Jason Creasey Certified STREAM Consultant A complete Information Risk Management solution for ISF Members using Simon Marvell Partner Abstract IRAM is a business-led information risk analysis methodology used widely by ISF members. IRAM provides tools for business impact assessment, threat and vulnerability assessment and control selection. However, it is not an integrated web-based solution and does not provide tools for ongoing monitoring and reporting of risk status or workflow for managing the treatment of unacceptable risks. This paper describes how IRAM can be used easily with Acuity s STREAM GRC software to provide a complete information risk management solution for ISF members. Overview of IRAM IRAM provides a three stage approach as illustrated in Figure 1. The comprehensive Business Impact Assessment is widely used and is ideal to provide a front-end to STREAM, where the summary detail can be entered and copies of the supporting BIA spreadsheets stored centrally. The Threat and Vulnerability Assessment is useful, particularly in conjunction with the ISF Healthcheck, both of which are compatible with STREAM. The control selection tool gives food for thought but at present is less widely used than the other two stages. Figure 1: Three-stage IRAM Process Note. The two assessment tools in IRAM are based on spreadsheets, which can be co-ordinated using the web-based Risk Analyst Workbench (RAW). For simplicity we just use the term IRAM in this paper. Page 1 of 7
The roles of in managing Information Risk IRAM provides a strong business driven articulation of the requirements for information security through its business impact analysis (BIA). The BIA provides an essential understanding of the requirements for Confidentiality, Integrity and Availability (CIA) of information which can be informed and refined by an understanding of the likelihood of a loss event or incident occurring by the IRAM Threat & Vulnerability Analysis. Clearly, information with high requirements for CIA needs a high degree of protection and without that protection there would be a significant risk (probably an expectation) of serious damage, even more so when there is a genuine likelihood of loss or attack. But the assumption of no protection is theoretical and the risk information of most value to business managers is an understanding of the residual risk, taking account of the existence and performance of controls deployed to mitigate this risk. The IRAM Control Selection stage allows a range of controls to be considered and, where required, helps to select additional controls to reduce the likelihood of serious incidents occurring. However, IRAM it is not designed to quantify residual risk as part of the risk analysis or to monitor residual risk as contributory factors change. This means that while, following an IRAM risk analysis, the business can be confident that it has a good understanding of the requirements for information security it may not fully understand the residual risk. Furthermore, any understanding of residual risk that it does have will deteriorate over time if the performance of controls changes in a way that is not visible to the risk analyst. The following table summarises the main factors that influence residual risk and their frequency of change: Factor Frequency of Change Influence on Residual Risk Business Impact Analysis Threat Likelihood Vulnerabilities Control Selection Relatively static - once determined, the potential business impacts from a loss of CIA tend not to change much 1. Variable by risk type. Can change significantly at short notice, e.g. if targeted by attackers Weaknesses in control 2 variable by control type. Can change significantly at short notice, e.g. zero-day vulnerabilities Variable as BIA, Threat Likelihood and Vulnerabilities change A broad statement of information security requirements Refines the BIA defined requirements Increases the likelihood that an attack, if mounted would be successful The design for reducing residual risk to an acceptable level Supported by IRAM? Supported by STREAM? - Detailed - Summary, but not as a compliance tool 1 The BIA can change as information goes through different phases in its lifecycle, e.g. data which is embargoed before publication. However this can be modelled and the BIA at each lifecycle stage tends to be relatively static. 2 Most vulnerabilities are weaknesses in control. However, organisations may also be inherently vulnerable to an incident, e.g. if there is a single-point of failure. Inherent vulnerabilities result in higher requirements for security whereas control vulnerabilities require improvement in control performance. Page 2 of 7
Factor Frequency of Change Influence on Residual Risk Control Performance Incidents and Near-misses Handling of Improvement Actions Variable, perhaps due to staffing levels, budget constraints, competing priorities, people making mistakes Variable by incident type Variable depending on the volume and frequency of improvement actions Very important factor in maintaining residual risk at an acceptable level Feedback on the performance of the above factors allowing refinement and improvement Reduces residual risk as improvement actions are completed Supported by IRAM? No No Supported by STREAM? Figure 2: The contributory factors in understanding residual risk The above table illustrates that all residual risk factors are variable (less so for BIA), sometimes to quite an extent. This means that to be effective and provide meaningful management information an information risk management solution must: Integrate all the different components of information risk Calculate residual risk it is impossible for a risk analyst to manually evaluate all of the above factors, even where they have visibility of them Update the calculation every time one of the factors changes, which could, in some cases, be daily. IRAM does not calculate residual risk or support the complete range of residual risk factors, as illustrated in the table above. However, a combination of IRAM with STREAM provides a complete, easy to use and powerful solution for information risk management. A complete information risk management solution for ISF Members using Figure 3 overleaf illustrates the recommended combined solution, allowing ISF members to take advantage of the powerful graphical displays and aggregation facilities available in STREAM without losing the benefits of the ISF IRAM tool which comes as a standard part of ISF membership. STREAM s asset management and risk modelling, which are straightforward and easy-to use, are important so that risk boards, committees or equivalent can view and discuss the risks to an application before it goes live or if it changes significantly. Although knowledge of how STREAM can be used with ISF tools will be very useful, STREAM can be configured easily without the need for extensive support, saving time and money. Furthermore, once it has been set up, many risk assessments can become semi-automatic. Page 3 of 7
Figure 3: A combined IRAM / STREAM Risk Management Solution Business Impact Analysis IRAM provides a comprehensive BIA designed specifically for the needs of ISF members. Members can use the IRAM BIA to capture BIA information and then enter the BIA Summary information to STREAM. Since BIA data is typically fairly static an automated interface is not required and the summary information can be entered to STREAM manually. STREAM can be configured with the same A E scale used by IRAM for recording impacts. Threat and Vulnerability Assessment Stage 2 of IRAM (Threat and Vulnerability Assessment) is not as widely used by Members as Stage 1 (BIA) and so Members may prefer to add this information directly into STREAM as it simplifies the process and is more flexible. Since this information is variable, it will be easy to manage in STREAM which automatically keeps a history of previous assessments and re-calculates the residual risk each time it is updated. Members that prefer to keep their Threat and Vulnerability Assessments in IRAM can transpose or import the data to STREAM. STREAM can be configured with the ISF Threat list and / or other Threat lists as required and the same A-E scale used by IRAM for recording threat likelihood. Control Selection As with Stage 2, Stage 3 of IRAM (Control Selection) is not as widely used by Members as Stage 1 (BIA) and so Members may prefer to add this information directly into STREAM, particularly for Page 4 of 7
compliance monitoring. STREAM also has the advantage in that its Framework mappings allow Controls to be mapped to Asset Classes and Threats. So each time an Asset is added to an Asset Class, STREAM will automatically map all relevant Controls and Threats to the Asset. STREAM can be configured with ISF Controls Content, such as the Standard of Good Practice (SoGP), Security Healthcheck, Benchmark controls or any other set of control standards, such as ISO 27001, PCI-DSS, COBIT 5 or internal policies and control standards. If Members prefer to use IRAM for control selection they can do so and transpose or import the data to STREAM. Control Compliance and Performance of Key Control Indicators (KCIs) Since control compliance and, in particular, the performance of key control indicators is such an important factor in residual risk, and varies over time, it is recommended that this information is recorded in STREAM. A history of control assessments is maintained and residual risk is recalculated every time a change is made. As indicated above, STREAM can be configured with ISF Controls content or any other set of control standards. Multiple controls assessment schemes can be defined for different control sets, including the ISF benchmarking scheme. An optional Control Approvals scheme can be configured to provide independent approval of control assessments. Incidents and Near-misses IRAM does not provide a facility for recording and tracking incidents and near-misses but they can be captured in STREAM and linked to Assets, Controls and Threats. STREAM can be configured with the ISF s Threat / Incident types. The impact of incidents can be recorded in STREAM (if required using the ISF s A-E scale) and reporting provides information on frequency and average impact of events which can be used to refine and continually improve the risk assessment and residual risk calculation. Action Management IRAM provides only limited options for recording and tracking actions but they can be raised (and easily tracked) in STREAM against controls, risks, incidents and near-misses. As actions are completed, the status of controls and risks can be updated in STREAM and the residual risk re-calculated. Alerting and Workflow As a single-user system IRAM does not support alerting and workflow. In STREAM risks, controls, incidents, near-misses and actions can be allocated to owners who will receive an email alert. Dates of next assessment, approval, acceptance and target completion dates for actions can be recorded with alerts and reminders sent to users. Workflow can be established to handle exceptions and waivers. Page 5 of 7
Asset Management and Risk Modelling A strength of STREAM is its configurable asset-based approach to risk management. Asset is a term used in STREAM to denote a component of the target scope for risk management. IRAM takes a system based approach to risk assessment and this can be configured in STREAM. However, Members also have a range of preferred primary points of focus some prefer a business process led approach, others segment into business as usual and project views, while others structure geographically and /or by technology components (critical business applications, networks, computer installations etc.). STREAM is configurable to support all of these approaches and they can be mixed and matched with different risk assessment and control assessment schemes as required. An unlimited Asset Class tree structure can be configured in STREAM allowing organisations to configure assets down to their required level of detail. As Assets are then added to the scope of the risk assessment, threats and controls will be automatically mapped to the Assets providing important assurance that a consistent approach is being taken to common Assets across the Enterprise. STREAM s flexibility in this area allows multiple risk types to be managed in the same database so, for example, information risk management can be integrated with: supply chain risk management; business continuity; privacy, and; enterprise risk management. Residual Risk Calculation As any contributory factor to residual risk assessment is changed, STREAM automatically recalculates residual risk and compares it against risk thresholds. Risk appetites can optionally be set in STREAM allowing residual risk to be reported in relation to risk appetite. STREAM automatically logs previous assessments so users can view history and trends. For frequently changing factors, such as patch or anti-virus status, key control indicators for these factors can be defined and the data imported automatically from third party applications (such as scanners and anti-virus systems) allowing the residual risk status to be updated in real time. Monitoring and Reporting STREAM provides an extensive set of graphical dashboards and reports providing easy, on-demand, visibility of risk and compliance status. Subject to user management permissions, users can aggregate up for summary views or drill down for more information. Reports draw real-time views from the database which is continually updated as factors change, ensuring that the user can always see the current status. Historical reports also allow the user to review progress and perform trend analysis. Conclusion ISF Members have long-recognised the importance of information risk management and the value of accurate information on risk and compliance status. IRAM is an excellent tool for risk analysis with a particularly strong BIA component which identifies information security requirements. However, to provide important information on residual risk Page 6 of 7
status in a centralised, aggregated manner, it needs to be combined with a tool that can calculate residual risk status and provide strong risk monitoring and reporting capabilities. STREAM provides these capabilities and also additional features not provided with IRAM such as Incident / Near-misses and Action Management. STREAM is configurable with ISF content and will therefore integrate seamlessly with IRAM. Finally, STREAM s multi-user capability with workflow and alerting will allow Members to extend controlled information risk management processes out from specialised, trained risk analysts to the wider user-base, including control owners, incident owners, action owners and auditors. Business managers can use STREAM s dashboards and reports to see at a glance real-time views of their residual risk and compliance status, identifying areas of concern for investigation. Contact Information Jason Creasey Director Simon Marvell Partner jason.creasey@jerakano.com www.jerakano.com +44 (0) 1483 838098 +44 (0) 7713 257282 simon.marvell@acuityrm.com www.acuityrm.com +44 (0) 20 7297 2086 +44 (0) 7900 246371 Relationship between Acuity and Jerakano STREAM Integrated Risk Manager from Acuity Risk Management provides flexible, easy to use and cost effective automation for managing risk and compliance to both ISF members and nonmembers alike. www.acuityrm.com As a Certified Consulting Partner, Jerakano can help you automate the ISF Standard of Good Practice and other ISF deliverables such as IRAM, Security Healthcheck, Benchmarking and Securing the Supply Chain using STREAM Integrated Risk Manager. Page 7 of 7