Information Security Risk Assessment Toolkit: Practical Assessments through Data Collection and Data Analysis [NOOK Book]

Overview

In order to protect company’s information assets such as sensitive customer records, health care records, etc., the security practitioner first needs to find out: what needs protected, what risks those assets are exposed to, what controls are in place to offset those risks, and where to focus attention for risk treatment. This is the true value and purpose of information security risk assessments.  Effective risk assessments are meant to provide a defendable analysis of residual risk associated with your key...

See more details below
Information Security Risk Assessment Toolkit: Practical Assessments through Data Collection and Data Analysis

Available on NOOK devices and apps  
  • NOOK Devices
  • Samsung Galaxy Tab 4 NOOK
  • NOOK HD/HD+ Tablet
  • NOOK
  • NOOK Color
  • NOOK Tablet
  • Tablet/Phone
  • NOOK for Windows 8 Tablet
  • NOOK for iOS
  • NOOK for Android
  • NOOK Kids for iPad
  • PC/Mac
  • NOOK for Windows 8
  • NOOK for PC
  • NOOK for Mac

Want a NOOK? Explore Now

NOOK Book (eBook)
$49.95
BN.com price

Overview

In order to protect company’s information assets such as sensitive customer records, health care records, etc., the security practitioner first needs to find out: what needs protected, what risks those assets are exposed to, what controls are in place to offset those risks, and where to focus attention for risk treatment. This is the true value and purpose of information security risk assessments.  Effective risk assessments are meant to provide a defendable analysis of residual risk associated with your key assets so that risk treatment options can be explored.  Information Security Risk Assessments gives you the tools and skills to get a quick, reliable, and thorough risk assessment for key stakeholders.




  • Based on authors’ experiences of real-world assessments, reports, and presentations

  • Focuses on implementing a process, rather than theory, that allows you to derive a quick and valuable assessment

  • Includes a companion web site with spreadsheets you can utilize to create and maintain the risk assessment
Read More Show Less

Product Details

  • ISBN-13: 9781597499750
  • Publisher: Elsevier Science
  • Publication date: 10/17/2012
  • Sold by: Barnes & Noble
  • Format: eBook
  • Pages: 278
  • File size: 11 MB
  • Note: This product may take a few minutes to download.

Meet the Author

Mark Ryan Talabis is a Manager for the Secure DNA Consulting practice. Prior to joining Secure DNA he was a consultant in the Asian Development Bank (ADB). He has extensive experience in information security risk assessments, information security policy and program development, vulnerability assessments and penetration testing and has specialized expertise in security analytics and data mining as applied to information security. He has a Master’s degree in Information Technology; Certified Information Systems Security Professional (CISSP); Certified Information Systems Auditor (CISA); a GIAC Certified Incident Handler Certification (GCIH); a GIAC Security Essentials Certification (GSEC); Certified in Risk and Information Systems Control (CRISC); and a Microsoft Certified Professional (MCP) on SQL Server Administration;. He has presented in various security and academic conferences around the world including Blackhat and Defcon and has a number of published papers to his name in various peer-reviewed journals. He is an alumni member of the Honeynet Project and is currently taking a Master of Liberal Arts (ALM) in Extension Studies in Harvard University.

Jason Martin is the President and CEO of Secure DNA, an Information Security Company that provides security solutions to companies throughout the United States and Asia. Prior to joining Secure DNA he was a Manager within KPMG’s Information Risk Management group. In his professional services role Mr. Martin has successfully designed, implemented, and operated security programs for multi-billion dollar organizations within Hawaii and the US Mainland as well as provided subject matter expertise as an executive level security advisor to companies throughout the world. He is a Certified Information Security Manager (CISM), a Certified Information Systems Security Professional (CISSP), a Certified Information Systems Auditor (CISA), Certified in the Governance of Enterprise IT (CGEIT), and holds the designation as Certified in Risk and Information Systems Control (CRISC). He has advised Lawmakers on emerging cyber security risks and is working with legislatures to enhance state privacy laws. He is a frequent speaker and instructor at security and audit training events and seminars, is a founder of the Shakacon Security Conference, and is on the board of advisors for the Hackito Ergo Sum security conference in France. He is a former board member for the Hawaii chapter of ISACA and is a current board member for the Hawaii chapter of INFRAGARD.

Read More Show Less

Read an Excerpt

Information Security Risk Assessment Toolkit

Practical Assessments through Data Collection and Data Analysis


By Mark Ryan M. Talabis, Jason L. Martin

Elsevier Science

Copyright © 2013 Elsevier, Inc.
All rights reserved.
ISBN: 978-1-59749-975-0


Excerpt

CHAPTER 1

Information Security Risk Assessments


INFORMATION IN THIS CHAPTER:

• What is Risk?

• What is an Information Security Risk Assessment?

• Drivers, Laws, and Regulations


INTRODUCTION

The past two decades or so have been routinely called the Information Age. In the Information Age, names like Google, Facebook, and Twitter have become as commonplace in our vernacular as Ford, GE, and Wal-Mart. When you stop and think about it these companies don't sell cars, refrigerators, or diapers. So what makes them relevant in these times? Information! These companies deliver services based on the collection and dissemination of information.

Information is valuable and as with any valuable asset it has to be protected. In order to properly protect an asset one needs to understand the dangers that the asset is exposed to. In the context of information as an asset this is where information security risk assessments come in to play.

In this chapter, we will be providing a primer on information security risk assessments with a focus on providing foundational knowledge regarding risk and its various components. We will then provide a high level overview of the components that make up a information security risk assessment, the major frameworks that provide guidance for conducting an assessment, and the laws and regulations that affect these assessments.


WHAT IS RISK?

All human endeavors carry some level of risk. This explains why throughout history risk has been a common topic of discussion. Strangely enough, even with all the discourse around risk it remains a very ambiguous concept. If you were to ask someone to provide you a definition of risk, they will very likely be able to provide you a reasonable answer; however, if you ask ten people, or even a hundred, you will likely receive a different definition from each person.

The ambiguity associated with defining risk is a fairly common roadblock to truly understanding risk. This is highlighted in the following statement from the Society of Risk Analysis:

"Many of you here remember that when our Society for Risk Analysis was brand new, one of the first things it did was to establish a committee to define the word "risk". This committee labored for 4 years and then gave up, saying in its final report, that maybe it's better not to define risk. Let each author define it in his own way, only please each should explain clearly what that way is (Kaplan, 1997)."


It is safe to say that there have been many discussions about risk but there have been few definitions provided or accepted. Of the definitions that we do have, the only thing that they share in common is the very fact that they share so little in common. This does not mean that people disagree on the meaning of risk, it just highlights the fact that each person interprets risk, and the definition of risk, in a very different way.

It is our opinion that when defining Risk, it is important to discuss risk in the proper context. Different fields or disciplines will have different interpretations and perceptions of risk. For example, the definition of risk will vary between Information Security, Economics, Finance, Healthcare, and even within Information Technology itself. Understanding that the definition of risk will vary depending on who you are talking to will help you more effectively communicate your risk assessment within your organization.

Another key point to remember is that the information security risk assessment process you are undertaking is very likely not the only risk assessment being conducted at your organization. Usually there are multiple risk assessments occurring within your organization being driven by different departments. In a well run organization these reviews will be funneled into a centralized risk management function for consolidation and reporting. By providing a solid definition of risk in the context of your field you will be able to avoid misunderstandings when the time comes to report your conclusions to these various centralized risk management functions.

When you start the risk assessment process you will have to interact with other people and many of these people won't be familiar with risk assessments and will only have a layman's understanding of what risk is. If you start talking about the more technical concepts of risk, which we will delve into later in this chapter, you will more than likely confuse them or at the very least make them uncomfortable. Remember that not all people are familiar with risk assessments so it is always good to start off with the most basic definitions of risk when meeting with someone so that the person you are meeting with can easily relate to the topic.

As an example, when interviewing non-technical business unit representatives, one of the best ways to communicate about what you are working on is to tell them that you are assessing the exposure of the department to possible data breach or loss. This may not be entirely accurate as risk assessments are much more thorough than just that but it does provide a simple way to put your interviewee into the proper state of mind for you to ask other more detailed questions.


Going Deeper with Risk

Using the common definitions of risk would suffice; however, when we start delving into the subject, we need something more substantial. One of the most famous definitions of risk comes from Frank Knight, a renowned economist, in his work "Risk, Uncertainty, and Profit":

Uncertainty must be taken in a sense radically distinct from the familiar notion of Risk, from which it has never been properly separated ... The essential fact is that "risk" means in some cases a quantity susceptible of measurement, while at other times it is something distinctly not of this character; and there are far-reaching and crucial differences in the bearings of the phenomena depending on which of the two is really present and operating ... It will appear that a measurable uncertainty, or "risk" proper, as we shall use the term, is so far different from an unmeasurable one that it is not in effect an uncertainty at all.


Frank Knight's definition focuses on the difference between uncertainty and risk. Uncertainty is a state of having limited knowledge where it is impossible to exactly describe the existing state or future outcome. Simply put, uncertainty is the state of not knowing.

Risk on the other hand can be defined as the quantitation or measurement of uncertainty. When we start measuring uncertainty, it is at this point when it becomes risk. Thus, risk is measureable while uncertainty is not.

Though this definition does have its critics, we believe that this definition presents a simple yet elegant description of risk because of the key concept of "measurement." Risk assessments are primarily an exercise of measurement. An organization without a risk assessment process cannot identify, much less measure, their risks and their level of exposure will remain in an uncertain state. An organization that is in an uncertain state cannot protect against possible dangers to itself until it is able to identify and measure them.

It is important to note that Knight's definition is heavily influenced by probability theory, which during that time was just taking hold. In fact, in most common risk assessment methodologies, probability is an integral component, which now brings us to a discussion of the various components of risk.


Components of Risk

So far, we have provided high-level definitions of risk; however, you have probably heard the concept that "An entity is a sum of its parts." Risk can be described in a very similar manner (see Figure 1.1). In order to break risk down to its individual components, let us use the definitions that we have used so far as illustrated in Figure 1.2.

Our first definition of risk has already provided us with the majority of the components that are needed to continue with this discussion. As we mentioned in the previous sections, without a form of measurement, than we are really just dealing with the definition of uncertainty. We need components from our second definition to complete our overall description of risk.

The addition of the components from our second definition helps to appropriately define risk for purposes of our discussion. Based on our definitions, risk is the sum of the following components:

• Event.

• Asset.

• Outcome.

• Probability.

Let's go over these components one by one.


Event

An event is a chance or situation that is possible but is not certain. An event in the context of a risk assessment is always a future event. An event could also be an action or inaction. This action or inaction will have a direct or indirect influence on the outcome.

Also, though there are different ways to view the polarity of an event. In the context of this book, we will always treat an event as a negative occurrence, which represents something undesirable or unwanted.

Identifying events is one of the key activities of a risk assessment. In information security risk assessments, these events will be our threat actions, which will be discussed in greater detail in later chapters. Hackers gaining unauthorized access to an application or an unencrypted backup tape data being lost and then read are examples of events in the context of information security.


Asset

An asset is the direct or indirect target of an event. The outcome always has a direct consequence and is applied to the asset.

More often than not, an asset is something valued in your organization. In information security, these assets are typically applications, databases, software, hardware, or even people. In our event example above, the application and the backup tape are the assets that are the object of the event.


Outcome

An outcome is the impact of the event. In the context of this book, an outcome will always be an adverse or unwelcome circumstance such as a loss or potential for loss. This loss in turn always has a direct effect on the whole or part of the asset.

Using the same examples provided in the event definition; a lost backup tape being read or unauthorized access by hackers to an application could have a similar outcome; that being the potential disclosure of sensitive information.


Probability

As previously mentioned, measurement is the cornerstone of any risk assessment. Ultimately, the goal of a risk assessment is to measure the probability or likelihood of a future event occurring.

Looking back at the examples that we have used so far regarding hackers accessing an application and the unencrypted backup tapes, the probability component will attempt to answer the following questions:

• What is the probability that hackers may be able to gain unauthorized access to the application?

• What is the probability that data on unencrypted backup tapes may be disclosed?


Probability typically revolves around the determination of the exposure and frequency of an event and can be very subjective in nature. The basis for determining probability will be discussed in more detail in the proceeding chapters.


Putting it All Together

Figure 1.3 illustrates the components of risk and their interaction with each other.

Now that we have all the pieces in place, let's put them together:

• The first component of risk is a future event, which can either be an action or inaction.

• The second component of risk is the probability or likelihood of that future event happening.

• The third component of risk is the asset, which is directly or indirectly affected by the event.

• The fourth component of risk is the outcome, which is the impact of the event on the asset.


Information Security Risk

Now that we have a high level definition of risk as well as an understanding of the primary components of risk, it's time to put this all into the context of information security risk. As we mentioned at the beginning of this chapter each field or discipline has its own definition of risk because each field has their own perception of what risk is.

In information security, risk revolves around three important concepts: threats, vulnerabilities and impact (see Figure 1.4).

1. Threat is an event, either an action or an inaction that leads to a negative or unwanted situation.

2. Vulnerabilities are weaknesses or environmental factors that increase the probability or likelihood of the threat being successful.

3. Impact is the outcome such as loss or potential for a loss due to the threat leveraging the vulnerability.
(Continues...)


Excerpted from Information Security Risk Assessment Toolkit by Mark Ryan M. Talabis. Copyright © 2013 by Elsevier, Inc.. Excerpted by permission of Elsevier Science.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.

Read More Show Less

Table of Contents

Chapter 1: Information Security Risk Assessments

Chapter 2: A Practical Approach

Chapter 3:  Data Collection

Chapter 4: Data Analysis

Chapter 5:  Risk Assessment

Chapter 6: Risk Prioritization and Treatment

Chapter 7:  Reporting

Chapter 8: Maintenance and Wrap Up

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star

(0)

4 Star

(0)

3 Star

(0)

2 Star

(0)

1 Star

(0)

Your Rating:

Your Name: Create a Pen Name or

Barnes & Noble.com Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & Noble.com that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & Noble.com does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at BN.com or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation

Reminder:

  • - By submitting a review, you grant to Barnes & Noble.com and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Noble.com Terms of Use.
  • - Barnes & Noble.com reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & Noble.com also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on BN.com. It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

 
Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)