Computer Security: Principles and Practice, 1/e

Detailed Risk Analysis

• most comprehensive alternative
• assess using formal structured process
• with a number of stages
• identify likelihood of risk and consequences
• hence have confidence controls appropriate
• costly and slow, requires expert analysts
• may be a legal requirement to use
• suitable for large organizations with IT systems critical to their business objectives

Combined Approach

• combines elements of other approaches
• initial baseline on all systems
• informal analysis to identify critical risks
• formal assessment on these systems
• iterated and extended over time
• better use of time and money resources
• better security earlier that evolves
• may miss some risks early
• recommended alternative for most orgs

Detailed Risk Analysis Process

Establish Context

• determine broad risk exposure of org
• related to wider political/social environment
• legal and regulatory constraints
• specify organization’s risk appetite
• set boundaries of risk assessment
• partly on risk assessment approach used
• decide on risk assessment criteria used

Asset Identification

• identify assets
• “anything which needs to be protected”
• of value to organization to meet its objectives
• tangible or intangible
• in practice try to identify significant assets
• draw on expertise of people in relevant areas of organization to identify key assets
• identify and interview such personnel
• see checklists in various standards

Terminology

Threat Identification

• to identify threats or risks to assets asK
• who or what could cause it harm?
• how could this occur?
• threats are anything that hinders or prevents an asset providing appropriate levels of the key security services:
• confidentiality, integrity, availability, accountability, authenticity and reliability
• assets may have multiple threats