Read an Excerpt
Information Security Risk Assessment Toolkit
Practical Assessments through Data Collection and Data Analysis
By Mark Ryan M. Talabis, Jason L. Martin
Elsevier ScienceCopyright © 2013 Elsevier, Inc.
All rights reserved.
Information Security Risk Assessments
INFORMATION IN THIS CHAPTER:
What is Risk?
What is an Information Security Risk Assessment?
Drivers, Laws, and Regulations
The past two decades or so have been routinely called the Information Age. In the Information Age, names like Google, Facebook, and Twitter have become as commonplace in our vernacular as Ford, GE, and Wal-Mart. When you stop and think about it these companies don't sell cars, refrigerators, or diapers. So what makes them relevant in these times? Information! These companies deliver services based on the collection and dissemination of information.
Information is valuable and as with any valuable asset it has to be protected. In order to properly protect an asset one needs to understand the dangers that the asset is exposed to. In the context of information as an asset this is where information security risk assessments come in to play.
In this chapter, we will be providing a primer on information security risk assessments with a focus on providing foundational knowledge regarding risk and its various components. We will then provide a high level overview of the components that make up a information security risk assessment, the major frameworks that provide guidance for conducting an assessment, and the laws and regulations that affect these assessments.
WHAT IS RISK?
All human endeavors carry some level of risk. This explains why throughout history risk has been a common topic of discussion. Strangely enough, even with all the discourse around risk it remains a very ambiguous concept. If you were to ask someone to provide you a definition of risk, they will very likely be able to provide you a reasonable answer; however, if you ask ten people, or even a hundred, you will likely receive a different definition from each person.
The ambiguity associated with defining risk is a fairly common roadblock to truly understanding risk. This is highlighted in the following statement from the Society of Risk Analysis:
"Many of you here remember that when our Society for Risk Analysis was brand new, one of the first things it did was to establish a committee to define the word "risk". This committee labored for 4 years and then gave up, saying in its final report, that maybe it's better not to define risk. Let each author define it in his own way, only please each should explain clearly what that way is (Kaplan, 1997)."
It is safe to say that there have been many discussions about risk but there have been few definitions provided or accepted. Of the definitions that we do have, the only thing that they share in common is the very fact that they share so little in common. This does not mean that people disagree on the meaning of risk, it just highlights the fact that each person interprets risk, and the definition of risk, in a very different way.
It is our opinion that when defining Risk, it is important to discuss risk in the proper context. Different fields or disciplines will have different interpretations and perceptions of risk. For example, the definition of risk will vary between Information Security, Economics, Finance, Healthcare, and even within Information Technology itself. Understanding that the definition of risk will vary depending on who you are talking to will help you more effectively communicate your risk assessment within your organization.
Another key point to remember is that the information security risk assessment process you are undertaking is very likely not the only risk assessment being conducted at your organization. Usually there are multiple risk assessments occurring within your organization being driven by different departments. In a well run organization these reviews will be funneled into a centralized risk management function for consolidation and reporting. By providing a solid definition of risk in the context of your field you will be able to avoid misunderstandings when the time comes to report your conclusions to these various centralized risk management functions.
When you start the risk assessment process you will have to interact with other people and many of these people won't be familiar with risk assessments and will only have a layman's understanding of what risk is. If you start talking about the more technical concepts of risk, which we will delve into later in this chapter, you will more than likely confuse them or at the very least make them uncomfortable. Remember that not all people are familiar with risk assessments so it is always good to start off with the most basic definitions of risk when meeting with someone so that the person you are meeting with can easily relate to the topic.
As an example, when interviewing non-technical business unit representatives, one of the best ways to communicate about what you are working on is to tell them that you are assessing the exposure of the department to possible data breach or loss. This may not be entirely accurate as risk assessments are much more thorough than just that but it does provide a simple way to put your interviewee into the proper state of mind for you to ask other more detailed questions.
Going Deeper with Risk
Using the common definitions of risk would suffice; however, when we start delving into the subject, we need something more substantial. One of the most famous definitions of risk comes from Frank Knight, a renowned economist, in his work "Risk, Uncertainty, and Profit":
Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated ... The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating ... It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an unmeasurable one that it is not in effect an uncertainty at all.
Frank Knight's definition focuses on the difference between uncertainty and risk. Uncertainty is a state of having limited knowledge where it is impossible to exactly describe the existing state or future outcome. Simply put, uncertainty is the state of not knowing.
Risk on the other hand can be defined as the quantitation or measurement of uncertainty. When we start measuring uncertainty, it is at this point when it becomes risk. Thus, risk is measureable while uncertainty is not.
Though this definition does have its critics, we believe that this definition presents a simple yet elegant description of risk because of the key concept of "measurement." Risk assessments are primarily an exercise of measurement. An organization without a risk assessment process cannot identify, much less measure, their risks and their level of exposure will remain in an uncertain state. An organization that is in an uncertain state cannot protect against possible dangers to itself until it is able to identify and measure them.
It is important to note that Knight's definition is heavily influenced by probability theory, which during that time was just taking hold. In fact, in most common risk assessment methodologies, probability is an integral component, which now brings us to a discussion of the various components of risk.
Components of Risk
So far, we have provided high-level definitions of risk; however, you have probably heard the concept that "An entity is a sum of its parts." Risk can be described in a very similar manner (see Figure 1.1). In order to break risk down to its individual components, let us use the definitions that we have used so far as illustrated in Figure 1.2.
Our first definition of risk has already provided us with the majority of the components that are needed to continue with this discussion. As we mentioned in the previous sections, without a form of measurement, than we are really just dealing with the definition of uncertainty. We need components from our second definition to complete our overall description of risk.
The addition of the components from our second definition helps to appropriately define risk for purposes of our discussion. Based on our definitions, risk is the sum of the following components:
Let's go over these components one by one.
An event is a chance or situation that is possible but is not certain. An event in the context of a risk assessment is always a future event. An event could also be an action or inaction. This action or inaction will have a direct or indirect influence on the outcome.
Also, though there are different ways to view the polarity of an event. In the context of this book, we will always treat an event as a negative occurrence, which represents something undesirable or unwanted.
Identifying events is one of the key activities of a risk assessment. In information security risk assessments, these events will be our threat actions, which will be discussed in greater detail in later chapters. Hackers gaining unauthorized access to an application or an unencrypted backup tape data being lost and then read are examples of events in the context of information security.
An asset is the direct or indirect target of an event. The outcome always has a direct consequence and is applied to the asset.
More often than not, an asset is something valued in your organization. In information security, these assets are typically applications, databases, software, hardware, or even people. In our event example above, the application and the backup tape are the assets that are the object of the event.
An outcome is the impact of the event. In the context of this book, an outcome will always be an adverse or unwelcome circumstance such as a loss or potential for loss. This loss in turn always has a direct effect on the whole or part of the asset.
Using the same examples provided in the event definition; a lost backup tape being read or unauthorized access by hackers to an application could have a similar outcome; that being the potential disclosure of sensitive information.
As previously mentioned, measurement is the cornerstone of any risk assessment. Ultimately, the goal of a risk assessment is to measure the probability or likelihood of a future event occurring.
Looking back at the examples that we have used so far regarding hackers accessing an application and the unencrypted backup tapes, the probability component will attempt to answer the following questions:
What is the probability that hackers may be able to gain unauthorized access to the application?
What is the probability that data on unencrypted backup tapes may be disclosed?
Probability typically revolves around the determination of the exposure and frequency of an event and can be very subjective in nature. The basis for determining probability will be discussed in more detail in the proceeding chapters.
Putting it All Together
Figure 1.3 illustrates the components of risk and their interaction with each other.
Now that we have all the pieces in place, let's put them together:
The first component of risk is a future event, which can either be an action or inaction.
The second component of risk is the probability or likelihood of that future event happening.
The third component of risk is the asset, which is directly or indirectly affected by the event.
The fourth component of risk is the outcome, which is the impact of the event on the asset.
Information Security Risk
Now that we have a high level definition of risk as well as an understanding of the primary components of risk, it's time to put this all into the context of information security risk. As we mentioned at the beginning of this chapter each field or discipline has its own definition of risk because each field has their own perception of what risk is.
In information security, risk revolves around three important concepts: threats, vulnerabilities and impact (see Figure 1.4).
1. Threat is an event, either an action or an inaction that leads to a negative or unwanted situation.
2. Vulnerabilities are weaknesses or environmental factors that increase the probability or likelihood of the threat being successful.
3. Impact is the outcome such as loss or potential for a loss due to the threat leveraging the vulnerability.
Excerpted from Information Security Risk Assessment Toolkit by Mark Ryan M. Talabis. Copyright © 2013 by Elsevier, Inc.. Excerpted by permission of Elsevier Science.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.