Vulnerability Pair

Information Security Chance Assessment: Data Analysis

Marking Talabis , Jason Martin , in Information Security Risk Assessment Toolkit, 2012

Threat Vulnerability Pairs

A threat-vulnerability pair is a matrix that matches all the threats in our listing with the electric current or hypothetical vulnerabilities that could be exploited by the threats. This is the final production leveraging both the threat listing and vulnerability list that we take been preparing. In one case the threat and vulnerability listings are complete, it is a adequately straightforward practice to create the Threat and Vulnerability pairs:

1.

Bold that you lot are using a spreadsheet or a table format, list all the threats in i column.

2.

In the post-obit column, write downwardly all the applicable vulnerabilities for each of the threats listed in the kickoff column.

3.

Remember that each threat could potentially have multiple vulnerabilities related to it. In this example, create a duplicate threat entry in the subsequent row.

Table 4.two is a shortened version of a threat and vulnerability pair matrix showing 6 threat and vulnerability pairs:

Table four.2. Sample Threat and Vulnerability Pairs

Threat (Agent and Action) Vulnerability
Users Eavesdropping and Interception of information Lack of transmission encryption leading to interception of unencrypted data
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized system access Possible Weak Passwords due to lack of countersign complexity controls
Users Denial of user actions or activeness Untraceable user actions due to generic accounts
Malicious Insider, Users Unchecked information alteration Lack of logging and monitoring controls
Non-Specific, Natural Loss of power Lack of redundant power supply
Natural Equipment damage or devastation due to natural causes (fire, water, etc.) Lack of environmental controls

A sample Threat Vulnerability Pair Matrix is provided in the companion website of this book.

This threat and vulnerability pair matrix will be the cornerstone for your gamble ciphering. Typically, the threat and vulnerability pair matrix is applicable for all assets and can exist used equally a generic template when computing the risk scores.

Read full chapter

URL:

https://www.sciencedirect.com/science/article/pii/B978159749735000004X

Information Security Risk Assessment: A Applied Approach

Mark Talabis , Jason Martin , in Information Security Risk Cess Toolkit, 2013

Vulnerability Identification

In the previous step, SP800-30 required a list of threat sources. In one case this listing has been compiled, the side by side step deals with identifying vulnerabilities that can exist leveraged by these threat sources.

Basically, a threat source plus the vulnerability that leverages it produces what nosotros call a threat and vulnerability pair. This is a very important concept in SP800-30 and with all risk assessment frameworks. Hither is an case of a threat and vulnerability pair:

•

Threat Source: Hacker.

•

Vulnerability: Lack of Organization Patching.

And then for each of the threat and vulnerability pairs that have been identified, a threat action is and so created. The threat action of the threat and vulnerability pair outlined above would exist:

•

Threat action: A hacker using an exploit against a system vulnerability and gaining admission to the system.

Probably one of the most useful aspects of the SP800-30 is that it provides possible inputs or sources of information for each of the steps. For vulnerability identification, SP800-30 identifies the following sources to assist in identifying vulnerabilities:

1.

Previous hazard assessments.

2.

It system audit reports.

three.

Vulnerability Listings.

4.

Security advisories.

5.

Vendor advisories.

6.

CERT.

seven.

Organisation security testing.

8.

Security requirements checklist.

In SP800-thirty, i very of import source of information in the vulnerability identification step as well as in other steps is the Security Requirements Checklist. This is a checklist of the security controls that are "standard" for an asset to comply with in order to have a baseline level of security. A resource that can exist utilized is SP800-53 or the "Recommended Security Controls for Federal Information Systems and Organizations." Any "non-compliance" or control gaps that were found through this checklist could be identified as a vulnerability in the system being assessed. At the end of this stride, you should take a list of vulnerabilities for each of the threat sources identified for the system.

Read full affiliate

URL:

https://www.sciencedirect.com/science/article/pii/B9781597497350000026

Hazard Cess Techniques

Evan Wheeler , in Security Hazard Direction, 2011

Sample Worksheets

Having a structured assessment arroyo is essential to the viability of the FRAAP approach; so, this section provides several worksheets that tin be used to capture the artifacts of each step of the FRAAP session. Keep in mind that each worksheet has been slightly adapted from the typical FRAAP worksheet to meet the adventure model used in this volume, but the general concepts remain the same.

The offset step in the session is to start identifying concerns or risks, assign them a risk type (C-I-A-A), and identify the resource affected by the take a chance. Y'all can see an case of this in Effigy 10.1.

Figure x.1. Risk description list worksheet.

One time you take completed the brainstorming, review the listing of risks identified and eliminate any duplicates. You lot should now have a list of categorized risks with the associated resources identified. Next, on the resource sensitivity contour worksheet (Figure 10.2), you lot will commencement out by list each resource from the start worksheet.

Effigy x.2. Resource sensitivity profile worksheet.

Once you lot have listed all of the resources, include a very short description of that asset's sensitivity or importance to the organization. Use this description to guide your rating of the resource'south confidentiality, integrity, availability, and accountability sensitivities using the same Low-Moderate-High calibration from our before security adventure profile. Finally, determine the overall sensitivity for the resources based on highest of the individual C-I-A-A values.

At this betoken, you have identified the risks and their associated resources and rated the sensitivity to risk for each resource. Side by side, you will demand to interruption each risk into its threat and vulnerability components, every bit shown in Figure 10.3.

Figure x.3. Run a risk exposure rating worksheet.

Notice in the case in Figure 10.3 that one initial risk has been separated into two different combinations of threat/vulnerability pairs with slightly unlike gamble ratings. This illustrates how the combinations of threats and vulnerabilities can effect in dissimilar run a risk exposures depending on the threat category. The threat categories being used are as follows:

•

Natural disaster

•

Infrastructure failures

•

Internal abuse

•

Accidents

•

External targeted attacks

•

External mass attacks

In this worksheet, the likelihood and severity of the threat/vulnerability pair is combined with the sensitivity of the resource from the previous worksheet to derive the final exposure rating.

You can use the qualitative mapping table from Chapter vi to derive the exposure value from the likelihood, severity, and sensitivity ratings.

Once the risks have been captured and rated, y'all volition need to identify the controls that volition mitigate them. You can start with a list from one of the numerous industry resource available (for example, ISO, NIST, NSA) or you can build your own custom listing. Oftentimes, organizations will publish a list of canonical or existing controls and technologies. This can help to reduce the complexity of the surroundings and increase the reusability of previous investments.

A good place to start is with the 20 Critical Security Controls for Effective Cyber Defense [4]. These Tiptop 20 Controls were agreed upon past a consortium The states government representatives, which included the National Security Agency (NSA), US Computer Emergency Readiness Team (US CERT), the Section of Defense Articulation Task Force-Global Network Operations (DoD JTF-GNO), the Department of Energy Nuclear Laboratories, the Department of State, and the Department of Defense force Cyber Crime Center, plus the top commercial forensics experts and penetration testers that serve the cyberbanking and critical infrastructure communities.

Use the mitigating controls list worksheet shown in Figure x.four to capture the mitigating controls that could be implemented to address the risks identified above, including the command type of preventative, detective, or responsive. You lot will use this worksheet to map each take chances to the control that will adequately mitigate it. When choosing controls, follow these guidelines:

Effigy 10.four. Mitigating controls listing worksheet.
•

Identify controls that accost multiple risks

•

Focus on cost-effective solutions

•

The total cost of the control should be proportional to the value of the asset

In many cases, multiple controls will be needed to properly mitigate a unmarried risk. Too, a single control may mitigate several risks. In the original FRAAP worksheets, there are a few interim worksheets to help illustrate the furnishings of mapping the controls to the risks and the risks to the controls. This can help you see the controls that will give you the most blindside for your buck. For the sake of simplicity, those worksheets have been eliminated here and have been replaced with the single action programme worksheet in Figure 10.five. The final worksheet (Effigy 10.4) was a unproblematic list of each take chances and the controls that could be used to mitigate it in the social club the risks were identified. The action programme worksheet should summarize all the information that you lot take gathered and so far for each of the priority items. These should be listed in order of importance.

Effigy 10.5. Action plan worksheet.

You desire to showtime by focusing on the risks with the highest ratings because they crave the most immediate attention. The moderate risks will need attention soon and the low risks can exist dealt with when time and resources are bachelor. You may also focus on prioritizing the controls that mitigate the most risks. When y'all are recommending deportment, remember to think about the fourth dimension and resource that will be required to execute on the plan. There is no value in listing action items that aren't applied.

Exist sure to identify who is responsible for each detail and include a borderline. As you are considering mitigating controls, always keep in mind that accepting a hazard as-is may be an option as well.

Read full affiliate

URL:

https://world wide web.sciencedirect.com/science/commodity/pii/B9781597496155000104

Information Security Risk Assessment: Reporting

Mark Talabis , Jason Martin , in Data Security Hazard Cess Toolkit, 2012

Risk Conclusion

The Risk Determination section is the final output based on the results of the Affect Analysis and Likelihood Assay. The final output that is represented in this department is the Adventure Score. Since the gamble score is computed for all threat and vulnerability pairs for all systems, information technology is not feasible to put all of the results in the trunk of the report. As with Touch on and Likelihood analysis, the results for this section are better represented in an Appendix. In our example this is a spreadsheet containing the risk computation. As with the previous section we encourage you lot to provide an example within the body of the report and will provide an instance below. Information technology is besides a good thought to present some form of amass results since the full risk scores cannot be hands presented. The presentation of the aggregate results could be a summation table of all the take chances scores as seen in the example beneath. All of the content for this section tin be derived from the data analysis activities covered in Chapter 4. What follows is a template that can be used for this section:

Risk Determination provides a quantitative gamble value representing the systems exposure to a threat exploiting a item vulnerability subsequently current controls take been considered. This quantitative value is in the form of a Gamble Score. A risk score basically follows the following formula:

•

RISK= IMPACT x LIKELIHOOD

The computation for the hazard value is a fairly straightforward multiplication of the Touch and Likelihood scores. This ciphering was performed for all threat and vulnerability pairs for all systems that were in scope for this assessment. An instance of what this looks like for i of the hypothetical in scope systems is captured below:

Application: Hospital Data System
Threat (Amanuensis and Activeness) Vulnerability Impact Score Likelihood Score Risk Score
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted data 5 2 10
External Intruders, Malicious Insiders, Malicious Lawmaking System intrusion and unauthorized arrangement access Possible Weak Passwords due to lack of countersign complication controls 5 2 x
Users Deprival of user actions or activeness Untraceable user deportment due to generic accounts 5 ii 10
Malicious Insider, Users Unchecked information amending Lack of logging and monitoring controls v three 15
Not-Specific, Natural Loss of power Lack of redundant power supply 5 2 10
Natural Equipment impairment or destruction due to natural causes (fire, water, etc.) Lack of environmental controls five i 5

The following risk categorization tabular array was then used to categorize the singled-out system chance scores into risk classification "buckets" of High, Moderate, or Low Risk:

Based on the categorization efforts using the Bear on versus Likelihood table above, the following table is an example of loftier risk items for a system are identified:

For all system adventure scores and adventure classifications delight refer to the Data Collection and Computation matrix in the Appendices of this study.

Based on the run a risk scores, what follows are aggregate views resulting from the chance determination phase. This table presents a ranking of applications based on their aggregate risk scores (sum of all risk scores for all threat and vulnerability pairs). In theory, the higher the aggregate risk score, the greater the risk to the system.

Adventure Rank Application Aggregate Risk Score
ane HIS threescore
ii HR Payroll 50
3 Cardio Research DB 47
4 Email 46
5 Imaging 45

The following table provides a breakup of the risk scores per system based on each threat and vulnerability pair. The higher the score for each listed arrangement the greater the adventure of the threat exploiting the vulnerability.

Threat Agent Threat Action Vulnerability HIS Cardio Research 60 minutes Payroll Email Imaging Aggregate Score
Users Eavesdropping and Interception of data Lack of manual encryption leading to interception of unencrypted data x 9 x xv xv 59
External Intruders, Malicious Insiders, Malicious Code Organisation intrusion and unauthorized system access Possible Weak Passwords due to lack of password complication controls x 12 15 10 10 57
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls 15 ten v 9 v 44
Users Deprival of user actions or activity Untraceable user deportment due to generic accounts x 10 ten six five 41
Non-Specific, Natural Loss of power Lack of redundant ability supply 10 3 v 3 5 26
Natural Equipment damage or devastation due to natural causes (fire, water, etc.) Lack of environmental controls 5 3 5 3 v 21

Finally based on the assemblage and categorization effort in the previous tables, the post-obit table identifies the high take chances systems for each of the risks represented by a threat and vulnerability pair:

Threat Agent Threat Activity Vulnerability Score High Risk Systems
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted data 59 Imaging, Email
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized organization access Possible weak Passwords due to lack of password complexity controls 57 HR Payroll
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls 44 HIS
Users Denial of user actions or activity Untraceable user actions due to generic accounts 41 None
Non-Specific, Natural Loss of power Lack of redundant power supply 26 None
Natural Equipment harm or destruction due to natural causes (fire, water, etc.) Lack of environmental controls 21 None

As seen in the template, the structure of the Risk Determination section follows a very similar pattern every bit the three intermediary sections (Impact, Likelihood, and Command Assay) whereby the full results are referenced in a container as it is not feasible to put everything in the body of the report. A central differentiator is that by virtue of it beingness the final stage of the computation, there are certain aggregate tables that can be presented.

Read full chapter

URL:

https://www.sciencedirect.com/science/commodity/pii/B9781597497350000075

Information Security Risk Assessment: Risk Assessment

Mark Talabis , Jason Martin , in Data Security Gamble Assessment Toolkit, 2012

Threat and Vulnerability Review

We accept conducted individual hazard reviews and by this time have a high level agreement of why the hazard rankings are what they are. At this bespeak, we will at present focus our attention on the threat and vulnerability pairs.

At that place are two approaches to performing this review:

1.

Identify HIGH chance threats across all systems—This is fairly straightforward. This allows the assessor to rapidly place threats that have the highest risk for the systems reviewed.

2.

Obtain amass threat and vulnerability pair scores across all systems—This is a little more subtle of an arroyo. This allows the assessor to see across just HIGH take a chance items and identify potential systemic problems across all systems.

Let'southward focus on the first approach earlier moving on to the second. In the get-go approach, we simply identify all the threat and vulnerability pairs that accept a HIGH rating and so rank them based on the number of systems that are affected.

This approach, different simply ranking systems past gamble scores, volition allow the assessor to immediately place high risk items for the systems reviewed. These items volition ultimately be part of risk handling activities which nosotros will be dealing with in a after chapter.

Permit's piece of work on an example. This process is actually fairly straightforward. Offset allow's go through all the organization risk matrices and identify all unique threat and vulnerability pairs that are classified High risk. Yous'll cease upwardly with a table similar to this:

Threat Amanuensis Threat Action Vulnerability
Users Eavesdropping and Interception of information Lack of transmission encryption leading to interception of unencrypted data
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized system access Possible Weak Passwords due to lack of password complexity controls

Afterward that, for each threat and vulnerability pair, identify all systems that have Loftier take a chance ratings for that particular pairing. You will terminate upwardly with something similar this:

Threat Amanuensis Threat Action Vulnerability Affected Systems
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted data Email Imaging
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls HIS
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized system access Possible Weak Passwords due to lack of countersign complexity controls HR Payroll

And there y'all have it. Through this view, it is adequately easy to see which threats and which systems are the nigh of import to consider in terms of take chances. Let'south say that we have the arrangement profile and command surveys on hand for each of the systems reviewed. Using the surveys, you could prepare an assay similar the following:

i.

There's a high take a chance of potential disclosure of information from Email and Imaging since both transmit highly confidential and regulated information but the information is not encrypted.

ii.

HIS has bereft logging and monitoring controls to detect unauthorized alterations. This is compounded past the fact that the arrangement has a very large and diverse user base (contractors and vendors) and the HIS is admittedly disquisitional to the hospital operations.

3.

The HR Payroll System has a high gamble of potential unauthorized admission because it does not support password complication. The adventure is compounded by the fact that the system contains confidential and regulated data equally well as the fact that information technology is considered highly critical to the organization.

For now, simply keep this assay in mind. This information will be useful when we start preparing risk management handling plans for specific systems.

Now it's time to discuss the 2nd, more subtle approach. Compared to the previous arroyo, which focuses on identifying High gamble items for specific systems, this approach tries to identify systemic problems across all systems.

The simplest manner to practice this is to use the aggregate scores for each threat and vulnerability pair across all systems. Permit'south work through an example. In this table you meet all the threat and vulnerability pairs for one arrangement.

Threat Agent Threat Activeness Vulnerability HIS
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted information 10
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized system access Possible Weak Passwords due to lack of password complexity controls 10
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls fifteen
Users Deprival of user actions or activity Untraceable user deportment due to generic accounts 10
Non-Specific, Natural Loss of ability Lack of redundant power supply 10
Natural Equipment impairment or destruction due to natural causes (fire, water, etc.) Lack of environmental controls 5

To allow us to review all systems we just create columns and input the scores for each of those systems and and so full the score for each threat and vulnerability pair.

Threat Agent Threat Action Vulnerability HIS Cardio Research Hr Payroll Email Imaging Score
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted information x 9 ten fifteen fifteen 59
External Intruders, Malicious Insiders, Malicious Lawmaking System intrusion and unauthorized system access Possible Weak Passwords due to lack of password complexity controls ten 12 xv 10 10 57
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls 15 10 five 9 five 44
Users Denial of user actions or activeness Untraceable user actions due to generic accounts 10 10 ten 6 5 41
Non-Specific, Natural Loss of power Lack of redundant power supply 10 3 5 three v 26
Natural Equipment impairment or destruction due to natural causes (fire, h2o, etc.) Lack of environmental controls 5 3 5 3 5 21

As a terminal step, the final aggregate scores are then plotted to each threat and vulnerability pair. We and then sort the threat and vulnerability pairs based on the amass chance scores and we get:

Threat Agent Threat Activity Vulnerability Score
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted data 59
External Intruders, Malicious Insiders, Malicious Code Organisation intrusion and unauthorized system admission Possible Weak Passwords due to lack of password complexity controls 57
Malicious Insider, Users Unchecked data alteration Lack of logging and monitoring controls 44
Users Denial of user actions or activity Untraceable user actions due to generic accounts 41
Non-Specific, Natural Loss of ability Lack of redundant power supply 26
Natural Equipment damage or destruction due to natural causes (fire, h2o, etc.) Lack of environmental controls 21

This view quickly provides united states an idea of what appears to exist systemic problems that the organization might be encountering across multiple systems. To make this even more helpful, let's add together the top two or three systems with the highest scores for each of the threat and vulnerability pair:

Threat Agent Threat Action Vulnerability Score Affected Systems
Users Eavesdropping and Interception of data Lack of transmission encryption leading to interception of unencrypted data 59 Imaging, Electronic mail
External Intruders, Malicious Insiders, Malicious Code System intrusion and unauthorized organization access Possible Weak Passwords due to lack of password complexity controls 57 HR Payroll, Cardiology Research
Malicious Insider, Users Unchecked data amending Lack of logging and monitoring controls 44 HIS, Cardiology Research
Users Denial of user actions or activity Untraceable user actions due to generic accounts 41 HIS, 60 minutes Payroll, Cardiology Research
Non-Specific, Natural Loss of power Lack of redundant ability supply 26 HIS
Natural Equipment damage or destruction due to natural causes (fire, h2o, etc.) Lack of environmental controls 21 HIS, Payroll Arrangement, Imaging

In this view, we can already derive several important observations nearly take a chance beyond all of the systems reviewed. Hither is a sample analysis for the tabular array higher up:

1.

By far, the highest hazard to the system is disclosure of regulated and confidential data. Looking back at our other analysis activities, this is likely due to the fact that two enterprise systems, that transmit large volumes of regulated data, have weak encryption controls.

two.

Unauthorized organization access due to weak passwords, though only related to 1 arrangement (Payroll System), actually gets a High rating as several other systems hit a moderate score because of weak controls. For example, the Cardiology Database has weak access controls; all the same, since it'southward full general exposure is low (as it is not as critical as the payroll database) it does not rank as high as the Payroll Organization.

3.

It is interesting to note that fifty-fifty though the Cardiology Research Database did not have any Loftier adventure items, information technology appears in the summit two or three in several of the risk categories. This would be worth making note of every bit well.

This approach provides the assessor with an overall view of the risks that are pervasive throughout the systems reviewed. When yous arroyo an analysis in this fashion you are able to catch trends in areas of risk that might not be identified if y'all just focus on items classified as HIGH. The Cardiology Research database is a practiced example of how this approach pays off. Fifty-fifty though the Cardiology Research database does not have any high risk items, it ranks high in many of the threat and vulnerability pairs. This could be an indication of an overall problem with the awarding. Subsequently quickly diving into the details effectually the application it becomes obvious that many of these factors are because it is an Access Database that has a general lack of controls.

A common theme throughout the analysis performed hither was the use of summing. Using an aggregate arroyo to analyzing gamble is a useful technique to place outliers and give clues to the assessor on what systems and threats to focus on. Though there are exceptions, about of the fourth dimension systems with a high score typically indicate that they are both of high value to the organization and suffering from either poor performing or missing controls.

We are ofttimes asked whether it is necessary to exercise this type of assessment over all systems in an enterprise. In our experience such a review is not necessary and may crusade the process to go big and unmanageable. In that location are software packages that volition assist with automating these processes to a certain extent; withal, at that place is withal meaning work that has to become into data collection and entry. It has always been our position that with the right arroyo and utilise of a consistent method you can extrapolate the results and, for the nearly part, assume that if the effect exists in systems that support critical processes at an enterprise level than information technology is very likely going to exist in a secondary or tertiary organization. This may not be true in all cases; withal, based on our feel this is typically a very audio approach. At this time, It is very of import to note all observations and analysis conducted in this part of the process as this will help in creating focus for the take a chance management plans.

Read full affiliate

URL:

https://world wide web.sciencedirect.com/science/article/pii/B9781597497350000051

Reports and Consulting

Evan Wheeler , in Security Take a chance Management, 2011

Assessment Steps

Next, you want to provide a high-level breakdown of the steps that were followed during the assessment. This gives the reader a good sense of the due diligence being performed and the thoroughness of the assessment. For example:

The following steps were followed and documented when conducting the assessment of XYZ's environment:

• A list of all XYZ's critical resource was compiled, including a brief clarification of the business value to XYZ. Each resource was assigned a value according to its risk sensitivity.

• Using a series of different testing techniques, all vulnerabilities were identified for the disquisitional resources, including a brief description of the weakness, how the weakness could affect XYZ, and the categorization of the threat.

• A severity and likelihood rating was calculated for each threat/vulnerability pair and a final hazard exposure rating was determined based on the confidentiality, integrity, availability, and accountability (C-I-A-A) needs of each critical resources.

• For each of the identified risks, an action was recommended that would bring the risk into an adequate range of exposure.

Although the first report format rated the risk exposures based on a single sensitivity value for each critical resources, some other way to organize this section of the executive summary would be to focus more on the confidentiality, integrity, availability, and accountability sensitivities for each resources and the evaluation of the threat/vulnerability pairs for each aspect of C-I-A-A. For example:

To come up with a program to mitigate and incorporate these threats, a detailed and systematic information security risk assessment was undertaken to identify the specific exposures that present the highest degree of risk to the organization. The post-obit assessment approach was undertaken:

• First, company assets (both tangible and intangible) were identified and related business organization values were documented.

• And so, depending upon the criticality of the resource's business value, these assets were evaluated for importance in terms of individual aspects of confidentiality, integrity, availability, and accountability (C-I-A-A).

• The C-I-A-A evaluation was used to drive an cess of the specific threats and related vulnerabilities associated with these resources.

• The most probable and most severe take chances exposures were identified, and these in turn were used to make up one's mind the overall take a chance exposure of a particular resource.

• The risk exposure ratings were used to determine recommended safeguards, which ultimately led to formation of the take chances mitigation strategy.

Hopefully, using these 2 very different approaches to draw the assessment process every bit a starting point, you can develop your ain format that will highlight the important aspects of your cess mode and priorities. Remember also that this is meant to exist one section of an executive summary, not a doctoral thesis, so try to continue it brief and to the point.

Read full chapter

URL:

https://www.sciencedirect.com/scientific discipline/commodity/pii/B9781597496155000098

Risk Exposure Factors

Evan Wheeler , in Security Risk Management, 2011

Estimating Likelihood

Every bit with severity, we demand to starting time past expanding on the three-level risk calibration for likelihood before nosotros tin can start assessing risks. In this case, we need to add ii additional levels of granularity, ane at the top (Very Loftier) and other at the bottom (Negligible). One motivation for this change is to permit for a closer mapping to the typical categories of threat universe and another is to account for the about cypher level at the bottom that signifies those exploits that are theoretically possible, simply not at all probable.

Table 6.12. Qualitative Likelihood Calibration, v-Level

Level Description
Negligible The threat source is part of a pocket-sized and trusted grouping, controls prevent exploitation without physical access to the target, significant within knowledge is necessary, or purely theoretical.
Low The threat source lacks motivation or capability, or controls are in place to prevent, or at least significantly impede, the vulnerability from being exercised.
Moderate The threat source is motivated and capable, merely controls are in place that may impede successful exercise of the vulnerability.
High The threat source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective.
Very High Exposure is apparent through coincidental use or with publicly available information, and the weakness is attainable publicly on the Internet.

It is easy to confuse factors that will bear on the severity and likelihood of a threat/vulnerability pair. One possible qualitative likelihood scale is shown in Table half dozen.12. There are and so many factors to consider, from the composure of the aggressor to the attractiveness of the target. For example, if exploit code is freely available on the Cyberspace, your likelihood rating is going to go upward. Yous may also want to look at historical incident data within your own organization or industry equally a factor. For instance, employees are constantly losing their BlackBerries, and then the likelihood of this effect may be easy to authorize. These are some good starter questions to ask when you are trying to qualify likelihood:

•

What is the size of the population or threat universe?

•

Is there a location requirement for exposure?

•

Are data and/or tools bachelor about exploit specifics?

•

Does exploit require tricking someone?

•

What skill level is required for exploit?

•

Can the vulnerability exist exploited anonymously?

•

How attractive is the target?

•

Does exploit require another vulnerability to exist nowadays?

•

Has it happened before?

Tips & Tricks

If these have been a documented occurrence of a vulnerability existence successfully exploited within your organization, unless further mitigations accept been put in place since the incident, and then the likelihood rating should be increased by one level from the initial rating. A documented incident in your same industry should fix the minimum likelihood rating at Moderate.

If you lot are still having problem qualifying the likelihood of a vulnerability, here are some additional questions to consider:

1.

Is it applicable in our environment? If vulnerabilities are existence identified through some kind of active testing, then this question might not be useful, just when you are sorting through new security advisories, this should exist the showtime question you ask before yous do any other risk analysis

2.

Is in that location a virus or IDS signature for information technology? Compensating controls can reduce the severity or likelihood of a threat/vulnerability pair, but most oft, they will affect the likelihood. Say, there is a new vulnerability announced and virus lawmaking has been detected on the Net. The likelihood of a compromise would exist rated lower if your anti-virus vendor has already distributed a signature for that virus versus if they have not.

3.

Is authentication required prior to exploit? Oft, specially in application penetration testing scenarios, testers will identify loftier-severity vulnerabilities that require a valid user to log-in before they are exploitable. This might lower the threat universe to a known population of authorized users.

iv.

Does it affect servers besides as desktops? All of the Adobe vulnerabilities that leverage specially crafted PDF documents to infect systems are a adept example of this gene. Is an Adobe Acrobat Reader vulnerability as likely to be exploited on servers as it is on laptops? How often do users download and view PDF files directly on a production server? Generally, not very often. How often does this happen on a typical laptop? Likely, everyday or multiple times per day. Laptops are too more probable to roam outside the perimeter protections of the organisation than servers, further increasing the chances of a successful compromise. Even if the PDF successfully executed on the server, would other controls forestall the attack from beingness successful? For an exploit to be truly successful, the assailant still has to get the stolen data out of the network or become control of the system entirely?

5.

How widely deployed is the vulnerable software or organization? If a critical Solaris vulnerability is announced, but your organization is primarily a Linux shop, how will this bear upon your likelihood rating? Exercise you think it would make a difference? If we are looking at pure probability, the Solaris server is less likely to be breached in this scenario than the Linux systems, making a breach less probable in this instance than if the vulnerability likewise afflicted the Linux systems.

Of course, this list of considerations is not exhaustive, and these are just a few of the factors to take into account. Hopefully, even so, information technology will give you a good starting bespeak for assessing likelihood, and yous tin and then build on these questions as appropriate for your organization and the risk being assessed.

Read full chapter

URL:

https://www.sciencedirect.com/science/article/pii/B9781597496155000062

Formulating a Risk

Evan Wheeler , in Security Risk Management, 2011

Breaking Down a Chance

If you went on Google and looked upward risk management, chance assessment, hazard assay, or any similar terms, y'all would discover a lot of different definitions, some of which are significantly different from one another and others that but vary in terminology but use the same cadre concepts. Even if you narrow your search to information security take a chance management, you are going to find a vast array of interpretations and perspectives. This is not but problematic for beginners every bit they try to go a grasp on the discipline, but information technology as well makes it very hard to have a productive chat with anyone in the field because you lot will discover yourself constantly tripping over terminology. Later on a few minutes of Google searching for adventure topics, you may commencement to go the idea that about anything can be called a risk assessment. Certainly, at that place are those in the field who are sorely misusing the terminology or basing their approach on fundamentally flawed models and assumptions, only at that place is as well a lot of fantastic enquiry emerging everyday and solid take chances models beingness practical by information security professionals. Don't worry—there is hope for us however! Risk management is finally starting to go the focus that it needs, and with that volition come more mature chance models.

Finding the Risk, Part I

We will kickoff by defining some terms to describe the key components of a risk, so nosotros will employ these terms every bit we clarify some simple risk scenarios. The terminate goal is a model that will accurately articulate, categorize, and charge per unit risk exposure. Consider the following assessment finding:

"Network administrators utilise telnet to manage network devices and their passwords never expire."

Assume that you lot are a security managing director for a retail company and you lot identified this finding. How would you interruption down this scenario into risk components? What is described above is certainly a finding, but does it describe the risk? For example, y'all should be able to answer the following questions from a well written hazard statement:

•

Who is a threat nosotros are worried most?

•

Why is this vulnerability causing the exposure?

•

What is the potential impact to the organization?

A detailed cess would likewise have into account any compensating controls that might lower the risk. Already, we have thrown out a lot of terms that may non be articulate yet: threat, vulnerability, affect, exposure, and compensating controls. These demand to be clearly defined before we can break down our Telnet finding. One time nosotros define some fundamental terms, we will come back to our discussion about the network administrators.

Terminology Is Key

The core elements of a adventure exposure and hazard rating are as follows:

•

Sensitivity of the resource (importance or criticality to the organization)

•

Threats, and threat countermeasures

•

Vulnerabilities, and vulnerability countermeasures

•

Inherent Gamble (the value of the unmitigated risk exposure)

•

Compensating Controls (controls currently in identify that reduce the exploitability)

•

Residual Risk (the value of the net risk after mitigation)

In simple terms, an information security take chances exposure should depict the issue of a successful exploit of the vulnerability by the threat. Sometimes, this combination of threat and vulnerability is referred to as the "affect" or "consequence" of a risk exposure. A simple way of remembering the differences between the run a risk terminology is that the threat describes the "who," the vulnerability explains the "why," and the chance the "what" consequences the business will experience. This may seem very simplistic, just it really helps to anticipate the differences.

Given those factors, a risk exposure value tin be calculated. Chapter 4 discussed risk sensitivity in nifty item, then the remaining elements of threat and vulnerability still need to be explained. Gamble qualification and especially quantifications can go very complex, but at the near basic level, the magnitude of the vulnerability is measured by severity, and the probability of the threat occurring is measured by likelihood. Together, sensitivity, severity, and likelihood are the 3 variables in your measurement of gamble exposure. Specific risk qualification methods and hazard calculations will be covered in more than detail later in this book, but for now, it is important to empathize what each term is describing.

To authorize a gamble, y'all need at to the lowest degree 3 ratings, which are divers by the SANS Plant [1] as follows:

•

Sensitivity A value relative to the resource's tolerance for risk exposure.

•

Severity Measures the magnitude of consequences from a threat/vulnerability pair being realized.

•

Likelihood Measures the probability that the threat/vulnerability pair will be realized.

The severity is a measure of the magnitude of the weakness that the threat tin can exploit. If the hazard describes the consequences if the vulnerability is exploited, then the severity is a measure of the magnitude of the exploit. For example, it may describe the extent of the penetration into your network or the amount of data exposed.

The likelihood is a measure out of how probable information technology is that the threat/vulnerability pair will be realized. If the hazard describes the consequences if the vulnerability is exploited, and so the likelihood is a measure out of the chance that information technology volition happen. Some chance models distinguish between the probability that a take a chance will occur, and the frequency with which it is likely to occur. Although this is an important distinction, nosotros will include both considerations in likelihood for now to proceed the model elementary. Every bit y'all get comfy with the basic model, you tin expand on this.

For example, an exploit of easily readable backup media could lead to "an unauthorized disclosure of sensitive credit card information for all customers, which would require a breach notification to the major credit card companies and afflicted clients." Notice that this description helps us rate the severity of the exploit past indicating the amount of data that will exist disclosed (all client data) and the sensitivity of the asset by indicating which data will be disclosed (sensitive, "regulated" customer credit card data). It also indicates that a notification to clients will be required, which further qualifies the sensitivity of the asset we are assessing by gauging the effects on reputation, financial loss, and possible exposure to civil legal action. You would also want to qualify the likelihood by how attractive these data would be to an attacker, how easily the backup media could be intercepted or lost, and how readily it could be read by a malicious party.

This type of take a chance qualification can help y'all determine your mitigation priorities past identifying the mission disquisitional functions that have the almost rest take chances because, presumably, you lot will work on these starting time. It is besides important to note that, without a threat, the vulnerability results in no risk exposure.

Envision the Consequences

When you demand to present a chance to senior management or a customer, it is critical to clear the risk accurately. Mixing upwards threats, vulnerabilities, outcomes, and controls will ultimately confuse your audition. When y'all are describing a take a chance exposure, call back about the consequences for the system, not simply the firsthand exploit activity. What would happen if the vulnerability were to be exploited? Remember that the risk exposure clarification needs to detail the impact to the organization. For example, if sensitive information were disclosed unintentionally or stolen from the organization, what would happen?

If y'all are having problem getting started, try to answer these questions:

•

Would the organisation lose its clients?

•

Would they become out of business?

•

Would they have to notify all their customers nearly the unauthorized disclosure?

•

Could they recover from a alienation?

If your risk clarification doesn't respond these questions, then y'all oasis't fully covered the components of the take chances.

The risk description should include the outcome of a successful exploit of the vulnerability by the threat. To avoid the error of mixing upwards threats, vulnerabilities, and risks, try using a structured format with required elements to provide a iii-part gamble statement:

"Every bit a consequence of <one or more than definite causes>, <uncertain event> may occur, which would lead to <one or more effects on resource(southward)>"

Consider what would happen if sensitive data were disclosed unintentionally or stolen from the organization. Your hazard clarification needs to address the consequences or outcomes in business terms. For instance, you could use this statement format to a data breach risk:

"As a result of lost backup tapes, an unauthorized disclosure of sensitive credit card data for all customers may occur, which would crave breach notifications to regulators and affected clients."

Always accept a disquisitional eye to whatever of your hazard descriptions and try to anticipate whether your description conveys the importance of the risk to senior management. Read over your hazard description and if you don't think it quickly tells the reader why they care nearly some security weakness and how this affects their bottom-line, then it needs to be rewritten. Also, be very careful not to include too much commentary or narration in your risk clarification when presenting information technology to management. They are going to want the facts without the colour of additional opinions or commentary.

It is easy to confuse the threat and vulnerability with the risk itself. Call back of the risk as a clarification of the consequences. What would happen if the vulnerability were to exist exploited? Call back that the adventure details the touch on to the organization.

For example, read through each of these statements and decide if you think that they describe the gamble:

•

Anyone who could compromise the access controls could have access to a tremendous corporeality of business information.

•

Transmitted information like passwords, eastward-mails, and business concern data are discipline to eavesdropping.

Advisedly read these two statements and decide whether y'all think that they pass the exam of conveying the who, the why, and the what. Both of these analyses seem to have stopped short of the point of the take a chance. They simply don't depict the business consequences for the arrangement. Without context, there is no way to really qualify the impact to the organization in terms of productivity loss, loss of revenue, regulatory sanctions, so on.

Let's try rewriting these analyses. Does the following statement ameliorate describe the first adventure?

"Anyone who could compromise the admission controls could have access to view regulated financial information for clients numbering around 20,000 records. A breach of this information would require mandatory reporting in over 40 states, and a $200 fine per record for Massachusetts residents."

Detect how this adventure description at present provides a very clear picture of how the organization will be impacted. This assay not only describes the type of data at run a risk but too includes the quantity and the type of admission (read-only in this instance). It goes on to describe the obligation to disembalm this breach to clients in many states and the expected dollar corporeality loss for clients residing in Massachusetts. This gives management a pretty expert picture of the impact to the arrangement.

Now let's try rewriting the other example. Does the post-obit statement improve describe the hazard?

"Transmitted information similar system ambassador passwords for product servers are discipline to eavesdropping across the network internally. Access to these passwords could allow a malicious insider to cause an outage of all client-facing services that would last for upwardly to 24 hours."

Notice that e-mails and other business information accept been left off; it is all-time to focus on one risk at a time. The eavesdropping of other types of sensitive data may have a very different touch on the arrangement and should be listed separately. Detect that this analysis describes the telescopic of the outage that results both in the number of clients afflicted and the duration of the potential outage. It also limits the scope of the source to insider, which would help someone reading this analysis to qualify the hazard and understand the potential threat vector. This assay likewise assumes some mitigating controls that would permit them to get the service operational once more in no more than than 24 hours.

The value of articulate and concise communication cannot be overstated in risk management. No matter how accurate your risk models or how thorough your threat analysis is, information technology will all be meaningless if you can't effectively present information technology to the business organization.

Finding the Adventure, Function II

We have laid out some basic risk concepts for y'all so far—at present permit's put this into practice. Remember the network administrator scenario from earlier role of the affiliate:

"Network administrators use Telnet to manage network devices and their passwords never expire."

How would you lot begin to assess the sensitivity, severity, and likelihood of this exposure for a typical retail organization?

Allow's start with the vulnerabilities. What is wrong with using Telnet to manage network devices? If you aren't familiar with the technical details of the Telnet protocol, a quick Net search should plow up plenty of reasons that using Telnet is dangerous. Equally a quick hint, only referencing a "lack of encryption" is not proficient enough for our take a chance description; as discussed in previous chapters, you should never accept "best practices" every bit a reason to do annihilation. The use of Telnet makes such a good instance because the limitations are easily explained to even the virtually nontechnical person. Using Telnet to manage any system is problematic considering all communications betwixt the customer and server are transmitted in cleartext (or in the clear), meaning that anyone who can intercept the traffic can read everything without the sender or receiver knowing they have washed and so. The information at risk includes the username and password used to log into the organization. If you lot are using Telnet across an untrusted network like the Cyberspace or your local Starbucks wireless, you can assume that the data take been disclosed. In the instance of the network administrator, this would include the username and countersign used to log into and manage a network device such equally a router or switch. The consequences of this weakness should be clearer now.

Now let'south consider the threats. You will want to place both the threat actor, who or what could exploit this vulnerability, and the threat activity, how the weakness will exist exploited past the histrion. To authorize the most likely threats, y'all volition want to practise some basic threat modeling. Start with a few basic questions to place the threat histrion first:

•

Are y'all worried about external mass attacks, such as a full general virus that isn't meant to compromise any one organization? Or, would it demand to be a targeted assault on your organisation to be of business organization? Are internal employees a concern or are you mostly worried about outsiders?

•

Are y'all more than worried about intentional abuse of this weakness or accidental damages?

Side by side, a few simple questions can help you to qualify the threat activity:

•

Can this weakness be exploited from anywhere or is a sure level of access needed?

•

Would the vulnerability be exploited with a concrete or technical attack or a combination of the ii?

•

Is there a level of business knowledge or information about the environment needed to successfully exploit the weakness?

•

What is the technical skill level required to exploit it?

For the threat activity, you lot will want to describe the most likely vector for abuse of the weakness. Vulnerabilities will often be for a long fourth dimension without ever being driveling, so what threat makes this one likely to exist exploited?

Side by side, you will want to qualify severity. Recollect of this as the magnitude or telescopic of the weakness, not necessarily the consequences of the exposure. This is a very important distinction. When you profiled your resource and determined the sensitivity level, you considered all the possible impacts to the organization if it were violated. That potential bear on exists regardless of the threat/vulnerability combination, simply what you want to measure out with the severity is the extent of the compromise. A disclosure of a single sensitive record from your database will take a much smaller affect than ane,000 records from that same database. This is an case of severity levels for confidentiality. Availability severity levels might exist distinguished by the length of a disruption, the number of users afflicted, or the extent of the disruption from degradation of service upward to a full outage of services. Another aspect of severity is the level of access the attacker could have over your systems. For example, some network devices have multiple levels of hallmark, from a normal read-only user with express functionality to a full privileged user. On other systems, this would exist the difference betwixt the scope of access a restricted user might have to perform everyday tasks versus that of an administrator with total control of the organization. The vulnerabilities with the highest severity will provide that unrestricted level of admission—what we call "owning the system."

Returning to the Telnet example, y'all will as well desire to call up about how the lack of whatsoever countersign expiration controls might chemical compound the trouble of using Telnet. The fear is that not only would the administrator's credentials exist compromised but the attacker could likewise apply them indefinitely. At least if the password expired every 30 days, the attacker might not have the opportunity to intercept the adjacent password and the length of the exposure would therefore be shortened. Of course, if the attacker stole the countersign one time, they can probably steal it twice, which makes the cleartext Telnet Protocol the primary weakness.

So far, the discussion has looked at the run a risk exposure without considering whatsoever compensating controls that might already be in identify. You may hear this referred to as the "raw adventure" or inherent risk, pregnant that you look at the risk naked of whatsoever controls or constraints that may lower the likelihood or limit the severity. Once again, going back to the Telnet case, if we presume that this organization has a typical corporate network installation, in that location may be a few controls already in place that brand it more difficult or less desirable to exploit this weakness. Suppose the administrators simply access the network devices from the local network and never remotely; in that case, an aggressor may need to be already connected to the internal network to intercept the Telnet traffic. This could greatly bear on your cess of the likelihood depending on the physical admission controls that are in place. At the very least, you might focus your analysis on internal employees, contractors, and guests. For a retail company, however, you need to consider how the networks in whatsoever of the stores might be continued back to the corporate offices. Potentially, network administrators need to remotely manage the network devices in the stores, which increases the opportunities for someone to intercept their communications.

To charge per unit the sensitivity of the network devices, you lot will want to consider the virtually likely outcomes of any breach. The sensitivity level should be an indication of how bad it would exist for your organization to take unauthorized individuals accessing a core infrastructure device like a router or switch. An attacker might exist able to view sensitive data that laissez passer through the network device unencrypted. Possibly, a competitor or disgruntled employee could cause a disruption or deposition of critical network services.

The earlier analysis may seem like a thorough exploration of the Telnet hazard scenario, but in reality, nosotros have only scratched the surface. These basic qualifying questions are a skillful place to start whenever you come across a risk in your organization, merely—non to worry—we will be introducing a more methodical approach soon. Based on the discussion so far, would you recommend the Telnet hazard equally a priority issue to exist addressed past the retail visitor?

Let'southward go through the discussion ane more time and capture the specifics. At that place are actually likewise many possible threat scenarios associated with this one vulnerability to list them all hither, so we'll choose one case bold the organization is a typical retailer:

•

Vulnerability Commands and hallmark credentials are sent to the network device in cleartext, which could allow for eavesdropping or manipulation of information in transit between the user and the network device.

•

Threat Internal corruption. A savvy insider could intercept and steal the credentials of an authorized administrator with the intention to steal sensitive information as it traverses the network.

•

Severity Payment bill of fare information traverses these network devices between the Betoken of Sale organisation (in the stores) and back-end servers (in the corporate data centers). In the issue that the assaulter gained access to the network device, they would accept total admission to view whatever of this sensitive information.

•

Likelihood Although it is possible to view any data in a Telnet session, it is not lilliputian to sniff traffic on a switched network. The attacker would demand to be in the path of the advice between the network device and the administrator, or the assailant would need to exploit a vulnerability on another network device in the path. Additionally, the attacker would need some knowledge of the network device technology in society to capture and view information traversing the network device after gaining admission. The probability of the aggressor gaining access one time the credentials have been stolen is further reduced past the employ of Access Command Lists (ACLs) on the network device to limit Telnet connections to sure source IP addresses used by network administrator's workstations. Given that the password never expires and is therefore likely not ever to be inverse, the chance of interception and successful exploitation increases over time. The set on vector with the nigh the highest probability of success would be from the store network.

•

Sensitivity A breach of this sort would require the organization to publicly report the incident, costing the company over $500,000 directly in the form of fines and lawsuits and as well indirectly when approximately 10% of clients switch their business organisation to a competitor.

And so given this analysis, do you yet remember that this is a priority item to address? Of course, in that location may be more likely or severe risks associated with this vulnerability, but based on this risk, how would you lot rate the risk overall? Take a quick gut cess of the overall hazard on a calibration of Low, Moderate, or High. Think about how information technology compares with other risks in your own environment. If this event existed in your arrangement, should it really bubble to the acme of the listing or would information technology come up out somewhere in the middle? Information technology really is hard to say with any confidence until you lot take a more structured model for evaluating the level of risk exposure, but these threat scenarios are a adept get-go stride to get y'all thinking about how many factors will bear upon the end risk exposure level.

Read full chapter

URL:

https://world wide web.sciencedirect.com/science/commodity/pii/B9781597496155000050

Threat and Vulnerability Direction

Evan Wheeler , in Security Risk Management, 2011

An Efficient Workflow

Now that you lot have a feeling for how to rate vulnerabilities as they come up in from advisories, information technology is worth briefly discussing what else is needed to make a Threat and Vulnerability Direction program successful. There are three basic activities in which every TVM program should be engaging, which are equally follows:

1.

Monitoring advisories from a trusted service.

2.

Performing regular security scanning of your environs, both internally and externally.

3.

Using the advisories and scanning to ensure that regular patching of disquisitional systems is being performed according to the risk of each threat/vulnerability pair.

There are many additional activities that may be within the purview of the TVM program, such as enterprise penetration testing and Cyberspace reconnaissance, but these iii duties are essential. Of form, but scanning an environment or monitoring an informational service isn't enough, you besides need to act on these data sources.

In that location are several commercial and free sources available for security alerts, including the post-obit:

•

United states of america CERT: www.us-cert.gov/cas/techalerts/index.html

•

Microsoft: www.microsoft.com/technet/security/advisory/default.mspx

•

Secunia: http://secunia.com/

•

iDefense: http://labs.idefense.com/intelligence/

•

SANS: http://isc.sans.edu/xml.html

Tips & Tricks

When you are presenting the results of your TVM program to management, keep the metrics very simple. Include a list of the top x most prevalent vulnerabilities, besides every bit the metric showing how the operational groups are doing with patching systems according to the Service Level Agreement (SLA) you have established internally. You want management to see that systems are getting patched in a timely manner, and and so aggrandize your metrics to cover other areas once the organization is comfortable with these initial metrics.

Defining a Workflow

Once you take divers your scales and formulas for calculating the real take a chance exposures of vulnerabilities, you lot need to define a workflow for handling them (run across Figure 11.1). Assuming a iv-tier gamble model, a good place to outset is by looking at but the Critical- and Loftier-level risks, setting bated the Moderate and Low findings for now. Hopefully, y'all volition have very few risks in the Critical category, only it is likely you will have a good number of High risks.

Figure eleven.1. Vulnerability qualification workflow.

Next, you volition need to authorize each vulnerability for applicability to your surround. This will usually require some enquiry on the part of your technical staff if you don't have a skilful nugget inventory that includes software and operating system versions. If you do have a comprehensive asset inventory, your job will be a lot easier and the filtering can potentially even be automated.

Once you have a list of vulnerabilities that are rated either Disquisitional or High and you take determined that they are applicable to your surroundings, you will need to re-rate them. This is where a formal risk model is crucial. You volition demand to determine in advance how many risk levels you lot volition take, what variables your gamble formula will include, and which criteria yous will employ to categorize vulnerabilities at each level.

For example, when one organization used this methodology, they started with 826 findings, narrowed those downwards to 321 that needed to exist qualified, eliminated 73 every bit faux positives, and after qualification and re-rating, they were left with 68 findings to address. Imagine if they had started out by trying to rate and clarify all 826 findings!

Exceptions

There are ever going to be vulnerabilities that either don't have a set (patch or workaround), or for which the ready will crave a long-term plan to accost and test the solution. Then how do you handle and rail these so that they don't go lost? To bargain with these scenarios, you can implement the existing Security Policy Exception/Risk Acceptance Process we reviewed in Chapter 8. This volition help you to fully appraise the risk of operating in the current state, consider any mitigating controls that may reduce your take chances and become senior management to sign-off on information technology. Further, this process should likewise include a tracking mechanism so that you can set an expiration appointment for the acceptance and make certain that the solution is being worked on. Near findings from the TVM plan will probable take a clear remediation action, such equally a configuration change or patch, but you need to be prepared for the ones that can't be stock-still, either because a solution hasn't been released by the vendor or because the nonsecure configuration is required for some business organisation purpose.

Read total chapter

URL:

https://www.sciencedirect.com/science/commodity/pii/B9781597496155000116