Risk bridges business and security
- 1. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Why is risk the bridge between business & security worlds? I s a i a h M c G o w a n # A T L S e c C o n 2 0 1 7
- 2. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . It’s ‘medium-high’ because it highly effects operations! The risk is ‘high’ because it’s easy to conduct the attack! It’s ‘medium’ because we have compensating controls!
- 3. The Goal of Cybersecurity Symptoms of Failure Treating Root Causes The Way Forward
- 4. The Goal of Cybersecurity
- 5. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . •All business functions dealing with adverse events share our goal: •To cost-effectively manage to an acceptable level of risk. •We are not here to make the business ‘secure’! “The value of information security is our ability to affect exposure to loss.” -Jack Jones, Inventor of FAIR
- 6. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . The Board of Directors Responsible for all opportunities and risks Executive Management Responsible for executing priorities set by the board CISO Responsible for managing cybersecurity risk to an acceptable level Cybersecurity Operations Responsible for executing security initiatives to affect the frequency and/or magnitude of adverse events
- 8. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . •Unicorn syndrom •Failing to address underlying assumptions •Leveraging poor models of the problem space •Expecting the business to speak our language •Mixing cybersecurity jargon with business terms Common symptoms affecting our ability to manage risk:
- 9. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . What’s the risk of this bald tire? •What were your assumptions? •How did you define ‘risk’?
- 10. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . f a i r i n s t i t u t e . o r g / b l o g / f i x i n g - n i s t - 8 0 0 - 3 0 Broken models are broken
- 11. Would you go to the moon if…
- 12. The Risk Register!! It’s out of control!!
- 13. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . A disease resulting in a Denial of Service attack on an organization attempting to prioritize cybersecurity issues. Risk-register-itis /risk/ˈrejəstər/itis noun •Putting any possible issue into a risk register •A signal-to-noise ratio too great to overcome Common conditions include:
- 15. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Risk is the probable frequency & probable magnitude of future loss. erm… How likely will adverse events occur and how unfavorable are they likely to be.
- 16. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Cloud Computing Unexpired passwords Privileged Insiders SQLi Mobile Devices Ransomware Weak VPN encryption Asset Control condition Threat Attack technique Asset Threat Control condition Can you spot the risks?
- 17. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Vulns Findings Exceptions Control Gaps Missing Policies Please Stop!
- 18. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . “Treat risk as a science, not a dark art. Use scenario analysis. Think things through all the way to the end. Then come back to the beginning and ask yourself "what if?". While predicting the future is hard, formal risk models like FAIR and bow-tie can help tremendously.” -Dr. Ramzan, CTO, RSA
- 19. Risk Loss Event Frequency (LEF) Loss Magnitude (LM) Threat Event Frequency (TEF) Vulnerability Contact Frequency Probability of Action (PoA) Threat Capability (TCap) Resistance Strength (RS) Random Regular Intentional Value Level of Effort Risk Skills -- Knowledge -- Experience Resources -- Time -- Materials Primary Loss Secondary Risk Secondary Loss Event Frequency Secondary Loss Magnitude Factor Analysis of Information Risk (FAIR) Analysis Scoping 1. Identify the asset(s) 2. Identify relevant threat(s) 3. Define Loss Type: C - I - A Productivity Loss - Loss that results from an operational inability to deliver products or services Response Costs - Loss associated with the costs of managing an event Risk - The probable frequency and probable magnitude of future loss Loss Event Frequency - The frequency, within a given timeframe, that loss is expected to occur
- 20. Data-driven risk analysis Risk-oriented Cybersecurity Operations Formal risk models Incorporating terms that aligns to the business •Classification patterns •VDBIR •Attack trends •Threat profiles •Threat modeling •STRIDE Threat Intelligence •Incident classification alignment •VERIS •MITRE •Reusable data Incident Management
- 21. •Security posture •Vulnerabilities •Configuration flaws •Variance in compliance Auditing & Scanning Node Telemetry •Asset inventory •Data at risk •Automated •Manual •Outsourced •Red Team Testing
- 22. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Risk management is an analytical discipline Enterprise risk Uncover key risk drivers Systematic analysis Analyses become repeatable and operationalized Scientific analysis results drive better recommendations to the business, resulting in cost- effectively managing risk to an acceptable level. Risk Management Goal Data (telemetry) Feeds analysis to drive objective results
- 23. The Way Forward
- 24. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . •The FAIR Institute •fairinstitute.org (membership is free) •Measuring & Managing Information Risk: A FAIR Approach •Amazon •‘Getting Started’ reading list •fairinstitute.org/blog/5-must-read-books-to-jumpstart-your-career-in-risk- management Resources:
- 26. C o p y r i g h t 2 0 1 7 R i s k L e n s , I n c . Questions?!