Risk Identification.
Identifying the sources, causes, and
consequences of the internal and external risks affecting the security of the
organization helps to understand your current posture.
The organization operates in defining the
external and internal environment in which the organization is operating.
Establishing context and quantifying risks
determines the effective risk, calibrates the possible outcome of risk.
We just did that with our whiteboard
equations by calculating exposure factor for massive value, what it's going to cost
the organization, and looked at one possible controller countermeasure.
Now, what we did in that demo is purely quantitative.
Part of it was qualitative due to the fact
we're trying to predict how often that happens or how many times per year, which
we can never 100 % calculate, but we could have based that on our previous
statistical analysis, and that is a hard and fast number.
There's a degree of quantitative, a degree of qualitative in any risk analysis.
You can always have a 100 % qualitative, but you can never have a 100 %
quantitative because there's always an unknown.
You're looking at likelihood of occurrence.
The risk management phase for risk assessments assesses the organization's
risk and provides an estimate on the likelihood and the impact of risk.
Again, we're laying out what could happen,
how bad would it be if it did, and how likely is it to happen.
It's an ongoing iterative process
assigning priorities to risk mitigation and implementation plans.
Again, this is an ongoing deal.
You don't just do it once and put it on the shelf.
It should be directly tied to your change
management and risk should be regularly assessed.
Risk changes over time, especially with the discovery of new vulnerabilities.
It determines your quantitative and qualitative value of risk, which we're
getting ready to further define in the next slide.
Again, the two types of risk assessments, quantitative and qualitative.
This step involves analyzing the risk of vulnerabilities and threats to provide an
understanding of the inherent and controlled risks, defines the nature of
the risk, and determines the level of risk exposure.
We've already mentioned these terms.
I've already done the calculation.
I like to do that right off the bat at the beginning of any risk analysis discussion.
You get an idea of what the equations might look like.
But we've seen quantitative as a numeric
assessment focused on mapping the probability and the perceived cost.
Again, that results in an annualized loss expectancy, which again, employs the
probability of the threat occurring and the likely loss it should occur.
Remember,
if your ALE calculation is less than the implementation of the countermeasure, then
there's really not a whole lot of business case of why to implement it.
That may give you the research or the
analysis to accept the risk versus address or mitigate the risk.
We're going to talk about response to risk here shortly.
We've got transference and acceptance and mitigation.
And if you find that you can't in a cost-
effective way address the risk, you might choose to accept it.
Qualitative, again, is opinion.
It's subjective.
Focuses on mapping the perceived impact,
perceived of a specific events occurring to risk agreed upon by the organization.
Most methodologies use interrelated
elements such as threats, vulnerabilities and controls.
Qualitative data is gathered by a variety
of means, focus groups, storyboarding, questionnaires.
There's something called the Delphi
method, which is interesting, that ensures honesty.
In the Delphi method, you have an anonymous submission of respondent data,
and then it's looked at and again, calculated anonymously.
Imagine you're in a situation where you got a manager and you're in the same
meeting talking about your perceived effectiveness or current preparedness for
denial of service, things like that, and you think you've got a lot of work to do.
Your supervisor manager thinks you're doing just great.
You might be a little bit hesitant to
share your true feelings or your true perspective.
But in a Delphi method, you could write
things down on a strip of paper, put in a box, nobody knows where it came from,
and then you've got an aggregation of those values.
With qualitative, a lot of times it's turned into a numeric format.
For example, on a scale of 1 to 10, how
likely do you think we would be to survive a denial service and so forth?
How effective would this control be on a scale of 1 to 10?
Then you average those values between the different respondents.
It still gets turned into a lot of times numerical data.
But again, qualitative is subjective, quantitative is numeric.