Information Security Risk Concepts and Principles

1
learntorise
2
INFORMATION SECURITY RISK
Access Control Con?dentiality Encryption
Data Validation
Protecting Information
Integrity
Checksums Redundancy
CRSIC DOMAIN 1
Availability Backup and Recovery
Firewalls
Network Security
Intrusion Detection Systems Antivirus
Information Systems Protection
Endpoint Security
Device Management Secure Coding
Application Security
Patch Management
Malware Threats Phishing
Software Flaws
Risk Events
Vulnerabilities
Con?guration Errors Data Breach
Impacts Service Downtime
www.infosectrain.com
3
JUSTIFICATION FOR INFORMATION SECURITY ACTIVITIES
GDPR
Regulatory Compliance
HIPAA
Cost of Breach
Financial Impact
Fines and Penalties
CRSIC DOMAIN 1
Customer Trust
Reputation Management
Brand Value
Disaster Recovery
Business Continuity
Incident Response
Mature risk management processes can quantify
risk accurately.
Risk Measurement
Quali?cation
Often difficult to measure due to reliance on
likelihood and impact.
www.infosectrain.com
4
LIKELIHOOD (PROBABILITY)
Historical Data Statistical Analysis Predictive
Modeling External Threats Threats Internal
Threats
Frequency of Potential Events
Cyber Attacks
Natural Disasters Insider Threats
CRSIC DOMAIN 1
System Failures
Dependencies
Software Vulnerabilities Hardware Vulnerabilities
Human Factors
Vulnerabilities
Access Controls
Preventive Controls
Firewalls Monitoring Systems
Detective Controls
Controls
Intrusion Detection Systems
Incident Response
Corrective Controls
Patch Management
www.infosectrain.com
5
FACTORS AFFECTING LIKELIHOOD
Volatility Unpredictability of conditions (e.g.,
market ?uctuations). Velocity Speed of onset
and preparation time (e.g., natural
disasters). Proximity Time between event
occurrence and impact (e.g., cyber attack
detection).
CRSIC DOMAIN 1
Interdependency Interaction between different
risks (e.g., supply chain disruptions).
Motivation Determination of the threat
perpetrator (e.g., hacktivists). Skill
Capability of the threat perpetrator (e.g.,
skilled hackers). Visibility Awareness of a
vulnerability (e.g., publicized software
vulnerabilities).
www.infosectrain.com
6
IMPACT
Loss or Compromise of Information Data breaches
(e.g., leaking customer data).
CRSIC DOMAIN 1
Types of Impact
Loss or Compromise of Information Systems System
outages (e.g., DDoS attacks).
www.infosectrain.com
7
CIA TRIAD
De?nition Secrecy and privacy of data.
Examples Need-to-know principle (e.g., masking
credit card numbers).
Con?dentiality
Real-world Example Unauthorized access to PII
(e.g., healthcare data breach). De?nition
Protection against improper modi?cation or
destruction of data.
CRSIC DOMAIN 1
Examples Error checking, least
privilege principle (e.g., ?nancial data
integrity).
Integrity
Real-world Example Unauthorized data modi?cation
(e.g., altering ?nancial records).
De?nition Timely and reliable access to
information. Examples Business continuity,
disaster recovery (e.g., 24/7 availability
of e-commerce). Real-World Example System
downtime (e.g., online banking outage).
Availability
www.infosectrain.com
8
FOUND THIS USEFUL?
To Get More Insights
Through Our FREE
Courses Workshops eBooks Checklists Mock
Tests
LIKE
FOLLOW
SHARE