Risk analysis and management is used to assess threats, vulnerabilities and risks of the information system, as well as to identify countermeasures that provide a sufficient level of security for this information system. The risk assessment process consists in determining the risk characteristics of the information system and its resources. Based on such data, the necessary safeguards can be selected. When assessing risks, many factors are taken into account: the value of resources, assessing the significance of threats, vulnerabilities, the effectiveness of existing and planned remedies, and much more. There are various approaches to risk assessment, the choice of which depends on the level of requirements in the organization for the information security (IS) regime. Risk management consists in determining the set of necessary controls in accordance with the performed risk analysis.
Consider the basic concepts of risk analysis and management processes system architect job description.
Threat - a set of conditions and factors that may cause a violation of the integrity, accessibility and confidentiality of information.
Vulnerability is a weakness in the security system that makes the threat possible.
Risk of security breach - the possibility of a threat.
Risk analysis - the process of identifying threats, vulnerabilities, possible damage, as well as countermeasures.
IS management system - a set of measures aimed at ensuring the information security regime at all stages of the life cycle of an information system.
The basic level of security is the mandatory minimum level of security for information systems. A number of countries have criteria for determining this level.
Basic risk analysis - a risk analysis conducted in accordance with the requirements of the basic level of security. Applied risk analysis methods focused on this level usually do not take into account the value of resources and do not evaluate the effectiveness of countermeasures. The methods of this class are applied in cases when the information system does not have high requirements in the field of information security.
A complete risk analysis is a risk analysis for information systems that pose increased requirements in the field of information security (higher than the basic level of security). It includes determining the value of information resources, assessing threats and vulnerabilities, choosing adequate countermeasures, and assessing their effectiveness.
Risk assessment - identification of risks, selection of parameters for their description and obtaining estimates of these parameters.
Risk analysis is the process of identifying threats, vulnerabilities and possible damage to the security of a corporate information system. The purpose of risk analysis is to identify existing risks and assess their magnitude (to give them a quantitative assessment). The risk is determined by the probability of causing damage and the amount of damage to CIS resources in the event of a security risk. Risk analysis includes measures to monitor the security of CIS, the purpose of which is to determine which resources and from which threats should be protected, and also to what extent these or those resources need to be protected. A set of adequate countermeasures is identified in the course of risk management.
There are various approaches to risk analysis. The choice of approach depends on the level of requirements in the organization for the information security regime and the nature of the threats taken into account (the spectrum of the impact of threats). There are two levels of requirements:
minimum requirements for IS mode;
increased requirements for the IB mode.
The basic requirements for information security correspond to the minimum requirements for the IS mode .Typical applications for this level are typical design solutions. Risk analysis is carried out according to a simplified scheme: a standard set of the most common threats without danger is considered without assessing their probability. There are a number of standards and specifications that consider the minimum (typical) set of the most probable threats, such as viruses, equipment failures, unauthorized access, etc. To neutralize these threats, countermeasures must be taken, regardless of the likelihood of their implementation and resource vulnerability, that is, the characteristics of threats at a basic level are not necessary.
Increased requirements for the IS mode are applied in cases where violations of the information security regime are fraught with serious consequences and the basic level of requirements for the IS regime is insufficient.
In order to formulate increased requirements for the IS mode, it is necessary:
determine the value of resources;
supplement the standard set with a list of threats relevant to this and information system;
assess the likelihood of threats;
identify resource vulnerabilities.
The risk analysis process can be divided into several successive stages:
identification of key CIS resources;
determination of the importance of certain resources;
identification of existing security threats and vulnerabilities that make threats possible;
Calculation of risks associated with the implementation of security threats.
CIS resources are divided into three categories:
informational resources;
software;
hardware (file servers, workstations, bridges, march routers, etc.).
In each category, resources can be divided into classes and subclasses. It is necessary to identify only those resources that determine the functionality of CIS and are essential from the point of view of ensuring security.
The importance (or cost) of a resource is determined by the amount of damage caused in case of violation of confidentiality, integrity or accessibility of this resource. During the assessment of the cost of resources, the amount of possible damage for each category of resources is determined, for example:
data has been disclosed, changed, deleted or become inaccessible;
the equipment has been damaged or destroyed;
software integrity is violated.
Typical security threats include:
local and remote attacks on CIS resources;
natural disasters;
staff errors;
malfunctions of the CIS, caused by errors in the software or hardware malfunctions.
The threat level is understood as the probability of its implementation.
The presence of vulnerabilities in CIS is caused by security weaknesses. Vulnerability assessment involves determining the likelihood of successful implementation of security threats. Successful implementation of the threat means damage to the resources of the information system. Thus, the probability of damage is determined by the probability of a threat and the magnitude of vulnerability.
The risk level is determined based on the cost of the resource, the level of threat and the magnitude of vulnerability. With an increase in the cost of a resource, the level of threat, and the magnitude of vulnerability, the level of risk also increases. Based on the assessment of the level of risks, safety requirements are determined.
The risk management task includes a reasonable choice of countermeasures to reduce risk levels to an acceptable level. Risk management includes an assessment of the cost of implementing countermeasures, which should be less than the amount of possible damage.
Countermeasures can reduce risk levels in various ways:
elimination of vulnerabilities or reduction of their size;
reducing the likelihood of security threats;
reduction in the amount of possible damage,
identifying attacks and other security breaches;
restoration of damaged CIS resources.
Consider the basic concepts of risk analysis and management processes system architect job description.
Threat - a set of conditions and factors that may cause a violation of the integrity, accessibility and confidentiality of information.
Vulnerability is a weakness in the security system that makes the threat possible.
Risk of security breach - the possibility of a threat.
Risk analysis - the process of identifying threats, vulnerabilities, possible damage, as well as countermeasures.
IS management system - a set of measures aimed at ensuring the information security regime at all stages of the life cycle of an information system.
The basic level of security is the mandatory minimum level of security for information systems. A number of countries have criteria for determining this level.
Basic risk analysis - a risk analysis conducted in accordance with the requirements of the basic level of security. Applied risk analysis methods focused on this level usually do not take into account the value of resources and do not evaluate the effectiveness of countermeasures. The methods of this class are applied in cases when the information system does not have high requirements in the field of information security.
A complete risk analysis is a risk analysis for information systems that pose increased requirements in the field of information security (higher than the basic level of security). It includes determining the value of information resources, assessing threats and vulnerabilities, choosing adequate countermeasures, and assessing their effectiveness.
Risk assessment - identification of risks, selection of parameters for their description and obtaining estimates of these parameters.
Risk analysis is the process of identifying threats, vulnerabilities and possible damage to the security of a corporate information system. The purpose of risk analysis is to identify existing risks and assess their magnitude (to give them a quantitative assessment). The risk is determined by the probability of causing damage and the amount of damage to CIS resources in the event of a security risk. Risk analysis includes measures to monitor the security of CIS, the purpose of which is to determine which resources and from which threats should be protected, and also to what extent these or those resources need to be protected. A set of adequate countermeasures is identified in the course of risk management.
There are various approaches to risk analysis. The choice of approach depends on the level of requirements in the organization for the information security regime and the nature of the threats taken into account (the spectrum of the impact of threats). There are two levels of requirements:
minimum requirements for IS mode;
increased requirements for the IB mode.
The basic requirements for information security correspond to the minimum requirements for the IS mode .Typical applications for this level are typical design solutions. Risk analysis is carried out according to a simplified scheme: a standard set of the most common threats without danger is considered without assessing their probability. There are a number of standards and specifications that consider the minimum (typical) set of the most probable threats, such as viruses, equipment failures, unauthorized access, etc. To neutralize these threats, countermeasures must be taken, regardless of the likelihood of their implementation and resource vulnerability, that is, the characteristics of threats at a basic level are not necessary.
Increased requirements for the IS mode are applied in cases where violations of the information security regime are fraught with serious consequences and the basic level of requirements for the IS regime is insufficient.
In order to formulate increased requirements for the IS mode, it is necessary:
determine the value of resources;
supplement the standard set with a list of threats relevant to this and information system;
assess the likelihood of threats;
identify resource vulnerabilities.
The risk analysis process can be divided into several successive stages:
identification of key CIS resources;
determination of the importance of certain resources;
identification of existing security threats and vulnerabilities that make threats possible;
Calculation of risks associated with the implementation of security threats.
CIS resources are divided into three categories:
informational resources;
software;
hardware (file servers, workstations, bridges, march routers, etc.).
In each category, resources can be divided into classes and subclasses. It is necessary to identify only those resources that determine the functionality of CIS and are essential from the point of view of ensuring security.
The importance (or cost) of a resource is determined by the amount of damage caused in case of violation of confidentiality, integrity or accessibility of this resource. During the assessment of the cost of resources, the amount of possible damage for each category of resources is determined, for example:
data has been disclosed, changed, deleted or become inaccessible;
the equipment has been damaged or destroyed;
software integrity is violated.
Typical security threats include:
local and remote attacks on CIS resources;
natural disasters;
staff errors;
malfunctions of the CIS, caused by errors in the software or hardware malfunctions.
The threat level is understood as the probability of its implementation.
The presence of vulnerabilities in CIS is caused by security weaknesses. Vulnerability assessment involves determining the likelihood of successful implementation of security threats. Successful implementation of the threat means damage to the resources of the information system. Thus, the probability of damage is determined by the probability of a threat and the magnitude of vulnerability.
The risk level is determined based on the cost of the resource, the level of threat and the magnitude of vulnerability. With an increase in the cost of a resource, the level of threat, and the magnitude of vulnerability, the level of risk also increases. Based on the assessment of the level of risks, safety requirements are determined.
The risk management task includes a reasonable choice of countermeasures to reduce risk levels to an acceptable level. Risk management includes an assessment of the cost of implementing countermeasures, which should be less than the amount of possible damage.
Countermeasures can reduce risk levels in various ways:
elimination of vulnerabilities or reduction of their size;
reducing the likelihood of security threats;
reduction in the amount of possible damage,
identifying attacks and other security breaches;
restoration of damaged CIS resources.
No comments:
Post a Comment