Security Risk Management: Building an Information Security Risk Management Program from the Ground Up

Security Risk Management: Building an Information Security Risk Management Program from the Ground Up......Page 3
Copyright\r......Page 4
Preface......Page 5
Intended Audience......Page 6
Part I—Introduction to Risk Management......Page 7
Part II—Risk Assessment and Analysis Techniques......Page 8
Part III—Building and Running a Risk Management Program......Page 9
Appendices......Page 10
Acknowledgments......Page 12
About the Author......Page 13
About the Technical Editor......Page 14
How We Got Here......Page 17
Banning Best Practices......Page 18
A New Path Forward......Page 20
The Shangri-La of Risk Management......Page 21
Safety before Security......Page 22
The Lure of Security by Obscurity......Page 23
Redefining the CIA Triad......Page 24
Security Design Principles......Page 25
Least Privilege......Page 26
Defense in Depth......Page 27
Separation of Duties......Page 29
Security Team Responsibilities......Page 30
Modern Information Security Challenges......Page 31
The Next Evolution......Page 32
References......Page 33
Applying Risk Management to Information Security......Page 35
Goal of Risk Management......Page 36
Architecting a Security Program......Page 38
How Does it Help?......Page 39
Work Smarter, Not Harder......Page 42
Due Diligence......Page 44
Facilitating Decision Making......Page 46
Security as an Investment......Page 48
Security Metrics......Page 49
Qualitative versus Quantitative......Page 51
Qualitative Analysis......Page 52
Quantitative Analysis......Page 53
Summary......Page 54
References......Page 55
Stages of the Risk Management Lifecycle......Page 57
Risk Is a Moving Target......Page 58
A Comprehensive Risk Management Workflow......Page 60
Resource Profiling......Page 62
A Vulnerability Assessment Is Not a Risk Assessment......Page 64
Risk Assessment......Page 65
Risk Evaluation......Page 67
Document......Page 69
Risk Mitigation......Page 70
Monitoring and Audit......Page 71
Process Ownership......Page 73
Action Plan......Page 74
How Risk Sensitivity Is Measured......Page 77
Making a Resource List......Page 78
Sensitivity, Not Exposure......Page 79
Security Risk Profile......Page 80
Profiling in Practice......Page 82
Risk Impact Categories and Examples......Page 85
Profile Design......Page 87
Calculating Sensitivity......Page 92
Assessing Risk Appetite......Page 95
Assessing the C-Level......Page 96
Setting Risk Thresholds and Determining Tolerance Ranges......Page 97
Action Plan......Page 98
Reference......Page 99
Breaking Down a Risk......Page 101
Terminology Is Key......Page 102
Envision the Consequences......Page 104
Finding the Risk, Part II......Page 106
Defining Threats......Page 109
Threat Analysis......Page 113
Threats Are Different from Risks......Page 114
Action Plan......Page 116
References......Page 117
Qualitative Risk Measures......Page 119
Defining Severity......Page 120
Availability Severity......Page 121
Confidentiality Severity......Page 122
Integrity Severity......Page 123
Combined Severity Scale......Page 124
Defining Likelihood......Page 125
Threat Universe Likelihood......Page 126
Combined Likelihood Scale......Page 127
Qualitative Risk Exposure......Page 128
Applying Sensitivity......Page 129
Estimating Severity......Page 131
Estimating Likelihood......Page 133
Estimating Risk Exposure......Page 135
Quantitative Risk Analysis......Page 137
Summary......Page 138
Reference......Page 139
Fundamental Security Services......Page 141
Standardization......Page 142
The C-I-A-A Model......Page 143
Rule-Based Access Control......Page 144
Security Services......Page 145
Communications Inspection......Page 146
Communications Validation......Page 147
Policy Enforcement......Page 148
Session Management......Page 149
Authentication......Page 151
Auditing/Logging......Page 152
Cryptography......Page 153
Physical......Page 154
Event Monitoring......Page 155
Vulnerability Management......Page 156
Access Control......Page 157
Fundamental Security Control Requirements......Page 158
Summary......Page 159
Reference......Page 160
Risk Evaluation......Page 161
Security’s Role in Decision Making......Page 162
Documenting Risk Decisions......Page 165
Calculating the Cost of Remediation......Page 167
Mitigation Approaches......Page 168
Policy Exceptions and Risk Acceptance......Page 170
Exception Workflow......Page 171
Signature Requirements......Page 173
Summary......Page 175
Action Plan......Page 176
Risk Management Artifacts......Page 177
Octave Allegro......Page 179
Gathering Business Requirements......Page 180
Risk Assessment Engagement......Page 182
Phase 1: Build Asset-Based Threat Profiles......Page 183
Phase 2: Identify Vulnerabilities......Page 186
Phase 3: Evaluate Risks and Develop Security Strategy......Page 187
Executive Summary......Page 189
Scope of Analysis......Page 190
Assessment Steps......Page 191
Findings Summary......Page 192
Executive Communication......Page 195
Writing Audit Responses......Page 197
Summary......Page 201
References......Page 202
Operational Assessments......Page 203
Operational Techniques......Page 204
Questionnaires and Interviews......Page 205
Active and Passive Testing......Page 206
Third-Party Reviews and Certifications......Page 209
Baseline Reviews......Page 210
Assessment Approaches for Different Sized Scopes......Page 211
Risk Assessments in the Project Lifecycle......Page 212
The FRAAP Approach......Page 213
Running the Session......Page 214
Sample Worksheets......Page 216
Third-Party Assessments......Page 219
Industry Standard Assessments......Page 220
Levels of Assessment......Page 221
Basing Assessments on Sensitivity......Page 222
Improving the Process......Page 224
Action Plan......Page 225
References......Page 226
Building Blocks......Page 229
Program Essentials......Page 230
Asset and Data Inventory......Page 232
Resource Profiling......Page 233
Threat Identification......Page 234
Threat Data Sources......Page 235
Rating Vulnerabilities......Page 236
An Efficient Workflow......Page 242
Defining a Workflow......Page 243
The FAIR Approach......Page 244
Measuring Risks......Page 245
Summary......Page 250
References......Page 251
Assessing the State of Compliance......Page 253
Balancing Security and Risk......Page 254
Qualifying the Risk......Page 255
Workflow Steps......Page 256
Establish Schedule......Page 257
Distribute a Questionnaire......Page 258
Generate Findings......Page 259
Create Tasks......Page 260
Final Rating......Page 262
Planning......Page 263
Process Optimization: A Review of Key Points......Page 265
The NIST Evolution......Page 267
Focus of the NIST Process......Page 268
References......Page 271
Risk in the Development Lifecycle......Page 273
Analysis Workflow......Page 275
Goal of Security Architecture......Page 277
Developing an Architecture......Page 278
Separation by Risk Profile......Page 281
Rules of Data Movement......Page 282
Trust Relationships......Page 283
Internal/External......Page 284
Privilege Level: The Initiator\'s Assigned Rights......Page 285
Security Zones......Page 286
Management Traffic......Page 287
Transitive Risk Considerations......Page 288
Combining Security Controls......Page 289
Multidevice Systems......Page 290
Internal Nonstandard Clients......Page 291
Detailed Risk Analysis Workflow......Page 292
Primary Workflow......Page 293
Risk Exposure Analysis......Page 296
Summary......Page 297
Reference......Page 298
Designing a Risk Program......Page 299
Risk Is the Core......Page 300
Program Goals......Page 301
Starting from Scratch......Page 302
Comparing the Models......Page 304
Prerequisites for a Risk Management Program......Page 305
Information Resources Inventory......Page 306
Security Liaisons......Page 307
Common Risk Formula......Page 309
Mapping Risk Domains to Business Objectives......Page 310
Tying Other Security Processes to Risk......Page 312
Risk and Exception Tracking System......Page 313
Program Roadmap......Page 314
Lessons from the Trenches......Page 315
Reference......Page 316
Information Sensitivity......Page 317
Regulatory Requirements......Page 320
Business Requirements......Page 321
Definitions......Page 322
Appendix B: Qualitative Risk Scale Reference Tables\r......Page 323
Baseline Security Levels and Sample Controls......Page 327
Security Enhancement Levels and Sample Controls......Page 333
Mapping Security Levels......Page 341
Step 4 Calculate Risk Exposure Rating for Flows......Page 344
C......Page 345
D......Page 346
I......Page 347
O......Page 348
R......Page 349
S......Page 351
T......Page 353
Z......Page 354