The OCTAVE Method
- 1. Raul Calzada Operationally Critical Threat, Asset and Vulnerability Evaluation Raul Calzada Digitally signed by Raul Calzada DN: cn=Raul Calzada, o, ou, email=raul@skerett.com, c=US Date: 2007.07.29 19:21:26 -04'00'
- 2. About Octave: Implementation Guide Base on catalogs of Information Sponsored by U.S. Department of Defense as technical information. Software Engineering Institute Federally funded by DOD. Carnegie Mellon University
- 3. Risk-based strategic assessment and planning technique for security. Self directed. Organization assume responsibility. Targeted at organizational risk and strategic related issues. Business and IT work together to address the needs of the organization.
- 4. To examine organizational and technology issues to compile an understandable view of the information security needs of the organization. Implemented by using a three-phase approach. Workshop base approach by analysis team. (Continue)
- 5. Phase 1 Build Asset-Base Threat Profiles Key areas of the organization are examined to identify assets Identify current protection strategies Discover vulnerabilities in the organization Phase 2 Identify Infrastructure Vulnerabilities Technology Access method
- 6. Phase 3 Develop Security Strategy and Plans Risk analysis Evaluation base on organization’s mission 1 2 3
- 7. Important Aspects of the OCTAVE Method Self-Direction Small team analyze all information. Personnel is actively involve in the decision-making process. Analysis Team Three to five people, depending on size of overall organization. Knowledge elicitation workshops of Phase 1 Gather supporting data as necessary Develop protection strategy for the organization Address plans to mitigate the risk to critical assets Workshop-Base Approach
- 8. Preparation Getting Senior Management Sponsorship Requires Briefings to help understand. Selecting the Team Sponsorship involvement. Business and IT. Right Scope of Implementation Select operational areas to participate. Participant Selection The analysis team will lead participants selection. Coordinate logistics. Brief all participants prior to their participation.
- 9. EVALUATION PROCESS Organization Levels Senior Management Operational area management Staff (including IT staff) •Important assets and their relative value •Perceived threats to the assets •Security requirements •Current protection strategy practices •Current organizational vulnerabilities Knowledge elicitationSurvey
- 10. EVALUATION PROCESS (continue) Each Organizational Levels: SurveySurvey Identify assets and relative priorities Identify areas of concern. Construct scenarios. Identify security requirements for assets. Capture knowledge of protection strategies and organizational vulnerabilities.
- 11. Analysis Team (Phase 1) Creates Threat Profiles Group results by organizational level. Select critical assets Describe security requirements Identify threats to critical assets
- 12. Analysis Team (Phase 2) Identify Infrastructure Vulnerabilities Design vulnerability (provide documentation) Implementation Configuration Technology vulnerability Reviewing firewall configuration Checking the security on public Web server (overload) Perform a comprehensive review on all operating systems
- 13. Technology vulnerability Identifying services running and/or available on host and systems Listing all system user accounts Identifying known vulnerabilities in routers, switches, RAS, OS and specifics services and applications Identifying configuration errors Looking for existing signs of intrusion (Trojan horses, backdoor programs, spyspy--ware,ware, integrity checks of critical system files, etc. Checking file ownership and permissions Testing password usage strength (continue)
- 14. Analysis Team (Phase 2) Identify Key Components The analysis team and IT staff determine which system is most closely related to each important asset. Identify network access paths to critical systems. Evaluate selected components Software tools (scanning) (network mapping) Test from outside, inside and individual systems Create summary of results
- 15. Analysis Team (Phase 3) Develop Security Strategy Plans Conduct Risk Analysis Identify impact of threats to critical assets Disclosure Modification Lost Destruction Interruption Create a qualitative scale High, Medium, Low
- 16. Analysis Team (Phase 3) Develop Protection Strategy Workshop / Session 1 Consolidate protection strategy Create protection strategy / Address vulnerabilities Create mitigation plans “ to reduce risk “ Workshop / Session 2 Presentation to senior management Review and refine protection strategy How to support ongoing security improvements
- 19. 1. > 300 employees or highly complex 2. Requires access to security expertise – best if on team 3. Org. and IT knowledge extracted via workshops 4. IT environment operated ‘in-house’ Comparing OCTAVE and OCTAVE-S 1. < 100 employees 2. Requires minimal security expertise 3. Analysis team has nearly complete org. and IT knowledge. 4. IT environment simple or outsourced 5. Uses ‘fill in the blank’ forms OCTAVEOCTAVE--SS OCTAVEOCTAVE
- 21. • OCTAVE Method Implementation Guide www.cert.org/octave/omig.pdf Reference: