Risk in Cyber Security
The core duty of cybersecurity is to identify, mitigate and manage cyberrisk to an organization’s digital assets. While most people have an inherent understanding of risk in their day-to-day lives, it is important to understand risk in the context of cybersecurity, which means knowing how to determine, measure and reduce risk effectively.
Assessing risk is one of the most critical functions of a cybersecurity organization. Effective policies, security implementations, resource allocation and incident response preparedness are all dependent on understanding the risk and threats an organization faces. Using a risk-based approach to cybersecurity allows more informed decision-making to protect the organization and to apply limited budgets and resources effectively. If controls are not implemented based on awareness of actual risk, then valuable organizational assets will not be adequately protected while other assets will be wastefully overprotected.
Yet, too often, cybersecurity controls are implemented with little or no assessment of risk. ISACA’s recent worldwide survey of IT management, auditors and security managers consistently shows that over 80 percent of companies believe “information security risks are either not known or are only partially assessed” and that “IT risk illiteracy and lack of awareness” are major challenges in managing risk.4 Therefore, understanding risk and risk assessments are critical requirements for any security practitioner.
Approaches to Cybersecurity
Generally, there are three different approaches to implementing cybersecurity. Each approach is described briefly below.
• Compliance-based—Also known as standards-based security, this approach relies on regulations or standards to
determine security implementations. Controls are implemented regardless of their applicability or necessity, which
often leads to a “checklist” attitude toward security.
• Risk-based—Risk-based security relies on identifying the unique risk a particular organization faces and designing and
implementing security controls to address that risk above and beyond the entity’s risk tolerance and business needs.
• Ad hoc—An ad hoc approach simply implements security with no particular rationale or criteria. Ad hoc
implementations may be driven by vendor marketing, or they may reflect insufficient subject matter expertise,
knowledge or training when designing and implementing safeguards.
In reality, most organizations with mature security programs use a combination of risk-based and compliance-based
approaches. In fact, most standards or regulations such as the Payment Card Industry Data Security Standard
(PCIDSS) or the US Health Insurance Portability and Accountability Act (HIPAA) require risk assessments to drive
the particular implementation of the required controls.
Key Terms and Definitions
There are many potential definitions of risk—some general and others more technical. Additionally, it is important to distinguish between a risk and a threat. Although many people use the words threat and risk synonymously, they have two very different meanings. As with any key concept, there is some variation in definition from one organization to another. For the purposes of this guide, we will define terms as follows:
Risk—The combination of the probability of an event and its consequence (International Organization for
Standardization/International Electrotechnical Commission [ISO/IEC] 73). Risk is mitigated through the use of controls or safeguards.
Threat—Anything (e.g., object, substance, human) that is capable of acting against an asset in a manner that can result in harm. ISO/IEC 13335 defines a threat broadly as a potential cause of an unwanted incident. Some organizations make a further distinction between a threat source and a threat event, classifying a threat source as the actual process or agent attempting to cause harm, and a threat event as the result or outcome of a threat agent’s malicious activity.
Asset—Something of either tangible or intangible value that is worth protecting, including people, information,
infrastructure, finances and reputation
Vulnerability—A weakness in the design, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events
Although much of cybersecurity is focused on the design, implementation and management of controls to mitigate risk, it is critical for security practitioners to understand that risk can never be completely eliminated. Beyond the general definition of risk provided above, there are other, more specific types of risk that apply to cybersecurity.
Residual risk—Even after safeguards are in place, there will always be residual risk, defined as the remaining risk after management has implemented a risk response.
Inherent risk—The risk level or exposure without taking into account the actions that management has taken or might take (e.g., implementing controls)
Likelihood and Impact
When assessing a threat, cybersecurity professionals often analyze the threat’s likelihood and impact in order to rank and prioritize it among other existing threats.
In some cases where clear, statistically sound data are available, likelihood can be a matter of mathematical probability.
This is true with situations such as weather events or natural disasters. However, sometimes accurate data are simply not available, as is often the case when analyzing human threat agents in cybersecurity environments. There will also be factors that create situations where the likelihood of certain threats is more or less prevalent for a given organization. For example, a connection to the Internet will predispose a system to port scanning. Typically, qualitative rankings such as
“High, Medium, Low” or “Certain, Very Likely, Unlikely, Impossible” can be used to rank and prioritize threats stemming from human activity. When using qualitative rankings, however, the most important step is to rigorously define the meaning of each category and use definitions consistently throughout the assessment process.
For each identified threat, the impact or magnitude of harm expected to result should also be determined. The impact of a threat can take many forms, but it often has an operational consequence of some sort, whether financial, reputational or legal. Impacts can be described either qualitatively or quantitatively, but as with likelihoods, qualitative rankings are most often used in cybersecurity risk assessment. Likewise, each ranking should be well-defined and consistently used. In
cybersecurity, impacts are also evaluated in terms of confidentiality, integrity and availability.
No comments:
Post a Comment