Fundamentals of Information Systems Security Unit 6 Role of Risk Management, Response, and Recovery for IT Systems, Applications, and Data

Transcription

1 Fundamentals of Information Systems Security Unit 6 Role of Risk Management, Response, and Recovery for IT Systems, Applications, and Data

2 Learning Objective Describe the principles of risk management, common response techniques, and issues related to recovery of IT systems. Page 2

3 Key Concepts Quantitative and qualitative risk assessment approaches Business impact analysis (BIA) Business continuity plan (BCP) Disaster recovery plan (DRP) Elements of an incident response plan Page 3

4 DISCOVER: CONCEPTS Page 4

5 BCP A plan designed to help an organization continue to operate during and after a disruption Covers all functions of a business: IT systems, facilities, and personnel Generally includes only mission-critical systems Page 5

6 BCP Elements Purpose and scope Assumptions and planning principles System description and architecture Responsibilities Page 6

7 BCP Elements (Continued) Notification or activation phase Recovery and reconstitution phases Plan training, testing, and exercises Plan maintenance Page 7

8 DRP Includes the specific steps and procedures to recover from a disaster Is part of a BCP Important terms: Critical business function (CBF) Maximum acceptable outage (MAO) Recovery time objectives (RTO) Page 8

9 DRP Elements Purpose and scope Disaster or emergency declaration Communications Emergency response and activities Page 9

10 DRP Elements (Continued) Recovery steps and procedures Critical business operations Recovery operations Critical operations, customer service, and operations recovery Page 10

11 BIA A study that identifies the CBFs and MAOs of a DRP Studies include interviews, surveys, meetings, and so on. Identifies the impact to the business if one or more IT functions fails Identifies the priority of different critical systems Page 11

12 BIA Elements Scope It is affected by size of the organization. For small organization, scope could include entire organization. For larger organizations, scope may include only certain areas. Objectives Page 12

13 Computer Incident Response Team (CIRT) Plan Outlines steps taken during a response effort and the roles and responsibilities of the team Includes the five Ws + H: Who launched the attack? What type of attack occurred? Where the attack occurred? When the attack occurred? Why the attack occurred? How the attack occurred? Page 13

14 DISCOVER: PROCESSES Page 14

15 Risk Management Assessment Avoidance Reduction Mitigation Page 15

16 Risk Assessment It is a process used to identify and evaluate risks. Risks are quantified based on importance or impact severity. Risks are prioritized. Page 16

17 Risk Assessment Steps Identify threats and vulnerabilities. Identify the likelihood that a risk will occur. Identify asset values. Determine the impact of a risk. Determine the usefulness of a safeguard or control. Page 17

18 Risk Assessment Approaches Quantitative Uses numbers, such as dollar values Qualitative No dollar values; determines risk level based on probability and impact of a risk Page 18

19 Quantitative Qualitative Numerically Based (Hard Data) Scenario-Based (Soft Data) Financial Data Objective Scenario-Oriented Subjective Page 19

20 Quantitative Risk Assessment Single loss expectancy (SLE) Total loss expected from a single incident Annual rate of occurrence (ARO) Number of times an incident is expected to occur in a year Annual loss expectancy (ALE) Expected loss for a year SLE X ARO = ALE Page 20

21 Qualitative Risk Assessment Probability Likelihood a threat will exploit a vulnerability Impact Negative result if a risk occurs Risk level = Probability X Impact Page 21

22 Example - Quantified Risk You have 100 users in your organization. All use laptops. The average laptop costs your company $2,000, including software and hardware modifications You have lost 6 computers in the last year, and this is typical Page 22

23 Single Loss Expectancy is 2,000 (Asset Value is 2000, Exposure Factor is 100% - you lose ALL of the asset. Question could the SLE be more?? Annualized Rate of Occurrence is 6 Annualized Loss Expectancy is $12,000 Page 23

24 Question Would it be cost effective to purchase Kensington Computer Cables (at a cost of $10 in bulk)? Let s assume that the average user lost his/her computer in a hotel room, and that only 1 was lost due to negligence while traveling. The cost of the countermeasure is $1000 (100 computers * $10) The new ARO is now 1 The new ALE is $2000 You spend $1000, to save $10,000, for a net gain of $9000 Page 24

25 Next question For $200 per computer, you can insure it. The insurance will Cover replacement cost Remotely wipe all data Cover new software cost Cost = $20,000 Savings is $12,000 You lost $8,000 Page 25

26 Qualitative Risk Analysis Probability Almost Certain Likely Insignificant Minor Moderate Major Catastrophic Impact Unlikely Rare Page 26

27 Residual Risk Total Risks Mitigating Controls (risk countermeasures) = Residual Risk Residual Risk is the best that can happen Countermeasure Cost = Product Costs Implementation Cost Compatibility Cost (OS, hardware) Hardware Costs Testing Costs Maintenance Costs Productivity Costs Page 27

28 Other metrics that you might consider MTD = Maximum Tolerable Downtime RTO = Recovery Time Objective RPO = Recovery Point Objective (the point to which data needs to be recovered) All of this is covered in a BCP (Business Continuity Plan) Page 28

29 Downtime People costs how do you notify them? How to you evacuate, transport, care, and pay for them? Systems costs what do you have to replicate immediately? What within a day? Data -. Property Page 29

30 NEW YORK (CNNMoney) -- Toyota's U.S. manufacturing arm is preparing for a possible shutdown because of parts shortages from Japan, a Toyota spokesman said. In Japan, meanwhile, Toyota and Nissan have announced some hybrid and electric car production has resumed, while Honda said it is extending its factory shutdown there. Word has gone out to all 13 of Toyota's factories in the United States, Canada and Mexico. This does not mean that the plants will stop working, Toyota spokesman Mike Goss said, but that they should be ready in case the need arises. "We expect some kind of interruptions," he said. While Toyota's car factories in Japan have stopped working since the March 11 earthquake in Japan, the automaker was able to resume production of some auto parts on March 17. Toyota employs 25,000 manufacturing and R&D workers in North America. Toyota has a long-standing policy of continuing to pay its employees while finding other work for them -- either within Toyota or even in the communities where they are located doing volunteer work -- during production shutdowns. "All automakers are just now figuring out who supplies every little part." Said Edmunds.com senior analyst Michelle Krebs. "The shortage of any one could shut down an assembly line. Toyota isn't the only one vulnerable; virtually all major automakers have some risks." Page 30

31 Data How do you backup? Full? Incremental? (just changes since last full or incremental). This takes same amount of time every day, but need every incremental since last full to completely recover. Differential? (changes since last full). Takes longer and longer every day, but a single differential backup will be enough to recover. Page 31

32 Recovery from damage Safety of damaged site Ensure destruction of data Looting prevention Reentry preparations Transportation of equipment and backups Generators? Page 32

33 DISCOVER: RATIONALE Page 33

34 Importance of Risk Assessments Is part of the overall risk management process Helps you evaluate controls Supports decision making Can help organizations remain in compliance Page 34

35 Summary You can protect data and business functions with a BCP, DRP, BIA, and incident response plan. Risk assessments include quantitative and qualitative approaches. Page 35