Chapter 4. Information Security Risk Management

In this chapter, we will be discussing information security risk management, which provides the main interface between the information security program and the business for prioritization and communication.

In this chapter, you will learn:

• Key information security risk management concepts
• Determining where valuable data is located
• Quick risk assessment techniques
• How risk management affects different parts of the organization
• How to perform information categorization
• Security control selection, implementation, and testing
• Authorizing information systems for production operations

What is risk?

Information security risk comes into play when there is a potential event or circumstance that could lead to organizational disruption, damage to organizational reputation, or financial loss because of failure of an information system.

The goal of information security risk management is to minimize the overall risk to an organization, as well as people, processes, and technology related to the information systems within an organization.

Risk management involves the entire organization, from senior executives down to front-line employees. This highly complex process requires a thorough understanding of how people, processes, and technology interact in the organization at all levels.

Who owns organizational risk?

Risk ownership is a very important topic and is given careful attention today in light of large-scale breaches in government and private sector information systems. In the past, many organizations viewed information security risk as being something that was the responsibility of the IT division of an organization. While this is not, and has never been, an acceptable practice it is how many organizations effectively viewed the ownership of risk within their organization.

The issue that many organizations encounter is the concept of risk ownership versus risk management.

Risk ownership

Understanding risk ownership, and who does not own risk, is critically important in order to make the correct risk decisions that support your organization's business and mission objectives:

• Risk ownership is held by the C-suite and/or people at the boardroom level.
• The ability to own risk is tied to authority and the ability to commit funds to reduce risk.
• Senior leaders have the ability...

Where is your valuable data?

Understanding your organization's valuable data is a key component of a successful information security program. Without an adequate understanding of your organization's critical business information you, as the information security professional, will be unable to adequately ensure that your organization's interests are adequately protected.

The information security program must align with key business stakeholders to help understand what the most valuable pieces of information are in the organization so that you can work with the business and IT teams to secure the data.

What does my organization have that is worth protecting?

Information security is not about implementing new information security tools. It is about protecting your organization's sensitive information assets. As an information security professional, you must determine what is important to your organization so that you can prioritize your security activities.

Intellectual property trade secrets

• Does...

Performing a quick risk assessment

The purpose of the quick risk assessment in this book is to give you a pulse check for your organization. The purpose is not to replace the more detailed risk assessment procedures detailed in this chapter. Use this quick assessment to give yourself and management a down-and-dirty review of what your organization, business partners, or vendors look like from an information security perspective. When presenting the output of this quick assessment you should ensure that you let your management know that this is a pulse check, and that they should expect more to come from an information security risk perspective.

Instructions:

• Yes: 5 points
• Unsure: 5 points
• No: 0 points

Answer the following questions with the preceding numerical scores. Once completed, add up your answers to determine your score. Compare your score to the following range to determine your risk rating:

• Does your organization use an internal unsecured guest wireless network?
• Does your organization...

Risk management is an organization-wide activity

Managing information security risk is a highly complex activity that requires the information security professional to be actively involved in all facets of the organization, from top-level organizational leadership down to the people, processes, and technology that makes the organization's mission successful:

The information professional must establish a risk management strategy whereby an organization can establish repeatable mechanisms for the ongoing assessment, response, and monitoring of information security risks. This allows the information security professional to engage the organization in a repeatable and transparent way, helping to ensure a greater level of acceptance by the organization. Use the following examples as a guide as you begin the process of understanding your organization more deeply.

Business operations

Business operations staff focus on the successful operations of the organization and are typically business/mission...

Security control selection

Now that you have completed the activity of information categorization, found your organizational information assets, discovered where your organizational information is located within the information system, organized your information into discrete protection categories, and assigned a dollar value to your information you are in an excellent position to begin establishing the security controls necessary to protect your organization's information. You have worked with the business and IT teams to establish the importance of the data within your organization. You can use this information to architect the needed security controls for the information system.

Prior to establishing the security controls for your information systems, you must look at your organization's regulatory and compliance requirements to make sure that you are building a security framework that ensures you are complying.

As you are in the process of building your organization's framework you should...

Security control implementation

Security control implementation is where the rubber meets the road for all of the effort that has been conducted regarding information categorization and security control selection with business and IT users. Security control implementation must be carefully planned and communicated with the project team that is implementing the new information system, ensuring that no information security control is left unimplemented.

Now that we are at the point in the system development life cycle where we are working to develop the information system, we must ensure that the project's scope includes the security control implementation as part of the overall project scope. While the information security professional will play an important role in the implementation of the security controls, this will be a team effort. Security controls must be assigned to the appropriate IT team member to ensure that that the correct subject matter expert is involved.

You should work to...

Assessing implemented security controls

The goal of assessing the implemented security controls is to ensure that the controls have been adequately implemented as part of the information system.

In order to properly assess the information system's security controls you should be asking if the security controls are the following:

• Implemented as expected: Are the agreed upon security control designs part of the production information system?
• Operating appropriately: Are the security controls impacting the production system negatively and providing the required security functionality?

Testing security controls should be a formalized procedure within your organization. Security control implementation can be very complicated and there are typically a large number of requirements that need to be implemented. Without a formalized plan, you will find it very difficult to adequately and completely test your newly implemented security controls. Your testing procedures will be ad hoc, and you run the risk...

Authorizing information systems to operate

Now that you have tested your information systems' security controls, validating that the controls have been effectively implemented and that they are operating as expected, it is now time to prepare for the system to be approved for production use.

This step in the process is referred to as system authorization. The purpose of this step is to allow an officially designated senior leader within the organization to decide whether an information system will be approved for production use, or whether a current operating system can continue to be used.

An authorizing official has options when it comes to deciding how they will treat a system that is requesting to operate on the production network.

The authorizing official can do the following:

• Authorize the system to operate:
  • In this case, the authorizing official approves the system based on the evidence provided, and allows the system to go to production
  • The system may have one or more Plan of Actions...

Monitoring information system security controls

Now that we have a production information system that has been fully authorized to operate by an executive leader with the appropriate authority to accept risk on the behalf of the organization, we now need to begin the process of operations and maintenance.

The operations and management phase for an information system is referred to as continuous monitoring. The purpose behind continuous monitoring is to ensure that the security controls that where designed and tested as part of the information system's development continue to be effective over the life of the system.

In the past, an information security professional would ensure that an information system was adequately protected as it was going into production. After that, the system was treated as secure until the authorizing official or compliance requirements dictated it was time to review the security documentation again. The reality is that an information system does not stay secure for...

Calculating risk

In this section, we will look at the difference between qualitative and quantitative risk assessments.

Qualitative risk analysis

A qualitative risk assessment is based on an individual's perception regarding the probability that a particular risk may occur at a given time, and whether that risk will have a genuine impact on the organization. The key thing to understand about qualitative risk assessments is that they do not utilize any mathematical calculation method to calculate a certain risk. As a result, qualitative risk analysis is relatively easy to perform and is typically the type of risk assessment that is performed by the information security professional.

The qualitative risk assessment provides a method where the information security professional can rank risk on a subjective scale as seen in the following, where risk is ranked high, medium, or low.

Qualitative risk assessments are not as precise as quantitative risk assessments as they do not contain a mathematical...

Summary

In this chapter, we learned about information security risk management and how to perform the necessary task of risk management, which can be applied to your organization.

We discussed the following:

• Information security risk management concepts and how they are applied to the organization
• How to determine where valuable information is located within your organization
• How to perform a quick initial risk assessment to determine an organization's health
• How risk management affects the organization
• How information categorization is performed
• How information security risk management is performed

In the next chapter, we will discuss how to develop your information security plan, which is the foundational component of establishing your information security program and its continued governance.