Reports Reports.Informationweek.Com January 2013 $99 How to Conduct an Effective IT Security Risk Assessment

Next reports Reports.InformationWeek.com January 2013 $99 How to Conduct an Effective IT Security Risk Assessment Assessing an organization’s security risk is an important element of an effective enterprise security strategy. It’s also a key way to justify future security spending to upper management. In this Dark Reading report, we recommend how to conduct an IT security risk assessment — and how to translate the results into terms that make sense in dollars. By Brad Causey Presented in conjunction with Report ID: S6450113 Previous Next reports How To Conduct An Effective IT Security Risk Assessment S 3 Author’s Bio ABOUT US 4 Executive Summary 5 Conducting An Effective IT Security Risk InformationWeek Reports’ analysts arm Assessment business technology decision-makers 5 Figure 1: Threat Matrix with real-world perspective based on 6 1. Identify Assets qualitative and quantitative research, 6 Figure 2: Components of Risk Management business and technology assessment 7 2. Identify Threats and planning tools, and adoption best 8 3. Identify Vulnerabilities practices gleaned from experience. To 8 Figure 3: Analysis of Malicious or Criminal contact us, write to managing director Attacks in 2011 Art Wittmann at [email protected], 9 4. Develop Metrics content director Lorna Garey at 9 Figure 4: New Threat Flow Model [email protected] and 10 5. Consider Historical Breach Data research managing editor Heather Vallis at 10 6. Calculate Cost [email protected]. Find all of our reports NTENT 11 7. Perform Fluid Risk-To-Asset Tracking at reports.informationweek.com. 12 Related Reports TABLE OF CO reports.informationweek.com January 2013 2 Previous Next Table of Contents reports How To Conduct An Effective IT Security Risk Assessment Brad Causey is an active member of the security and forensics community worldwide. Brad focuses his time on Web application security as it applies to global and enterprise arenas. He is a member of the OWASP Global Projects Committee and president of the International Information Systems Forensics Association chapter in Alabama. Brad is an avid author and writer, with hundreds of publications and several books to his name. Brad also holds dozens of industry- recognized certificates, including CISSP, MCSE, C|EH, CIFI and CGSP. Want More? Never Miss a Report! Follow Follow reports.informationweek.com © 2013 InformationWeek, Reproduction Prohibited January 2013 3 Previous Next Table of Contents reports How To Conduct An Effective IT Security Risk Assessment Assessing an organization’s security risk is a key element of an effective enterprise security strategy. Such assessments can mitigate the impact of a security breach or, more to the point, prevent such a breach from happening in the first place. Done well and used correctly, an IT security assessment can also be an invaluable tool for justifying future security spending. The CEO and other business executives may not understand the technical underpinnings of vulnerabilities, hacks and the security tools used to keep organizations safe, but they will understand the dollars and cents involved when systems, networks and data are compromised. In this special report, Dark Reading offers an in-depth look at the risk assessment process, the potential means and practices for conducting an audit, and the strengths and pitfalls surrounding a security risk assessment. We also offer some insight into how to measure and convey risk parameters so that they can be understood and used by upper management. EXECUTIVE SUMMARY reports.informationweek.com January 2013 4 Previous Next Table of Contents reports How To Conduct An Effective IT Security Risk Assessment Conducting An Effective IT Security Risk Assessment Many security and compliance projects be- forming a risk assessment is a very small part ring, eliminating or accepting it. gin with a simple idea: assess the organization’s of the overall risk management process. The presence of these three high-level risk of vulnerabilities and breaches. Indeed, There are basically three risk management processes is constant in all risk assessment implementing an IT security risk assessment is components: methodologies, although what they are called absolutely critical to the overall security 1. Evaluation and assessment, to identify assets may vary. Our primary focus in this report is to posture of your organization. An effective and evaluate their properties and characteristics. discuss the assessment itself, but we will also security risk assessment can prevent breaches, 2. Risk assessment, to discover threats and touch on key elements of risk evaluation and reduce the impact of realized breaches and vulnerabilities that pose risk to assets. assessment, as well as risk mitigation. keep your company’s name from appearing in 3. Risk mitigation, to address risk by transfer- Traditional risk assessment includes general the spotlight for all the wrong reasons. Regular Figure 1 IT security risk assessments also enable organ- Threat Matrix izations to build up a cache of historical data Breaking down complicated assessment data into simple formulas can help quanitfy potential risk and the resources needed to mitigate that risk. that can be used to effectively gauge and com- municate monetary impact related to risks — and, hopefully, convince upper management to take decisive action to reduce the organization’s threat surface. It’s important to note that not every IT security risk assessment is alike — or even re- motely close. Indeed, there are many ways to perform IT security risk assessments, and the results may vary widely depending on the method used. It should also be noted that per- Source: InformationWeek Reports S6450113/1 reports.informationweek.com January 2013 5 S Previous Next Table of Contents reports How To Conduct An Effective IT Security Risk Assessment IT-related issues such as accidental outages, Figure 2 lations or internal policy. The problem with this hardware failures and uptime. Security risk Risk Management Triad is that the threat landscape is always chang- assessment, on the other hand, is just what it A risk management strategy must include three key ing. New vulnerabilities and exploits are re- elements. sounds like — analysis of the issues relating leased daily, and a single review of a system’s directly to security threats. However, many threat profile every few years might not be organizations lump these two types of assess- sufficient to keep that system and its data pro- ments together, applying more generic risk tected. models in the more dynamic world of IT This is probably the most common prob- security. That’s a problem. lem seen in the risk world, and it only high- In many cases, the data compiled about a lights the need for a continuous risk assess- given asset and its risk is created with great ment life cycle. care, but is not updated in a timeframe that Data classification is one of the most critical, would enable security pros to address the and difficult-to-implement, steps in the asset changing threat landscape. This leads to identification and classification process. The Band-Aid-style fixes such as hard reassess- most common mistake that companies make ment intervals every one or two years. Ulti- is that they try to push classification from mately, this will leave gaps in security for Source: InformationWeek Reports S6450113/2 upper management or IT security groups into months at a time. the business units. You can avoid this by Following are the steps required to perform point, you can identify the threat and its pos- creating a data classification program that pro- an effective IT security risk assessment. sible impact, as well as develop a mitigation vides structure and guidance, but places the plan. Unfortunately, this process usually occurs classification in the hands of the data owners. 1. Identify Assets atS only two distinct points in time during the They are the closest to the data and will likely Most IT security models have between five system life cycle: first, as the system is have the most insight into the impact a com- and 10 steps, but they all start with the same deployed in the organization, and, second, dur- promise to that data would have on the overall one: identify the asset or system. From that ing a predetermined interval based on regu- security posture of the organization. reports.informationweek.com January 2013 6 Previous Next Table of Contents reports How To Conduct An Effective IT Security Risk Assessment Data classification is just one aspect of the that details an asset’s threat portfolio (in- asset for which you are building your profile. overall asset classification, however. You will cluding the classification of the data therein), need to have a reasonable understanding of you can create an asset “value.” This value is 2. Identify Threats the technologies that a given asset would used in combination with threat and vulner- The next crucial step is to use the data utilize and what possible vulnerabilities exist ability information to establish an overall risk discovered during your asset profile creation for those technologies. rating. to determine what threats may exist for any Take a basic Web application, for example. An easy way to do this is to use a 1-to-100- given system. Here, it’s important to under- Most enterprise Web applications are built point scale based on data classification. This stand how the notions of “threat” and “vulner- on a framework such as Ruby on Rails or scale will allow you to quickly determine an ability” connect. A threat (specifically in the IT Microsoft Silverlight. These frameworks asset’s importance as it relates to risk. (To security world) is the potential for an attacker Six Steps To A Risk-Based should be part of the asset’s risk profile. Since make things less complicated, you can to take advantage of a given vulnerability.

Load more