Paradigm Shift! - Customer Information Centric IT Risk Assessments
- 1. Paradigm Shift! Customer Information Centric IT Risk Assessments TM The CICRAM IT Risk Assessment Methodology for GLBA & HIPAA Compliance May 7th 2009 CICRAMTM IT Risk Assessment Methodology 1 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 2. Why Perform IT Risk Assessments? • Management Request • Regulatory Requirement • IT Best Practice CICRAMTM IT Risk Assessment Methodology 2 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 3. What is “RISK”? • First and most obvious, “Risk” is a probability issue. • “Risk” has both a frequency and a magnitude component. • The fundamental nature of “Risk” is universal; regardless of it’s context. An Introduction to Factor Analysis of Information Risk (FAIR) A framework for understanding, analyzing, and measuring information risk Jack A. Jones, CISSP, CISM, CISA “Risk is the association of the probability/frequency of a negative event occurrence, with the projected magnitude of a future loss.” Fernando A. Reiser CISSP, CISM, CISA, CIPP – April 2009 CICRAMTM IT Risk Assessment Methodology 3 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 4. The Basic “IT Risk” Formula Information Security It’s All About Professionals generally IT Risk can agree that: IT Controls mitigate Risk by lowering the Probability of a Threat acting on a Vulnerability to harm an organization’s Asset. CICRAMTM IT Risk Assessment Methodology 4 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 5. Assessing “IT Risk” High Level Goals & Objectives • Assess current threats & vulnerabilities • Identity and assess “Risk Factors” to the Organization • Present information in a way that management can use to make informed business decisions based on risk. Processes • Identify assets – information stores & IT systems. • Quantify the probability of a negative event occurrence. • Determine the value of information & IT assets. • Assess the business impact of negative events. CICRAMTM IT Risk Assessment Methodology 5 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 6. Assessing “IT Risk” It’s a simple concept, but a difficult and complex analytical problem to solve. Most IT Risk Assessment Methodologies Attempt to Determine the Threats, Vulnerabilities, Negative Event Likelihood and Information Security Impacts to Specific IT Assets. CICRAMTM IT Risk Assessment Methodology 6 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 7. What IT Risk Assessment Methodology Should I Use? Quantitative Risk Analysis- Two basic elements are assessed: the probability of a negative event – “ARO” (annual rate of occurrence) and the likely financial loss – the “SLE” (single loss expectancy). The Annual Loss is then calculated – “ALE”. Qualitative Risk Analysis This is by far the most widely used approach to risk analysis. Probability data is not required and only the estimated financial loss is used. CICRAMTM IT Risk Assessment Methodology 7 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 8. What IT Risk Assessment Methodology Should I Use? “Published” IT Risk Assessment Methodologies Quantitative Methodologies: CRAMM BITS (Kalculator) FAIR FMEA Qualitative Methodologies: FRAP COBRA OCTAVE CICRAMTM IT Risk Assessment Methodology 8 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 9. Assessing IT Risk: “The Problem in the security world is we often lack the data to do risk management well. Technological risks are complicated and subtle.” “We don’t know how well our network security will keep the bad guys out, and we don’t know the cost to the company if we don’t keep them out.” Does risk management make sense? Bruce Schneier – Oct 2008 CICRAMTM IT Risk Assessment Methodology 9 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 10. In Addition, Traditional IT Risk Assessments Methodologies Do Not Assess IT Risks To Customer Information • Storage • Transmission • Access & Processing I Stipulate That The IT Security Profession Has A Dirty Little Secret ... CICRAMTM IT Risk Assessment Methodology 10 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 11. Randy Pausch Said In His Now Famous “Last Lecture” … “When There Is An Elephant In The Room Introduce Him” Randy Pausch Graphic – www.thelastlecture.com “Most IT Security Professionals Can Not Accurately Assess IT Risks.” Fernando A. Reiser CISSP, CISM, CISA, CIPP – April 2009 CICRAMTM IT Risk Assessment Methodology 11 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 12. In fact, many Information Security professionals cannot even agree on a definition of IT Risk! “Ask a dozen information security professionals to define risk and you’re certain to get several different answers.“ An Introduction to Factor Analysis of Information Risk (FAIR) Jack A. Jones, CISSP, CISM, CISA “Technically speaking, risk is the probability of a threat agent exploiting a vulnerability and the resulting business impact.” Understanding Risk Shon Harris CISSP - 2006 If security professional cannot agree on what are the risks, how can we accurately assess “IT Risks”? CICRAMTM IT Risk Assessment Methodology 12 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 13. What Are Leading Information Security Professionals Saying About Current IT Risk Assessment Processes & Models? Number-driven risk metrics 'fundamentally broken‘ Gamit Yoran, former National Cyber Security Divison director Why Johnny Can’t Evaluate Security Risk George Cybenko, Editor in Chief Taking the risk out of IT risk management Jim Hietala – October 16, 2008 Why you shouldn’t wager the house on risk management models Bruce Schneier and Marcus Ranum – Oct 2008 It’s time to think differently about protecting data Bill Ledingham – September 10, 2008 CICRAMTM IT Risk Assessment Methodology 13 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 14. There Is A Problem With Many IT Risk Assessment Process. Traditional IT Risk Assessment Methodologies are Primarily Focused on the Risks and Impacts to the Organization that is Being Assessed. The Impact to the Confidentiality or Integrity of Customers and Employee Information is Graphic - Microsoft not Assessed! CICRAMTM IT Risk Assessment Methodology 14 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 15. Why Are Risks to Customer Information Important? • Regulatory Requirements Financial Industry – GLBA Health Care – HIPAA Higher Education – FERPA State Data Breach • Organizational Reputation Graphic - Microsoft • Industry Standards Retail - PCI CICRAMTM IT Risk Assessment Methodology 15 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 16. TM The CICRAM IT Risk Assessment Methodology for GLBA & HIPAA Compliance A Paradigm Shift In IT Risk Assessment Methodologies! Assess Risks To Customer & Employee Information, Rather Than Operational IT Risks To The Organization. CICRAMTM IT Risk Assessment Methodology 16 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 17. TM CICRAM IT Risk Assessment Methodology Core Concepts: A Simplified View of IT Risks Threat Vulnerability Asset Value X X Risk = __________ Countermeasures An IT Risk is defined within CICRAMTM, as the likelihood of a Threat acting on a Vulnerability to harm an asset which causes a negative impact. CICRAMTM IT Risk Assessment Methodology 17 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 18. TM CICRAM IT Risk Assessment Methodology Core Concepts: • There are an infinite number of “Latent” vulnerabilities in software systems that allow attackers to breach computer systems. • There is a sufficiently high number of “Threats”, that given enough time, the likelihood of a vulnerability being exploited is 100%. • “Customer Information” has an inherently high value. • Assess “Risks” by following the movement of Customer Information. • Assess the effects of an IT control failure. The “Worst Case Scenario” becomes the “Baseline” for the IT Risk Assessment. • Effective IT controls reduce risks • IT Risks are almost never reduced to zero by the implementation of IT controls, there is usually some “Residual Risk”. CICRAMTM IT Risk Assessment Methodology 18 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 19. TM CICRAM IT Risk Assessment Methodology Core Concepts: There are a only a few actions that can be performed with an Organization’s Customer Information: INFORMATION ACTION SECURITY RISK FACTOR View / Access / Use Confidentiality Copy Confidentiality Modify Integrity Loss Confidentiality Delete / Destroy Integrity and Availability CICRAMTM IT Risk Assessment Methodology 19 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 20. TM CICRAM IT Risk Assessment Methodology “A Hybrid IT Risk Assessment Process” • Use Qualitative Analysis methods to determine current IT “Threats”. • Utilize “Data Flow” concepts to analyze risks to Customer Information as it moves across various environments. • Use Interogative & RIIOT methods to document the IT environment used to transmit, manipulate and store customer data. • Use Qualitative Analysis methods to develop a “Baseline” of IT Risks for an IT environment that does not have any IT controls. • Use Control Maturity Modeling and Quantitative Analysis – methods to assess the effectiveness of current IT controls. • Use Quantitative Analysis methods to determine the risk reduction impact of current IT controls. CICRAMTM IT Risk Assessment Methodology 20 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 21. TM CICRAM IT Risk Assessment Step#1 – Assess The Current IT Threat Environment Attack Motivational Factors External Threats i. Criminal Cyber Gangs ii. Former Employees iii. Consultants & Contractors iv. Casual Hackers & Script Kidde Insider threats i. Malicious Insiders: Corporate Spies & Disgruntled Employees ii. Careless Staff: Policy Breakers and the Uninformed Technical Attacks Malware Applications i. Viruses, Worms, Trojans ii. Spyware iii. Adware Botnets DNS Denial of Service Human Attacks Social Engineering Identity Theft Email Spam CICRAMTM IT Risk Assessment Methodology 21 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 22. TM CICRAM IT Risk Assessment Step#2 – Determine Where Customer Information Is Located Data Flow Regions IT Risks Business Partners Infrastructure Application Systems CICRAMTM IT Risk Assessment Methodology 22 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 23. TM CICRAM IT Risk Assessment Step#3 – Document The IT Operational Environment: IT Systems & Applications Use IT auditing tools and methods like questionnaires, interviews and diagrams to document the IT systems and applications. CICRAMTM IT Risk Assessment Methodology 23 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 24. TM CICRAM IT Risk Assessment Step#4 - Select an Information Security Controls Framework • Each “Standard” may contain ISO 17799 FFIEC & FTC Security Standards for similar information security controls. Program safeguarding customer • Resolve circular references and information overlapping IT controls across the multiple frameworks. + • Use hierarchical clustering to group IT Controls into categories. COBIT NIST SP 800 Use current Your SANS & ITGI PCI information from: Organization’s SANS Institute, Controls Controls Analysts, = IT Security Industry Best Control Practices Framework CICRAMTM IT Risk Assessment Methodology 24 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 25. TM CICRAM IT Risk Assessment Step#5: Select Key IT Risk Assessment Factors IT Risk Assessment “Factors”: Customer Information Security (Confidentiality) Improper/Incorrect Transaction Data (Integrity) Infrastructure Stability/Change Control (Availability) Customer Confidence / Stewardship (Reputation) Regulatory Compliance (Legal) Fraud / Data Breach (Financial Loss) CICRAMTM IT Risk Assessment Methodology 25 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 26. TM CICRAM IT Risk Assessment Step#6: Determine an IT Risks Numerical Rating Scale NUMERICAL IT RISK RATING DEFINITIONS Level 0 - Functional control area is not relevant Color Range Risk Level 1 - Functional control area poses an insignificant risk: White 0 N/A the significance of a control failure is low or not relevant Level 2 - Functional control area poses a minimal risk potential: Green 1-2 Low the significance of a control failure is minor Level 3 - Functional control area poses a moderate risk potential: Yellow 3-4 Medium the significance of a control failure is considerable Level 4 - Functional control area poses an elevated risk potential: Red 5 High the significance of a control failure is extensive Level 5 - Functional control area poses a significant risk potential: the implications of a control failure is severe CICRAMTM IT Risk Assessment Methodology 26 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 27. TM CICRAM IT Risk Assessment Step #7: Assess “Baseline” High Level Risks Use Control Matrix and Apply Threat Analysis to Develop a Heat Map of Baseline IT Risks Heat Map of Baseline IT Risks External Network Security - Perimeter Defense Systems 5 4 4 3 5 3 Internal Network Security - Back Information Office User Authentication Systems 4 4 3 3 5 4 Security Technical Virus and Malware Protection 4 4 4 4 3 4 Controls Backup / Recovery 2 0 5 2 5 3 Monitoring and Logging 3 3 2 2 2 1 CICRAMTM IT Risk Assessment Methodology 27 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 28. TM CICRAM IT Risk Assessment Step#8: Determine an IT Control Numerical Rating Scale IT CONTROL MATURITY RATING Stage 0 – Nonexistent Information Security Stage 1 - Initial/Ad Hoc Control Maturity Model- CMM Ratings are Stage 2 - Repeatable but Intuitive Based on Carnegie Stage 3 - Defined Process Mellon’s Process Improvement Model Stage 4 - Managed and Measurable Ratings Scale – CMMI. Stage 5 - Optimized www.sei.cmu.edu/cmmi/general/index.html CICRAMTM IT Risk Assessment Methodology 28 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 29. TM CICRAM IT Risk Assessment Step #9: Assess IT Control Effectiveness GAP Exists Control PROCESS FUNCTION HIGH LEVEL OBJECTIVE Control Objectives Ref # Comments Maturity Where network connectivity is used, IT.B.3.1 appropriate controls, including firewalls, Deployment of DMZ intrusion detection and vulnerability assessments, exist and are used to prevent unauthorized access. Where network connectivity is used, IT.B.3.1 appropriate controls, including firewalls, External Deployment of Network intrusion detection and vulnerability Network FIREWALL assessments, exist and are used to prevent Security - unauthorized access. Perimeter Impl. Where network connectivity is used, IT.B.3.1 Defense appropriate controls, including firewalls, Systems Deployment of Network intrusion detection and vulnerability IDS/IPS assessments, exist and are used to prevent unauthorized access. Where network connectivity is used, IT.B.3.1 appropriate controls, including firewalls, Deployment of Wireless intrusion detection and vulnerability Encryption - Authentication assessments, exist and are used to prevent unauthorized access. CICRAMTM IT Risk Assessment Methodology 29 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 30. 9 TM CICRAM IT Risk Assessment Step#10: Adjust Baseline Risks for Control Effectiveness Use Control Effectiveness Ratings to Adjust Baseline IT Risks Heat Map of IT Risks Adjusted for Control Effectiveness External Network Security - Perimeter Defense Systems 3 3 3 2 2 2 Internal Network Security - Back Information Office User Authentication Systems 4 4 3 3 2 3 Security Technical Virus and Malware Protection 4 3 3 3 2 3 Controls Backup / Recovery 1 0 3 3 2 2 Physical Security / Environmental 3 2 3 2 2 1 CICRAMTM IT Risk Assessment Methodology 30 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 31. 9 TM CICRAM IT Risk Assessment Step#11: Generate Narrative IT Risk Report Document Develop a Written Report CICRAMTM IT Risk Assessment Methodology 31 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 32. 9 TM CICRAM IT Risk Assessment Step#12: Present Risk Report and Findings to Management Congratulations, You Get To Do This Again Next Year! CICRAMTM IT Risk Assessment Methodology 32 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved
- 33. TM CICRAM IT Risk Assessment Methodology Paradigm Shift! Customer Information Centric IT Risk Assessments Questions ? Fernando A. Reiser freiser@bankitsecurity.com CICRAMTM IT Risk Assessment Methodology 33 © Copyright 2004-2009 Fernando Reiser, All Rights Reserved