Skip to main content
UploadLanguage (EN)Support
BusinessMobileSocial MediaMarketingTechnologyArt & PhotosCareerDesignEducationPresentations & Public SpeakingGovernment & NonprofitHealthcareInternetLawLeadership & ManagementAutomotiveEngineeringSoftwareRecruiting & HRRetailSalesServicesScienceSmall Business & EntrepreneurshipFoodEnvironmentEconomy & FinanceData & AnalyticsInvestor RelationsSportsSpiritualNews & PoliticsTravelSelf ImprovementReal EstateEntertainment & HumorHealth & MedicineDevices & HardwareLifestyle
Praveen Vackayil, profile picture
Uploaded byPraveen Vackayil
PPTX, PDF404 views

How to Do a Formal Risk Assessment

This document discusses implementing a formal information security risk assessment. It begins by establishing context and discussing risk assessments in the Indian context. It then presents a case study of a risk assessment conducted for card data at a bank. The document outlines common challenges encountered with risk assessments and suggested solutions. It stresses the need for continuous risk assessments in Indian organizations and keys to a successful risk management program.

Technology◦
Download to read offline
Implementing a Formal Information Security Risk Assessment Praveen Joseph Vackayil M.S, B.E, CISSP, PCI QSA cert., CCNA, ISO 27001 LA
ABOUT • CONSULTING • TRAINING • AUDIT & CERTIFICATION
AGENDA • CONTEXT ESTABLISHMENT • ISRA IN THE INDIAN CONTEXT • CASE STUDY RISK ASSESSMENT • COMMON CHALLENGES, SUGGESTED SOLUTIONS • NEED OF THE HOUR IN INDIAN ORGANIZATIONS
WHAT IS RISK ASSESSMENT?
WHAT IS RA? • Risk Assessment is just people being people • It is the accomplishment of a basic human need…
FORMAL INFORMATION SECURITY RISK ASSESSMENT
NEW METHODOLOGY vs FORMAL METHODOLOGY Develop a New RA methodology Adopt a pre-existing Formal RA methodology RA METHODOLOGY: • A new methodology must be developed, tried and revised. • This is in some ways re-invention of the wheel • A tried and tested methodology already exists. It needs to be identified, tailored and adopted. • Corresponding RA template may be available RISK ASSESSORS: • Develop an in-house talent pool that is well versed with the methodology. Training costs extra. • Hire RA personnel with relevant experience/certification. Staffing costs extra. COMPATIBILITY : • It will be created as per the organization’s unique environment. • The existing methodology may need to be tweaked to suit the organization’s environment, structure and culture. Eg. Primary and supporting assets may be selected according to the org-structure. ADOPTION: • Factors that support user adoption may be built-in while developing the methodology. • Eg. Qualitative risk calculation is used, since it is easier for all to understand. • Ways to enable user adoption of the methodology must be developed. Eg. The survey-based approach of OCTAVE may not work in an organization where people don’t respond to emails. FIRST TIME USE: • Not sure if it will succeed/fail since there is no prior user experience/reviews to refer to • Tried and tested. Common pitfalls will be available based on others’ experiences.
RISK ASSESSMENT APPROACH Qualitative Quantitative • High, Medium, Low • Red, Green, Yellow Numeric Easy to calculate May include complex formulae Less accurate, but gets the job done Precise. Useful in $ estimations Difficult to convince stakeholders since it is based on subjective judgment Easier to convince stakeholders Risk = f (Asset Value, Threat probability, Level of Vulnerability) Basic concepts to be noted: SLE=Asset Value x Exposure Factor ALE= SLE x ARO A truly quantitative risk assessment is not possible to achieve. True. Because we are assigning quantitative values to qualitative entities. For example, stating that an earthquake will occur once in 10 years and will incur loss of INR 3 crore cannot be 100% accurate. Ref - Shon Harris - CISSP AIO, 6th Edition TRUE OR FALSE ?
ISRA IN THE INDIAN CONTEXT
WHY DO A RISK ASSESSMENT?
GUESS WHICH OPTION GETS YOU MAXIMUM BUY-IN “A formal information security risk assessment is needed to a) Prepare for a compliance program (eg. PCI, ISO 27001, HIPAA, etc.) b) Formulate an information security strategy c) Meet a compliance mandate d) Perform a due diligence check on the current security posture”
TYPICAL RESPONSE #1 – AUDIT vs RA “We have annual audits done by our clients. We don’t need risk assessment.” WHAT HAS GONE WRONG WHAT CAN GO WRONG
TYPICAL RESPONSE #2 – COMPLIANCE vs RA “I am trying to check the boxes in my PCI DSS/SSAE 16 checklist. I don’t need a separate risk assessment.” UNIVERSAL SET OF CONTROL REQUIREMENTS MAPS CONTROL REQUIREMENTS TO UNIQUE NEEDS OF AN ENVIRONMENT
TYPICAL RESPONSE #3 - RoSI “Everything eventually boils down to the numbers. How do I justify the cost invested in an RA?” 0 100%
CASE STUDY: CARD DATA RISK ASSESSMENT IN A BANK Scope Asset Threat Vulnerability Risk Score Risk Management
Scope Asset Threat Vulnerability Risk Score Risk Management
Scope Asset Threat Vulnerability Risk Score Risk Management
Scope Asset Threat Vulnerability Risk Score Risk Management
Scope Asset Threat Vulnerability Risk Score Risk Management
Scope Asset Threat Vulnerability Risk Score Risk Management Likelihood of Occurrence Level of Impact Very Low Low Moderate High Very High Very High Very Low Moderate High Very High Very High High Low Moderate Moderate High Very High Moderate Low Low Moderate Moderate High Low Very Low Low Low Moderate Moderate Very Low Very Low Very Low Low Low Low
Scope Asset Threat Vulnerability Risk Score Risk Management
COMMON CHALLENGES, SUGGESTED SOLUTIONS
COMMON CHALLENGES
WHICH OF THE FOLLOWING IS THE BEST TIME TO DO A RISK ASSESSMENT? • Before acquiring a company •Just before an audit • Just after deploying new laptops • Before starting operations in a new facility • Every month for all assets • Never. 
CONTINUOUS RISK ASSESSMENT Scope Identify AssessManage Document
NEED OF THE HOUR IN INDIAN ORGANIZATIONS
2015: STATS 74% 26% 2015: RA Not Done 2015: RA Done Ref: http://www.kpmg.com/IN/en/IssuesAndInsights/ArticlesPublications/Documents/Cyber-Crime-Survey-2015-30Nov15.pdf Organizations Breached
KEYS TO A SUCCESSFUL RISK MANAGEMENT PROGRAM
Thank You praveen.jvc@gmail.com linkedin.com/in/vackayil