• Risk control involves selecting one of the four risk control

strategies
– For the vulnerabilities present

• If the loss is within the range of losses the organization can

absorb, or if the attacker’s gain is less than expected costs of the
attack, the organization may choose to accept the risk
– Otherwise, one of the other control strategies will have to be selected
 Managing Risk (cont’d.)

Figure 2 Risk-handling action points

 Managing Risk (cont’d.)

• Guidelines for risk control strategy selection

– When a vulnerability exists
• Implement security controls to reduce the likelihood of a vulnerability being
exercised

– When a vulnerability can be exploited

• Apply layered controls to minimize the risk or prevent occurrence

• ‫تطبيق ضوابط متعددة الطبقات لتقليل المخاطر أو منع حدوثها‬

– When the attacker’s potential gain is greater than the costs of attack
• Apply technical or managerial controls to increase the attacker’s cost, or
reduce his gain
 Managing Risk (cont’d.)

• Guidelines for risk control strategy selection (cont’d.)

– When potential loss is substantial
• Apply design controls to limit the extent of the attack, thereby
reducing the potential for loss
 Managing Risk (cont’d.)

Figure 3 Risk control cycle

 Feasibility and Cost-Benefit Analysis

• Before deciding on the strategy for a specific

vulnerability
– All readily accessible information about the consequences of
the vulnerability must be explored
• Ask “what are the advantages of implementing a control as opposed
to the disadvantages of implementing the control?”

• There are a number of ways to determine the advantage or

disadvantage of a specific control
 Feasibility and Cost-Benefit Analysis
(cont’d.)
• The primary means are based on the value of the
information assets that it is designed to protect
 Cost-Benefit Analysis
• Economic feasibility
– The criterion most commonly used when evaluating a
project that implements information security controls and
safeguards
• Begin a cost-benefit analysis by:
– Evaluating the worth of the information assets to be
protected and the loss in value if those information assets are
compromised
• This decision-making process is called
– Cost-benefit analysis or economic feasibility study
 Cost-Benefit Analysis (cont’d.)
• It is difficult to determine the value of information
– It is also difficult to determine the cost of safeguarding it
• Factors that affect the cost of a safeguard
– Cost of development or acquisition of hardware, software,
and services
– Training fees
– Cost of implementation
– Service and maintenance costs
 Cost-Benefit Analysis (cont’d.)
• Benefit
– The value to the organization of using controls to prevent
losses associated with a specific vulnerability
– Usually determined by valuing the information assets
exposed by the vulnerability and then determining how
much of that value is at risk and how much risk there is for
the asset
– This is expressed as the annualized loss expectancy (ALE)
 Cost-Benefit Analysis (cont’d.)
• Asset valuation
– The process of assigning financial value or worth to each
information asset
– The value of information differs within and between
organizations
• Based on the characteristics of information and the perceived value
of that information
– Involves estimation of real and perceived costs associated
with the design, development, installation, maintenance,
protection, recovery, and defense against loss and litigation
 Cost-Benefit Analysis (cont’d.)
• Asset valuation components
– Value retained from the cost of creating the information
asset
– Value retained from past maintenance of the information
asset
– Value implied by the cost of replacing the information
– Value from providing the information
– Value acquired from the cost of protecting the information
 Cost-Benefit Analysis (cont’d.)
• Asset valuation components (cont’d.)
– Value to owners
– Value of intellectual property
– Value to adversaries
– Loss of productivity while the information assets are
unavailable
– Loss of revenue while information assets are unavailable
 Cost-Benefit Analysis (cont’d.)
• An organization must be able to place a dollar value on
each information asset it owns, based on:
– How much did it cost to create or acquire?
– How much would it cost to recreate or recover?
– How much does it cost to maintain?
– How much is it worth to the organization?
– How much is it worth to the competition?
 Cost-Benefit Analysis (cont’d.)
• Potential loss is that which could occur from the
exploitation of vulnerability or a threat occurrence
• Ask these questions:
– What loss could occur, and what financial impact would it
have?
– What would it cost to recover from the attack, in addition to
the financial impact of damage?
– What is the single loss expectancy for each risk?
 Cost-Benefit Analysis (cont’d.)
• A single loss expectancy (SLE)
– The calculation of the value associated with the most likely
loss from an attack
– SLE is based on the value of the asset and the expected
percentage of loss that would occur from a particular attack
– SLE = asset value (AV) x exposure factor (EF)
• Where EF is the percentage loss that would occur from a given
vulnerability being exploited
– This information is usually estimated
 Cost-Benefit Analysis (cont’d.)
• In most cases, the probability of a threat occurring is
the probability of loss from an attack within a given
time frame
• This value is commonly referred to as the annualized
rate of occurrence (ARO)

ALE = SLE * ARO

 Cost-Benefit Analysis (cont’d.)
• CBA determines whether or not a control alternative is
worth its associated cost
• CBAs may be calculated before a control or safeguard
is implemented
– To determine if the control is worth implementing
• Or calculated after controls have been implemented
and have been functioning for a time
 Cost-Benefit Analysis (cont’d.)
• Cost-benefit analysis formula
CBA = ALE(prior) – ALE(post) – ACS
– ALE (prior to control) is the annualized loss expectancy of
the risk before the implementation of the control
– ALE (post-control) is the ALE examined after the control
has been in place for a period of time
– ACS is the annual cost of the safeguard
 Other Methods of Establishing Feasibility
• Organizational feasibility analysis
– Examines how well the proposed information security
alternatives will contribute to the operation of an
organization
• Operational feasibility
– Addresses user and management acceptance and support
– Addresses the overall requirements of the organization’s
stakeholders
 Other Methods of Establishing Feasibility
(cont’d.)
• Technical feasibility
– Examines whether or not the organization has or can acquire
the technology to implement and support the alternatives
• Political feasibility
– Defines what can and cannot occur based on the consensus
and relationships between the communities of interest
 Alternatives to Feasibility Analysis
• Benchmarking
• Due care and due diligence
• Best business practices
• Gold standard
• Government recommendations
• Baseline
 Recommended Risk Control Practices
• Organizations typically look for a more
straightforward method of implementing controls
• This preference has prompted an ongoing search for
ways to design security architectures that go beyond
the direct application of specific controls for specific
information asset vulnerability
 Qualitative and Hybrid Measures
• Quantitative assessment
– Performs asset valuation with actual values or estimates
– May be difficult to assign specific values
• Qualitative assessment
– Use scales instead of specific estimates
• Hybrid assessment
– Tries to improve upon the ambiguity of qualitative measures
without using an estimating process
 A Single Source Approach to Risk
Management
• The Operationally Critical Threat, Asset, and
Vulnerability Evaluation (OCTAVE) Method
– Defines the essential components of a comprehensive,
systematic, context-driven, self-directed information security
risk evaluation
 A Single Source Approach to Risk
Management (cont’d.)
• The OCTAVE method (cont’d.)
– Allows an organization to make information-protection
decisions based on risks to the confidentiality, integrity, and
availability of critical information technology assets
– The operational or business units and the IT department
work together to address the information security needs of
the organization
 The OCTAVE Methods
• Three variations of the OCTAVE method
– The original OCTAVE method, (forms the basis for the
OCTAVE body of knowledge)
• Was designed for larger organizations with 300 or more users
– OCTAVE-S
• For smaller organizations of about 100 users
– OCTAVE-Allegro
• A streamlined approach for information security assessment and
assurance
• For more information: www.cert.org/octave/
 Microsoft Risk Management Approach
• Microsoft Corporation also promotes a risk
management approach
• Four phases in the Microsoft InfoSec risk management
process:
– Assessing risk
– Conducting decision support
– Implementing controls
– Measuring program effectiveness
 Microsoft Risk Management Approach
(cont’d.)
• Assessing Risk: Identification and prioritization of
risks facing the organization
– Plan data gathering – discuss keys to success and preparation
guidance
– Gather risk data – outline the data collection process and
analysis
– Prioritize risks – outline prescriptive steps to qualify and
quantify risks
 Microsoft Risk Management Approach
(cont’d.)
• Conducting Decision Support: Identify and evaluate
available controls
– Define functional requirements – create the necessary
requirements to mitigate risks
– Select possible control solutions – outline approach to
identify mitigation solutions
– Review solution – evaluate proposed controls against
functional requirements
 Microsoft Risk Management Approach
(cont’d.)
• Identify and evaluate available controls (cont’d.)
– Estimate risk reduction – endeavor to understand reduced
exposure or probability of risks
– Estimate solution cost – evaluate direct and indirect costs
associated with mitigation solutions
– Select mitigation strategy – complete cost-benefit analysis to
identify the most cost-effective mitigation solution
 Microsoft Risk Management Approach
(cont’d.)
• Implementing controls: deployment and operation of
the controls selected from the cost-benefit analyses
and other mitigating factors from the previous step
– Seek holistic approach – incorporate people, process, and
technology in mitigation solution
– Organize by defense-in-depth – arrange mitigation solutions
across the business
 Microsoft Risk Management Approach
(cont’d.)
• Measuring program effectiveness: ongoing assessment
of the effectiveness of the risk management program
– Develop risk scoreboard – understand risk posture and
progress
– Measure program effectiveness – evaluate the risk
management program for opportunities to improve
Microsoft Risk Management
Approach (cont’d.)

Figure A-1 Security Risk Management Guide

Source: Course Technology/Cengage Learning

 Microsoft Risk Management Approach
(cont’d.)
• Additional information is available at:
www.microsoft.com/technet/security/topics/complianceandpoli
cies/secrisk/default.mspx
 FAIR
• The Factor Analysis of Information Risk (FAIR)
framework includes:
– A taxonomy for information risk
– Standard nomenclature for information risk terms
– A framework for establishing data collection criteria
– Measurement scales for risk factors
– A computational engine for calculating risk
 FAIR (cont’d.)
• The Factor Analysis of Information Risk (FAIR)
framework includes: (cont’d.)
– A modeling construct for analyzing complex risk scenarios
• See http://fairwiki.riskmanagementinsight.com
 FAIR (cont’d.)
• Basic FAIR analysis is comprised of ten steps in four
stages
• Stage 1 - Identify scenario components
1. Identify the asset at risk
2. Identify the threat community under consideration
• Stage 2 - Evaluate loss event frequency
3. Estimate the probable threat event frequency
4. Estimate the threat capability (TCap)
 FAIR (cont’d.)
• Stage 2 - Evaluate loss event frequency (cont’d.)
5. Estimate Control strength (CS)
6. Derive Vulnerability (Vuln)
7. Derive Loss Event Frequency (LEF)
• Stage 3 - Evaluate probable loss magnitude (PLM)
8. Estimate worst-case loss
9. Estimate probable loss
 FAIR (cont’d.)
• Stage 4 - Derive and articulate Risk
10. Derive and articulate Risk
• Unlike other risk management frameworks, FAIR
relies on the qualitative assessment of many risk
components using scales with value ranges, for
example very high to very low
 FAIR (cont’d.)

Figure 9-4 Factor analysis of information risk (FAIR)

Source: Course Technology/Cengage Learning

(Based on concepts from Jack A. Jones)
 ISO 27005 Standard for Information
Security Risk Management

• The ISO 27000 series includes a standard for the

performance of Risk Management
– ISO 27005
– See http://www.27000.org/iso-27005.htm
 ISO 27005 Standard for Information
Security Risk Management (cont’d.)

• The 27005 document includes a five-stage risk

management methodology
– Information security risk assessment (ISRA)
– Information security risk treatment
– Information security risk acceptance
– Information security risk communication
– Information security risk monitoring and review
 Other Methods

Figure 9-5 ENISA ranking of risk management methods

Source: Course Technology/Cengage Learning

 Summary
• Introduction
• Risk control strategies
• Risk control strategy selection
• Categories of controls
• Feasibility studies and cost-benefit analysis
• Risk management discussion points
• Recommended risk control practices
• The OCTAVE method
 Summary (cont’d.)
• The Microsoft risk management approach
• FAIR
• ISO 27005 Standard for Information Risk
Management