Contents

PREFACE

ABOUT THE AUTHORS

PART I

CHAPTER 1 INFORMATION SECURITY RISK MANAGEMENT IMPERATIVES AND OPPORTUNITIES

1.1 RISK MANAGEMENT PURPOSE AND SCOPE

REFERENCES

APPENDIX 1A: BIBLIOGRAPHY OF RELATED LITERATURE

CHAPTER 2 INFORMATION SECURITY RISK MANAGEMENT DEFINED

2.1 KEY RISK MANAGEMENT DEFINITIONS

2.2 A MATHEMATICAL FORMULATION OF RISK

2.3 TYPICAL THREATS/RISK EVENTS

2.4 WHAT IS AN ENTERPRISE ARCHITECTURE?

REFERENCES

APPENDIX 2A: THE CISSPFORUM/ISO27K IMPLEMENTERS FORUM INFORMATION SECURITY RISK LIST FOR 2008

APPENDIX 2B: WHAT IS ENTERPRISE RISK MANAGEMENT (ERM)?

CHAPTER 3 INFORMATION SECURITY RISK MANAGEMENT STANDARDS

3.1 ISO/IEC 13335

3.2 ISO/IEC 17799 (ISO/IEC 27002:2005)

3.3 ISO/IEC 27000 SERIES

3.4 ISO/IEC 31000

3.5 NIST STANDARDS

3.6 AS/NZS 4360

REFERENCES

APPENDIX 3A: ORGANIZATION FOR ECONOMIC COOPERATION AND DEVELOPMENT (OECD) GUIDELINES FOR THE SECURITY OF INFORMATION SYSTEMS AND NETWORKS: TOWARD A CULTURE OF SECURITY

CHAPTER 4 A SURVEY OF AVAILABLE INFORMATION SECURITY RISK MANAGEMENT METHODS AND TOOLS

4.1 OVERVIEW

4.2 RISK MANAGEMENT/RISK ANALYSIS METHODS

REFERENCES

CHAPTER 5 METHODOLOGIES EXAMPLES: COBIT AND OCTAVE

5.1 OVERVIEW

5.2 COBIT26

5.3 OCTAVE

REFERENCES

PART II

CHAPTER 6 RISK MANAGEMENT ISSUES AND ORGANIZATION SPECIFICS

6.1 PURPOSE AND SCOPE

6.2 RISK MANAGEMENT POLICIES

6.3 A SNAPSHOT OF RISK MANAGEMENT IN THE CORPORATE WORLD

6.4 OVERVIEW OF PRAGMATIC RISK MANAGEMENT PROCESS

6.5 ROADMAP TO PRAGMATIC RISK MANAGEMENT

REFERENCES

APPENDIX 6A: EXAMPLE OF A SECURITY POLICY

CHAPTER 7 ASSESSING ORGANIZATION AND ESTABLISHING RISK MANAGEMENT SCOPE

7.1 ASSESSING THE CURRENT ENTERPRISE ENVIRONMENT

7.2 SOLICITING SUPPORT FROM SENIOR MANAGEMENT

7.3 ESTABLISHING RISK MANAGEMENT SCOPE AND BOUNDARIES

7.4 DEFINING ACCEPTABLE RISK FOR ENTERPRISE

7.5 RISK MANAGEMENT COMMITTEE

7.6 ORGANIZATION-SPECIFIC RISK METHODOLOGY

7.7 RISK WAIVERS PROGRAMS

REFERENCES

APPENDIX 7A: SUMMARY OF APPLICABLE LEGISLATION

CHAPTER 8 IDENTIFYING RESOURCES AND IMPLEMENTING THE RISK MANAGEMENT TEAM

8.1 OPERATING COSTS TO SUPPORT RISK MANAGEMENT AND STAFFING REQUIREMENTS

8.2 ORGANIZATIONAL MODELS

8.3 STAFFING REQUIREMENTS

8.4 RISK MANAGEMENT TOOLS

8.5 RISK MANAGEMENT SERVICES

8.6 DEVELOPING AND IMPLEMENTING THE RISK MANAGEMENT/ASSESSMENT TEAM

REFERENCES

APPENDIX 8A: SIZING EXAMPLE FOR RISK MANAGEMENT TEAM

APPENDIX 8B: EXAMPLE OF VULNERABILITY ALERTS BY VENDORS AND CERT

APPENDIX 8C: EXAMPLES OF DATA LOSSES—A ONE-MONTH SNAPSHOT

CHAPTER 9 IDENTIFYING ASSETS AND ORGANIZATION RISK EXPOSURES

9.1 IMPORTANCE OF ASSET IDENTIFICATION AND MANAGEMENT

9.2 ENTERPRISE ARCHITECTURE

9.3 IDENTIFYING IT ASSETS

9.4 ASSIGNING VALUE TO IT ASSETS

9.5 VULNERABILITY IDENTIFICATION/CLASSIFICATION

9.6 THREAT ANALYSIS: TYPE OF RISK EXPOSURES

9.7 SUMMARY

REFERENCES

APPENDIX 9A: COMMON INFORMATION SYSTEMS ASSETS

CHAPTER 10 REMEDIATION PLANNING AND COMPLIANCE REPORTING

10.1 DETERMINING RISK VALUE

10.2 REMEDIATION APPROACHES

10.3 PRIORITIZING REMEDIATIONS

10.4 DETERMINING MITIGATING TIMEFRAMES

10.5 COMPLIANCE MONITORING AND SECURITY METRICS

10.6 COMPLIANCE REPORTING

REFERENCES

BASIC GLOSSARY OF TERMS USED IN THIS TEXT

INDEX

Copyright © 2010 by John Wiley & Sons, Inc. All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750–8400, fax (978) 750–4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748–6011, fax (201) 748–6008, or online at http://www.wiley.com/go/permission.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages.

For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762–2974, outside the United States at (317) 572–3993 or fax (317) 572–4002.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit our web site at www.wiley.com.

ISBN 978-0-471-76254-6

Library of Congress Cataloging-in-Publication Data is available.

Jake:

I would like to dedicate this book to all of the volunteers that have supported the Open Security Foundation. To my friends and colleagues over the years. To my parents, Barry and Roxanne, for their continued support and to Jill and Elora for their unending love and patience.

Dan:

For Anna

PREFACE

Well-documented studies show that cyber attacks continue to remain a substantial threat to organizations of all types and their information technology (IT) assets. It has been forecasted that in 2010 around 10,000 new vulnerabilities will be discovered in software applications in that year alone; this will force companies to assess and mitigate one new risk every hour each day of the year. Considering that each vulnerability instance has the potential to disrupt or bring a company’s business to a complete halt, organizations must take risk assessment seriously and determine how each risk will be handled. The increased number of vulnerabilities being discovered also drives up the number of security incidents worldwide, and it will increase to a point where hundreds, if not thousands, of incidents per month will affect organizations that have not properly addressed and mitigated their risks.

Risk is a quantitative evaluation of the potential damage caused by an attack, a vulnerability, or an event impacting the set of company IT assets. A vulnerability (or weakness) is a lack of a safeguard, which may be exploited by a threat, causing harm to the information systems; specifically it can be a software flaw that permits an exogenous agent to use a computer system without authorization or use it with authorization in excess of that which the system owner specifically granted said agent. Risk-generating events and vulnerabilities are implicitly related in the context of this discussion in the sense that (we postulate that) a vulnerability is ultimately caused by some subtending event, malicious or nonmalicious. For example, in a so-called ‘‘non- malicious event,’’ a flaw may be introduced in some software release by its designers, and then the event of having the IT group load and distribute that software throughout the enterprise creates a predicament where risk ensues. A ‘‘malicious’’ event may be a direct attack on the organization firewall, router, website, or database platform.

Corporate information security has become the fiduciary concern of the CEO, the CSO, the CFO, the CIO, and the COO of the organization. If a company were to lose its IT (computer and/or voice/data networking) resources (assets) for more than a day or two, the company may well find itself in financial trouble. Obviously brokerage firms, banks, airports, critical infrastructure, medical establishments, and homeland security concerns would be impacted faster than, say, a manufacturing firm or a book publishing firm. However, the general concern is universal. If a company is unable to conduct business for more than a week, the company may well be permanently incapacitated. Therefore, a clear need arises to protect the enterprise from random, negligent, malicious, or planned attacks on its IT assets. It is critical, therefore, for companies to develop ready-to-go technological and human resources within the organization, to handle vulnerabilities and events that likely will impact the organization in the years to come. Some have called these teams risk management or risk assessment teams. The job function of a risk management team is to assess the risk that ensues from vulnerabilities and/or from risk-generating/causing events and to identify and ensure that risk mitigation solutions are implemented.

As more and more companies send their IT business abroad because of “outsourcing” or near-shoring, the potential IT (and, hence, corporate) risks are arguably growing at a geometric pace; these risks can have ultimate negative implications, particularly in view of cumulative exposures to risks that, in the aggregate, do not take on a trivial probability and, thus, risk.

This book aims at surveying industry approaches, best practices, and standards for how an organization can position itself to properly handle this ever-increasing and perennially mutating tsunami of risks to their business- critical IT assets. The book has two major sections. Part 1 reviews industry practices in the area of risk assessment and mitigation. The aim is to provide an overview of the well-known risk management approaches and methodologies. Part 2 focuses on helping an organization to develop a repeatable program that will address technological issues and human resources within the organization, to effectively undertake the risk assessment and mitigation function. It looks at the best use of IT resources, procedures, tools, and preparedness, and it places emphasis on implementing a risk assessment team that can properly foresee, prevent, and/or rapidly remediate potential infractions. This text is intended to be used by information security managers, security analysts, systems developers, auditors, consultants, and students, among others.

Jake Kouns

Daniel Minoli

ABOUT THE AUTHORS

Jake Kouns is a business-focused technology and information security executive with an extensive knowledge base and international experience. He focuses on the application of security concepts across a broad range on information technology areas including data communications, network design, operations, database structures, operating systems, application development, and disaster recovery. He holds both a Bachelor of Business Administration and a Master of Business Administration with a concentration in Information Security from James Madison University. In addition, he holds a number of certifications including ISC2’s CISSP and ISACA’s CISM, CISA, and CGEIT. Mr. Kouns is currently the Senior Director of Technology for Markel Corporation, a specialty insurance company. Prior to his current role, he was Senior Network Security Manager for Capital One Financial, a Fortune 200 financial institution where he was responsible for the day-to-day global security management of a large complex firewall environment, intrusion detection, and risk assessment.

Mr. Kouns has twice presented for Check Point Software Technologies as an expert in global firewall management and intrusion detection. In recent years, Mr. Kouns’ main focus has been spent redefining the information security vulnerability industry, and he has presented on the topic at many well-known security conferences including CanSecWest and SyScan. He is the co-author of the book Security in an IPv6 Environment, Taylor and Francis, 2009, and he has also been interviewed as an expert in the security industry by Information Week, eWeek, Processor.com, Federal Computer Week, Government Computer News, and SC Magazine.

Mr. Kouns is the co-founder, CEO, and CFO of the Open Security Foundation (OSF), a nonprofit organization that oversees the operations of the Open Source Vulnerability Database (OSVDB.org) and the DataLossDB. Mr. Kouns’ primary focus is to provide management oversight and define the strategic direction of the projects. Both projects are independent and open source databases that provide detailed and unbiased technical information on security vulnerabilities and data loss incidents worldwide. Mr. Kouns has also has participated in Google’s Summer of Code and volunteered time to mentor students during the 2006, 2007, and 2008 programs.

Daniel Minoli has extensive technical-hands-on and managerial experience in security, networking, telecom, wireless, video, and Enterprise Architecture for global Best-In-Class carriers and financial companies. He has worked at financial firms such as AIG, Prudential Securities, and Capital One Financial and at service provider firms such as Network Analysis Corporation, Bell Telephone Laboratories, ITT, Bell Communications Research (now Telcordia), AT&T, Leading Edge Networks Inc., and SES Engineering, where he is Director of Terrestrial Systems Engineering (SES is the largest satellite services company in the world).

At SES Mr. Minoli has been responsible for the development and deployment of IPTV systems, terrestrial and mobile IP-based networking services, and IPv6 services over satellite links. He also played a founding role in the launching of two companies through the high-tech incubator Leading Edge Networks Inc., which he ran in the early 2000s: Global Wireless Services, a provider of secure broadband hotspot mobile Internet and hotspot VoIP services; and, InfoPort Communications Group, an optical and Gigabit Ethernet metropolitan carrier supporting Data Center/SAN/channel extension and Grid Computing network access services. He is also the Founder and President Emeritus of the IPv6 Institute, the premiere leading certification organization for IPv6 networking technology, IPv6 global network deployment, and IPv6 security (www.ipv6institute.org). For several years he has been Session, Tutorial, and now overall Technical Program Chair for the IEEE ENTNET (Enterprise Networking) conference. ENTNET focuses on enterprise networking requirements for large financial firms and other corporate institutions.

Mr. Minoli has done important work in security, including leading-edge work such as security in an IPv6 environment (results documented in the first text on the topic of Security in an IPv6 Environment, Taylor and Francis, 2009, co-authored), security for IPTV systems, particularly encryption and Conditional Access (approaches documented in his text IP Multicast with Applications to IPTV and Mobile DVB-H, Wiley, 2008), and basic security work as documented in the Minoli-Cordovana Authoritative Computer and Network Security Dictionary (Wiley, 2006, co-authored).

Mr. Minoli has also written columns for ComputerWorld, NetworkWorld, and Network Computing (1985–2006). He has taught at New York University (Information Technology Institute), Rutgers University, and Stevens Institute of Technology (1984–2006). Also, he was a Technology Analyst At-Large for Gartner/DataPro (1985–2001); based on extensive hands-on work at financial firms and carriers, he tracked technologies and wrote CTO/CIO-level technical scans in the area of telephony and data systems, including topics on security, disaster recovery, network management, LANs, WANs (ATM and MPLS), wireless (LAN and public hotspot), VoIP, network design/economics, carrier networks (such as metro Ethernet and CWDM/DWDM), and e-commerce. Over the years he has advised Venture Capitals for investments of $150M in a dozen high-tech companies. He has acted as Expert Witness in a (won) $11B lawsuit regarding a VoIP-based wireless Air-to-Ground communication system, and he has been involved as a technical expert in a number of patent infringement proceedings.

PART I

INDUSTRY PRACTICES IN RISK MANAGEMENT

CHAPTER 1

INFORMATION SECURITY RISK MANAGEMENT IMPERATIVES AND OPPORTUNITIES

1.1 RISK MANAGEMENT PURPOSE AND SCOPE

1.1.1 Purpose of Risk Management

This text deals with information technology (IT) risk management (ITRM), which, given the context of this text, we also just refer to as risk management.¹ Concerns about the possibility of compromise and/or the loss of proprietary information have reached critical levels in many organizations in recent years as a barrage of news bulletins reporting on infractions and product defects, staffs shortfalls and shortcomings, functions’ outsourcings and offshorings, political instabilities in a number of countries and in wider regions, and management’s emphasis on short-term financial breakeven has become all too frequent. Cyber attacks continue to be a source of significant exposure to organizations of all types, and, as a consequence, potential damage, potential impairment, and/or potential incapacitation of IT assets have become fundamental business viability/continuity issues.

Information Security² is recognized at this juncture to be a key area of IT management by a majority of government, commercial, and industrial organizations. Information Security is defined as the set of mechanisms, techniques, measures, and administrative processes employed to protect IT assets from unauthorized access, (mis)appropriation, manipulation, modification, loss, or (mis)use and from unintentional disclosure of data and information embedded in these assets. Some organizations have individuals on staff with a plethora of security certifications, yet these organizations continue to be afflicted with security breaches on a fairly routine basis and continue to be exposed to risk; this implies that perhaps other approaches to information security are needed. Practitioners of information security are all well aware that exposure to risk is ever-changing and that it is also hard to assess; therefore, what is needed to manage and minimize risk in organizations is a diversified, versatile, and experienced IT/networking staff along with a solid set of policies, processes, and procedures that create a reliable information security program. This approach is typically much more successful as compared to the case where an organization just attempts to rely on ultra-narrow staffers with cookbooks of perishable memorized software commands specific to a given version of a given program of a given vendor to produce results, where the organization seems to be assuming that the real-life information security issues are similar to an academic pre-canned rapid-fire test for abstract scholastic grades, and simply believes that an alphabet soup of tags following one’s name is sufficient (or necessary) to address incessant IT security threats.

Risk is a quantitative measure of the potential damage caused by a threat, by a vulnerability, or by an event (malicious or nonmalicious) that affects the set of IT assets owned by the organization. Risk exposure (that is, being subjected to risk-generating events) leads to potential losses, and risk is a measure of the “average” (typical) loss that may be expected from that exposure. Risk, therefore, is a quantitative measure of the damage that can incur to a given asset even after (a number of) information security measures have been deployed by the organization. Obviously, when the risk is high, an enhanced set of information security controls, specific to the situation at hand, needs to be deployed fairly rapidly in the IT environment of the organization. See Table 1.1 for some risk- related definitions, loosely modeled after [HUB200701]. The term “information asset” refers here to actual data elements, records, files, software systems (applications), and so on, while the term “IT asset” refers to the broader set of assets including the hardware, the media, the communications elements, and the actual IT environment of the enterprise; the general term “asset,” refers to either “information asset” or “IT asset;” or both, depending on context. Typical corporate IT assets in a commercial enterprise environment include, but are not limited to, the following:

Desktops PCs and laptops

Mobile devices and wireless networks (e.g., PDAs, Wi-Fi/Bluetooth devices)

Application servers, mainframes

Mail servers

Web servers

Database servers (data warehouses, storage) as well as the entire universe of corporate data, records, memos, reports, etc.

Network elements (switches, routers, firewalls, appliances, etc.)

PBXs, IP-PBXs, VRUs, ACDs, voicemail systems, etc.

Mobility (support) systems (Virtual Private Network nodes, wireless e-mail servers, etc.)

TABLE 1.1. Uncertainty, Probability, and Risk

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!