Chapter 15
Risk Management
The first 14 chapters of this book dealt with the sort of deep-in-the-details technical work that fills the days of most cybersecurity analysts. These are the activities that we engage in regularly to identify and address threats and vulnerabilities, implement and maintain secure systems, monitor the status of our cybersecurity efforts, and respond to incidents when they occur. We now shift gears to look at the big picture of cybersecurity in a large organization. How do we evaluate and manage risks to ensure that we're spending our limited time and money on the controls that will have the greatest effect? That's where risk management comes into play.
Analyzing Risk
We operate in a world full of risks. If you left your home and drove to your office this morning, you encountered a large number of risks. You could have been involved in an automobile accident, encountered a train delay, been struck by a bicycle on the sidewalk, or even contracted a dangerous virus from another rider in an elevator. We're aware of these risks in the back of our minds, but we don't let them paralyze us. Instead, we take simple precautions to help manage the risks that we think have the greatest potential to disrupt our lives.
In an enterprise risk management (ERM) program, organizations take a formal approach to risk analysis that begins with identifying risks, continues with determining the severity of each risk, and then results in adopting one or more risk management strategies to address each risk.
Before we move too deeply into the risk assessment process, let's define a few important terms that we'll use during our discussion:
- Threats are any possible events that might have an adverse impact on the confidentiality, integrity, and/or availability of our information or information systems.
- Vulnerabilities are weaknesses in our systems or controls that could be exploited by a threat.
- Risks occur at the intersection of a vulnerability and a threat that might exploit that vulnerability. A threat without a corresponding vulnerability does not pose a risk, nor does a vulnerability without a corresponding threat.
Figure 15.1 illustrates this relationship between threats, vulnerabilities, and risks.
Consider the example from earlier of walking down the sidewalk on your way to work. The fact that you are on the sidewalk without any protection is a vulnerability. A bicycle speeding down that sidewalk is a threat. The result of this combination of factors is that you are at risk of being hit by the bicycle on the sidewalk. If you remove the vulnerability by parking in a garage beneath your building, you are no longer at risk for that particular threat. Similarly, if the city erects barriers that prevent bicycles from entering the sidewalk, you are also no longer at risk.
FIGURE 15.1 Risk exists at the intersection of a threat and a corresponding vulnerability.
Let's consider another example drawn from the cybersecurity domain. In Chapters 4 and 5, you learned about the vulnerability management process. Organizations regularly conduct vulnerability scans designed to identify potential vulnerabilities in their environment. One of these scans might identify a server that exposes TCP port 22 to the world, allowing brute-force SSH attempts by an attacker. Exposing port 22 presents a vulnerability to a brute-force attack. An attacker with a brute-force scanning tool presents a threat. The combination of the port exposure and the existence of attackers presents a risk.
In this case, you don't have any way to eliminate attackers, so you can't really address the threat, but you do have control over the services running on your systems. If you shut down the SSH service and close port 22, you eliminate the vulnerability and, therefore, also eliminate the risk.
Of course, we can't always completely eliminate a risk because it isn't always feasible to shut down services. We might decide instead to take actions that reduce the risk. We'll talk more about those options when we get to risk management strategies later in this chapter.
Risk Identification
The risk identification process requires identifying the threats and vulnerabilities that exist in your operating environment. We've already covered the many ways that you might conduct risk identification in this book; we just haven't put them together in the big picture frame of risk management.
Chapters 2 and 3 discussed the concepts of threat intelligence. You learned how you can leverage internal and external information sources to identify the many threats facing your organization.
Chapters 4 and 5 discussed the concepts of vulnerability management. You learned how you can create a vulnerability management program for your organization and how you can automate portions of that program through routine vulnerability scans. Chapters 7 through 9 covered the concept of software and systems security, providing you with the information you need to conduct systems assessments that supplement vulnerability scanning results.
There's not much more to the risk identification process. You may already be conducting all the technical activities that you need to identify risks. Now you just need to pull that information together and develop a comprehensive list of threats, vulnerabilities, and risks.
Risk Calculation
Not all risks are equal. Returning to the example of a pedestrian on the street, the risk of being hit by a bicycle is far more worrisome than the risk of being struck down by a meteor. That makes intuitive sense, but let's explore the underlying thought process that leads to that conclusion. It's a process called risk calculation.
When we evaluate any risk, we do so by using two different factors:
- The probability, or likelihood, that the risk will occur. We might express this as the percent chance that a threat will exploit a vulnerability over a specified period of time, such as within the next year.
- The magnitude, or impact, that the risk will have on the organization if it does occur. We might express this as the financial cost that we will incur as the result of a risk, although there are other possible measures.
Using these two factors, we can assign each risk a conceptual score by combining the probability and the magnitude. This leads many risk analysts to express the severity of a risk using this formula:
It's important to point out that this equation does not always have to be interpreted literally. Although you may wind up multiplying these values together in some risk assessment processes, it's best to think of this conceptually as combining the magnitude and impact to determine the severity of a risk.
When we assess the risks of being struck by a bicycle or a meteor on the street, we can use these factors to evaluate the risk severity. There might be a high probability that we will be struck by a bicycle. That type of accident might have a moderate magnitude, leaving us willing to consider taking steps to reduce our risk. Being struck by a meteor would clearly have a catastrophic magnitude of impact, but the probability of such an incident is incredibly unlikely, leading us to acknowledge the risk and move on without changing our behavior.
Business Impact Analysis
The business impact analysis (BIA) is a formalized approach to risk prioritization that allows organizations to conduct their reviews in a structured manner. BIAs follow two different analysis methodologies:
- Quantitative risk assessments use numeric data in the analysis, resulting in assessments that allow the very straightforward prioritization of risks.
- Qualitative risk assessments substitute subjective judgments and categories for strict numerical analysis, allowing the assessment of risks that are difficult to quantify.
As organizations seek to provide clear communication of risk factors to stakeholders, they often combine elements of quantitative and qualitative risk assessments. Let's review each of these approaches.
Quantitative Risk Assessment
Most quantitative risk assessment processes follow a similar methodology that includes the following steps:
- Determine the asset value (AV) of the asset affected by the risk. This asset value (AV) is expressed in dollars, or other currency, and may be determined using the cost to acquire the asset, the cost to replace the asset, or the depreciated cost of the asset, depending on the organization's preferences.
- Determine the likelihood that the risk will occur. Risk analysts consult subject matter experts and determine the likelihood that a risk will occur in a given year. This is expressed as the number of times the risk is expected each year, and is described as the annualized rate of occurrence (ARO). A risk that is expected to occur twice a year has an ARO of 2.0, whereas a risk that is expected once every one hundred years has an ARO of 0.01.
- Determine the amount of damage that will occur to the asset if the risk materializes. This is known as the exposure factor (EF) and is expressed as the percentage of the asset expected to be damaged. The exposure factor of a risk that would completely destroy an asset is 100 percent, whereas a risk that would damage half of an asset has an EF of 50 percent.
- Calculate the single loss expectancy. The single loss expectancy (SLE) is the amount of financial damage expected each time a risk materializes. It is calculated by multiplying the AV by the EF.
- Calculate the annualized loss expectancy. The annualized loss expectancy (ALE) is the amount of damage expected from a risk each year. It is calculated by multiplying the SLE and the ARO.
It's important to note that these steps assess the quantitative scale of a single risk—that is, one combination of a threat and a vulnerability. Organizations conducting quantitative risk assessments would repeat this process for each threat/vulnerability combination.
Let's walk through an example of a quantitative risk assessment. Imagine that you are concerned about the risk associated with a denial-of-service (DoS) attack against your email server. Your organization uses that server to send email messages to customers offering products for sale. It generates $1,000 in sales per hour that it is in operation. After consulting threat intelligence sources, you believe that a DoS attack is likely to occur three times a year and last for three hours before you are able to control it.
The asset in this case is not the server itself, because the server will not be physically damaged. The asset is the ability to send email and you have already determined that it is worth $1,000 per hour. The asset value for three hours of server operation is, therefore, $3,000.
Your threat intelligence estimates that the risk will occur three times per year, making your annualized rate of occurrence 3.0.
After consulting your email team, you believe that the server would operate at 10 percent capacity during a DoS attack, as some legitimate messages would get out. Therefore, your exposure factor is 90 percent, because 90 percent of the capacity would be consumed by the attack.
Your single loss expectancy is calculated by multiplying the asset value ($3,000) by the exposure factor (90 percent) to get the expected loss during each attack. This gives you an SLE of $27,000.
Your annualized loss expectancy is the product of the SLE ($27,000) and the ARO (3.0), or $81,000.
Organizations can use the ALEs that result from a quantitative risk assessment to prioritize their remediation activities and determine the appropriate level of investment in controls that mitigate risks. For example, it would not normally make sense (at least in a strictly financial sense) to spend more than the ALE on an annual basis to protect against a risk. In the previous example, if a DoS prevention service would block all of those attacks, it would make financial sense to purchase it if the cost is less than $81,000 per year.
Qualitative Risk Assessment
Quantitative techniques work very well for evaluating financial risks and other risks that can be clearly expressed in numeric terms. Many risks, however, do not easily lend themselves to quantitative analysis. For example, how would you describe reputational damage, public health and safety, or employee morale in quantitative terms? You might be able to draw some inferences that tie these issues back to financial data, but the bottom line is that quantitative techniques simply aren't well suited to evaluating these risks.
Qualitative risk assessment techniques seek to overcome the limitations of quantitative techniques by substituting subjective judgment for objective data. Qualitative techniques still use the same probability and magnitude factors to evaluate the severity of a risk, but do so using subjective categories. For example, Figure 15.2 shows a simple qualitative risk assessment that evaluates the probability and magnitude of several risks on a subjective “Low/Medium/High” scale. Risks are placed on this chart based on the judgments made by subject matter experts.
FIGURE 15.2 Qualitative risk assessments use subjective rating scales to evaluate probability and magnitude.
Although it's not possible to directly calculate the financial impact of risks that are assessed using qualitative techniques, this risk assessment scale makes it possible to prioritize risks. For example, reviewing the risk assessment in Figure 15.2, we can determine that the greatest risks facing this organization are stolen unencrypted devices and spear phishing attacks. Both of these risks share a high probability and high magnitude of impact. If we're considering using funds to add better physical security to the datacenter, this risk assessment informs us that our time and money would likely be better spent on full-disk encryption for mobile devices and a secure email gateway.
Managing Risk
With a completed risk assessment in hand, organizations can then turn their attention to addressing those risks. Risk management is the process of systematically addressing the risks facing an organization. The risk assessment serves two important roles in the risk management process:
- The risk assessment provides guidance in prioritizing risks so that the risks with the highest probability and magnitude are addressed first.
- Quantitative risk assessments help determine whether the potential impact of a risk justifies the costs incurred by adopting a risk management approach.
Risk managers should work their way through the risk assessment and identify an appropriate management strategy for each risk included in the assessment. They have four strategies to choose from: risk mitigation, risk avoidance, risk transference, and risk acceptance. In the next several sections, we discuss each of these strategies using two examples.
First, we discuss the financial risk associated with the theft of a laptop from an employee. In this example, we are assuming that the laptop does not contain any unencrypted sensitive information. The risk that we are managing is the financial impact of losing the actual hardware.
Second, we discuss the business risk associated with a distributed denial-of-service (DDoS) attack against an organization's website.
We use these two scenarios to help you understand the different options available when selecting a risk management strategy and the trade-offs involved in that selection process.
Risk Mitigation
Risk mitigation is the process of applying security controls to reduce the probability and/or magnitude of a risk. Risk mitigation is the most common risk management strategy, and the vast majority of the work of security professionals revolves around mitigating risks through the design, implementation, and management of security controls. Many of these controls involve engineering trade-offs between functionality, performance, and security. We'll discuss some examples of security controls later in this chapter and take a more in-depth look at the categories and types of controls in Chapter 16, “Policy and Compliance.”
When you choose to mitigate a risk, you may apply one security control or a series of security controls. Each of those controls should reduce the probability that the risk will materialize, the magnitude of the risk should it materialize, or both the probability and magnitude.
In our first scenario, we are concerned about the theft of laptops from our organization. If we want to mitigate that risk, we could choose from a variety of security controls. For example, purchasing cable locks for laptops might reduce the probability that a theft will occur.
We could also choose to purchase a device registration service that provides tamperproof registration tags for devices, such as the STOP tags shown in Figure 15.3. These tags provide a prominent warning to potential thieves when attached to a device, as shown in Figure 15.3(a). This serves as a deterrent to theft, reducing the probability that the laptop will be stolen in the first place. If a thief does steal the device and removes the tag, it leaves the permanent residue, shown in Figure 15.3(b). Anyone finding the device is instructed to contact the registration vendor for instructions, reducing the potential impact of the theft if the device is returned.
In our second scenario, a DDoS attack against an organization's website, we could choose among several mitigating controls. For example, we could simply purchase more bandwidth and server capacity, allowing us to absorb the bombardment of a DDoS attack, thus reducing the impact of an attack. We could also choose to purchase a third-party DDoS mitigation service that prevents the traffic from reaching our network in the first place, thus reducing the probability of an attack.
Risk Avoidance
Risk avoidance is a risk management strategy where we change our business practices to completely eliminate the potential that a risk will materialize. Risk avoidance may initially seem like a highly desirable approach. After all, who wouldn't want to eliminate the risks facing their organization? There is, however, a major drawback. Risk avoidance strategies typically have a serious detrimental impact on the business.
FIGURE 15.3 (a) STOP tag attached to a device (b) Residue remaining on device after attempted removal of a STOP tag
For example, consider the laptop theft risk discussed earlier in this chapter. We could adopt a risk avoidance strategy and completely eliminate the risk by not allowing employees to purchase or use laptops. This approach is unwieldy and would likely be met with strong opposition from employees and managers due to the negative impact on employee productivity.
Similarly, we could avoid the risk of a DDoS attack against the organization's website by simply shutting down the website. If there is no website to attack, there's no risk that a DDoS attack can affect the site. But it's highly improbable that business leaders will accept shutting down the website as a viable approach. In fact, you might consider being driven to shut down your website to avoid DDoS attacks as the ultimate denial of service attack!
Risk Transference
Risk transference shifts some of the impact of a risk from the organization experiencing the risk to another entity. The most common example of risk transference is purchasing an insurance policy that covers a risk. When purchasing insurance, the customer pays a premium to the insurance carrier. In exchange, the insurance carrier agrees to cover losses from risks specified in the policy.
In the example of laptop theft, property insurance policies may cover the risk. If an employee's laptop is stolen, the insurance policy would provide funds to cover either the value of the stolen device or the cost to replace the device, depending on the type of coverage.
It's unlikely that a property insurance policy would cover a DDoS attack. In fact, many general business policies exclude all cybersecurity risks. An organization seeking insurance coverage against this type of attack should purchase cybersecurity insurance, either as a separate policy or as a rider on an existing business insurance policy. This coverage would repay some or all of the cost of recovering operations and may also cover lost revenue during an attack.
Risk Acceptance
Risk acceptance is the final risk management strategy and it boils down to deliberately choosing to take no other risk management strategy and to simply continue operations as normal in the face of the risk. A risk acceptance approach may be warranted if the cost of mitigating a risk is greater than the impact of the risk itself.
In our laptop theft example, we might decide that none of the other risk management strategies are appropriate. For example, we might feel that the use of cable locks is an unnecessary burden and that theft recovery tags are unlikely to work, leaving us without a viable risk mitigation strategy. Business leaders might require that employees have laptop devices, taking risk avoidance off the table. And the cost of a laptop insurance policy might be too high to justify. In that case, we might decide that we will simply accept the risk and cover the cost of stolen devices when thefts occur. That's risk acceptance.
In the case of the DDoS risk, we might go through a similar analysis and decide that risk mitigation and transference strategies are too costly. In the event we continue to operate the site, we might do so accepting the risk that a DDoS attack could take the site down.
Security Controls
Security controls are designed to mitigate one or more risks facing an organization by reducing the probability and/or magnitude of that risk. Throughout this book, you've already read about a large number of security controls.
In this chapter, we're grouping security controls into the broad categories of technical and nontechnical controls. In Chapter 16, we present a more formal framework that groups security controls into three categories (managerial, operational, and technical) and six types (preventive, detective, corrective, deterrent, compensating, and physical).
Nontechnical Controls
Most of this book focused on technical controls, ranging from vulnerability management and threat assessment to software and systems security. Technical topics do make up the vast majority of the CySA+ exam objectives, but it's important to remember that there are also nontechnical controls that we can use to mitigate the risks facing our organizations.
Data Ownership
One of the most important things that we can do to protect our data is to create clear data ownership policies and procedures. Using this approach, the organization designates specific senior executives as the data owners for different data types. For example, the vice president of Human Resources might be the data owner for employment and payroll data, whereas the vice president for Sales might be the data owner for customer information.
Clear lines of data ownership place responsibility for data in the hands of executives who best understand the impact of decisions about that data on the business. They don't make all of these decisions in isolation, however. Data owners delegate some of their responsibilities to others in the organization and also rely on advice from subject matter experts, such as cybersecurity analysts and data protection specialists.
Information Classification
Information classification programs organize data into categories based on the sensitivity of the information and the impact on the organization should the information be inadvertently disclosed. For example, the U.S. government uses the following four major classification categories:
- Top Secret information requires the highest degree of protection. The unauthorized disclosure of Top Secret information could reasonably be expected to cause exceptionally grave damage to national security.
- Secret information requires a substantial degree of protection. The unauthorized disclosure of Secret information could reasonably be expected to cause serious damage to national security.
- Confidential information requires some protection. The unauthorized disclosure of Confidential information could reasonably be expected to cause identifiable damage to national security.
- Unclassified information is information that does not meet the standards for classification under the other categories. Information in this category is still not publicly releasable without authorization.
Businesses generally don't use the same terminology for their levels of classified information. Instead, they might use friendlier terms, such as Highly Sensitive, Sensitive, Internal, and Public.
Data classification allows organizations to clearly specify the security controls required to protect information with different levels of sensitivity. For example, the U.S. government requires the use of brightly colored cover sheets, such as those shown in Figure 15.4, to identify classified information in printed form.
FIGURE 15.4 Cover sheets used to identify classified U.S. government information
Data Life Cycle
Data protection should continue at all stages of the data life cycle, from the time the data is originally collected until the time it is eventually disposed.
At the early stages of the data life cycle, organizations should practice data minimization, where they collect the smallest possible amount of information necessary to meet their business requirements. Information that is not necessary should either be immediately discarded or, better yet, not collected in the first place.
While information remains within the care of the organization, the organization should practice purpose limitation. This means that information should only be used for the purpose that it was originally collected and that was consented to by the data subjects.
Finally, the organization should implement data retention standards that guide the end of the data life cycle. Data should only be kept for as long as it remains necessary to fulfill the purpose for which it was originally collected. At the conclusion of its life cycle, data should be securely destroyed.
Compliance Requirements
You may also implement nontechnical controls to satisfy legal requirements facing your organization. We'll discuss some of those specific requirements in Chapter 16, but there are two specific controls that CompTIA recommends in this category for data protection initiatives.
Data Sovereignty
Whether an organization builds their own infrastructure or relies on cloud service providers, they commonly distribute customer data across geographically distant data centers to mitigate the risk of an infrastructure failure. If one datacenter experiences a major operational issue, datacenters located in other regions automatically take over processing requirements.
This geographic distribution of data does introduce an important concern. The principle of data sovereignty says that data is subject to the legal restrictions of any jurisdiction where it is collected, stored, or processed.
Think about the impact here. If a company in the United States collects information from a U.S. citizen and stores it in a U.S. datacenter, that data is very clearly subject to U.S. law and immune from European Union (EU) law. If the EU tried to assert authority over that data under the General Data Protection Regulation (GDPR), the case would be thrown out of court because the EU regulators have no jurisdiction. However, if the U.S. company backs up their data to an alternate datacenter in Italy, suddenly the distinction is less clear. What laws now apply to the data?
Data sovereignty says that both EU and U.S. laws would apply and that could cause serious issues for the company. They were only attempting to protect the availability of their data in the event of a disaster, and they wound up subject to a whole new compliance regime.
Security professionals should pay careful attention to data sovereignty issues and take action to protect their organization against unwanted regulatory burdens:
- Before deploying any new service, determine where data will be stored and the regulatory implications of that storage.
- Ask cloud providers to specify the locations where data will be stored in writing and require that they provide advance notice before moving data into any new jurisdiction.
- Use encryption to protect data against prying eyes. If a foreign government demands that a cloud provider give them access to your data, they won't be able to read it if you hold the decryption key.
Nondisclosure Agreements
Nondisclosure agreements (NDAs) also play an important role in supporting compliance obligations. When an organization handles sensitive data, it should require that all employees working with that data sign NDAs that prohibit them from sharing that information with unauthorized individuals. NDAs contain language and penalties that survive the employment relationship, meaning that they continue to remain in force even after the employee leaves the organization.
Training and Exercises
Organizations conduct a wide variety of training programs designed to help employees understand their cybersecurity role. Cybersecurity analysts often participate in training programs that are set up as exercises using a competition-style format, pitting a team of attackers against a team of defenders.
Running exercises helps to identify vulnerabilities in the organization's systems, networks, and applications, similar to the results achieved from penetration testing. Exercises also provide employees with hands-on experience both attacking and defending systems. This helps boost cybersecurity skills and awareness among the technical staff.
When conducting an exercise, participants are often divided into three teams:
- Red team members are the attackers who attempt to gain access to systems.
- Blue team members are the defenders who must secure systems and networks from attack. The blue team also monitors the environment during the exercise, conducting active defense techniques. The blue team commonly gets a head start with some time to secure systems before the attack phase of the exercise begins.
- White team members are the observers and judges. They serve as referees to settle disputes over the rules and watch the exercise to document lessons learned from the test. The white team is able to observe the activities of both the red and blue teams and is also responsible for ensuring that the exercise does not cause production issues.
Capture the flag (CTF) exercises are a fun way to achieve training objectives. In a CTF exercise, the red team begins with set objectives, such as disrupting a website, stealing a file from a secured system, or causing other security failures. The exercise is scored based on how many objectives the red team was able to achieve compared to how many the blue team prevented them from executing.
Exercises don't need to take place using production systems. In many cases, an organization might set up a special environment solely for the purpose of the exercise. This provides a safe playground for the test and minimizes the probability that an attack will damage production systems. Other exercises may not even use real systems at all. Tabletop exercises simply gather participants in the same room to walk through their response to a fictitious exercise scenario.
Technical Controls
Throughout this book, you learned about many of the technical controls used to mitigate security risks. In this section, we recap some of the specific security controls that CompTIA advocates for using to protect data from prying eyes.
Encryption
Encryption technology uses mathematical algorithms to protect information from prying eyes, both while it is in transit over a network and while it resides on systems. Encrypted data is unintelligible to anyone who does not have access to the appropriate decryption key, making it safe to store and transmit encrypted data over otherwise insecure means.
Data Loss Prevention
Data loss prevention (DLP) systems help organizations enforce information handling policies and procedures to prevent data loss and theft. They search systems for stores of sensitive information that might be unsecured and monitor network traffic for potential attempts to remove sensitive information from the organization. They can act quickly to block the transmission before damage is done and alert administrators to the attempted breach.
DLP systems work in two different environments:
- Host-based DLP
- Network-based DLP
Host-based DLP uses software agents installed on systems that search those systems for the presence of sensitive information. These searches often turn up Social Security Numbers, credit card numbers, and other sensitive information in the most unlikely places!
Detecting the presence of stored sensitive information allows security professionals to take prompt action to either remove it or secure it with encryption. Taking the time to secure or remove information now may pay handsome rewards down the road if the device is lost, stolen, or compromised.
Host-based DLP can also monitor system configuration and user actions, blocking undesirable actions. For example, some organizations use host-based DLP to block users from accessing USB-based removable media devices that they might use to carry information out of the organization's secure environment.
Network-based DLP systems are dedicated devices that sit on the network and monitor outbound network traffic, watching for any transmissions that contain unencrypted sensitive information. They can then block those transmissions, preventing the unsecured loss of sensitive information.
DLP systems may simply block traffic that violates the organization's policy or, in some cases, they may automatically apply encryption to the content. This automatic encryption is commonly used with DLP systems that focus on email.
DLP systems also have two mechanisms of action:
- Pattern matching, where they watch for the telltale signs of sensitive information. For example, if they see a number that is formatted like a credit card or Social Security Number, they can automatically trigger on that. Similarly, they may contain a database of sensitive terms, such as “Top Secret” or “Business Confidential” and trigger when they see those terms in a transmission.
- Watermarking, where systems or administrators apply electronic tags to sensitive documents and then the DLP system can monitor systems and networks for unencrypted content containing those tags.
Watermarking technology is also commonly used in digital rights management (DRM) solutions that enforce copyright and data ownership restrictions.
Data Minimization
If we can't completely remove data from a dataset, we can often transform it into a format where the original sensitive information is deidentified. The deidentification process removes the ability to link data back to an individual, reducing its sensitivity.
An alternative to deidentifying data is transforming it into a format where the original information can't be retrieved. This is a process called data obfuscation and we have several tools at our disposal to assist with it:
- Hashing uses a hash function to transform a value in our dataset to a corresponding hash value. If we apply a strong hash function to a data element, we may replace the value in our file with the hashed value.
- Tokenization replaces sensitive values with a unique identifier using a lookup table. For example, we might replace a widely known value, such as a student ID, with a randomly generated 10-digit number. We'd then maintain a lookup table that allows us to convert those back to student IDs if we need to determine someone's identity. Of course, if you use this approach, you need to keep the lookup table secure!
- Masking partially redacts sensitive information by replacing some or all of sensitive fields with blank characters. For example, we might replace all but the last four digits of a credit card number with X's or *'s to render the card number unreadable.
Although it isn't possible to retrieve the original value directly from the hashed value, there is one major flaw to this approach. If someone has a list of possible values for a field, they can conduct something called a rainbow table attack. In this attack, the attacker computes the hashes of those candidate values and then checks to see if those hashes exist in our data file.
For example, imagine that we have a file listing all the students at our college who have failed courses but we hash their student IDs. If an attacker has a list of all students, they can compute the hash values of all student IDs and then check to see which hash values are on the list. For this reason, hashing should only be used with caution.
Access Controls
Organizations may also leverage their existing access control systems to provide enhanced protection for sensitive information, such as by implementing geographic access requirements that limit access by authorized user to certain locations, such as from within the office. You'll find more coverage of this topic in the “Context-Based Authentication” section of Chapter 8, “Identity and Access Management Security.”
Summary
Cybersecurity efforts are all about risk management. In this chapter, you learned about the techniques that cybersecurity analysts use to identify, assess, and manage a wide variety of risks. You learned about the differences between risk mitigation, risk avoidance, risk transference, and risk acceptance and when it is appropriate to use each. You also explored the different types of security controls that organizations can use to mitigate risks. In the next chapter, we continue this discussion and wrap up your preparation for the CySA+ exam with a look at policy and compliance issues.
Exam Essentials
Explain how risk identification and assessment helps organizations prioritize cybersecurity efforts. Cybersecurity analysts seek to identify all the risks facing their organization and then conduct a business impact analysis to assess the potential degree of risk based on the probability that it will occur and the magnitude of the potential effect on the organization. This work allows security professionals to prioritize risks and communicate risk factors to others in the organization.
Know that vendors are a source of external risk. Organizations should conduct their own systems assessments as part of their risk assessment practices, but they should conduct supply chain assessments as well. Performing vendor due diligence reduces the likelihood that a previously unidentified risk at a vendor will negatively impact the organization. Hardware source authenticity techniques verify that hardware was not tampered with after leaving the vendor's premises.
Describe a variety of risk management strategies. Risk avoidance strategies change business practices to eliminate a risk. Risk mitigation techniques seek to reduce the probability or magnitude of a risk. Risk transference approaches move some of the risk to a third party. Risk acceptance acknowledges the risk and continues normal business operations despite the presence of the risk.
Know that exercises play a crucial role in an organization's training program. Exercises may take place in a tabletop manner or may use real-world techniques. Live action exercises use blue teams to defend the network and red teams to attack those defenses. White teams serve as referees and neutral arbiters during the exercise.
Describe how security controls mitigate risks. Organizations implementing security controls often make engineering trade-offs as they seek to balance security and operational concerns. They may choose to implement nontechnical controls, including data ownership, classification, and retention policies. They may also adopt technical controls, including the use of encryption, data loss prevention, digital rights management, access controls, masking, deidentification, and tokenization.
Lab Exercises
Activity 15.1: Risk Management Strategies
- On the next page, match the following risk management strategies with their descriptions.
| Risk avoidance | Choosing to continue operations as normal despite the potential risk |
| Risk transference | Changing business activities to eliminate a risk |
| Risk mitigation | Shifting the impact of a risk to another organization |
| Risk acceptance | Implementing security controls that reduce the probability and/or magnitude of a risk |
Activity 15.2: Risk Identification and Assessment
For this exercise, use your own organization. If you are not currently employed, you may use your school or another organization that you are familiar with.
Think of a business process that is critical to your organization's continued existence. Identify all the risks to the continued operation of that business process. Then choose one of those risks and conduct a quantitative or qualitative risk assessment of that risk.
Activity 15.3: Risk Management
Take the risk assessment that you developed in Activity 15.2. Identify at least one way that you could use each of the following risk management strategies to address that risk:
- Risk mitigation
- Risk avoidance
- Risk acceptance
- Risk transference
Which of these strategies do you feel is most appropriate for your scenario? Why? Feel free to choose more than one strategy if you believe it is the best way to manage the risk.
Review Questions
- Jen identified a missing patch on a Windows server that might allow an attacker to gain remote control of the system. After consulting with her manager, she applied the patch. From a risk management perspective, what has she done?
- Removed the threat
- Reduced the threat
- Removed the vulnerability
- Reduced the vulnerability
- You notice a high number of SQL injection attacks against a web application run by your organization, and you install a web application firewall to block many of these attacks before they reach the server. How have you altered the severity of this risk?
- Reduced the magnitude
- Eliminated the vulnerability
- Reduced the probability
- Eliminated the threat
Questions 3–7 refer to the following scenario: Aziz is responsible for the administration of an e-commerce website that generates $100,000 per day in revenue for his firm. The website uses a database that contains sensitive information about the firm's customers. He expects that a compromise of that database would result in $500,000 in fines against his firm.
Aziz is assessing the risk of a SQL injection attack against the database where the attacker would steal all of the customer personally identifiable information (PII) from the database. After consulting threat intelligence, he believes that there is a 5 percent chance of a successful attack in any given year.
- What is the asset value (AV)?
- $5,000
- $100,000
- $500,000
- $600,000
- What is the exposure factor (EF)?
- 5 percent
- 20 percent
- 50 percent
- 100 percent
- What is the single loss expectancy (SLE)?
- $5,000
- $100,000
- $500,000
- $600,000
- What is the annualized rate of occurrence (ARO)?
- 0.05
- 0.20
- 2.00
- 5.00
- What is the annualized loss expectancy (ALE)?
- $5,000
- $25,000
- $100,000
- $500,000
Questions 8–11 refer to the following scenario: Grace recently completed a risk assessment of her organization's exposure to data breaches and determined that there is a high level of risk related to the loss of sensitive personal information. She is considering a variety of approaches to managing this risk.
- Grace's first idea is to add a web application firewall to protect her organization against SQL injection attacks. What risk management strategy does this approach adopt?
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transference
- Business leaders are considering dropping the customer activities that collect and store sensitive personal information. What risk management strategy would this approach use?
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transference
- The business decided to install the web application firewall and continue doing business. They still were worried about other risks to the information that were not addressed by the firewall and considered purchasing an insurance policy to cover those risks. What strategy does this use?
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transference
- In the end, risk managers found that the insurance policy was too expensive and opted not to purchase it. They are taking no additional action. What risk management strategy is being used in this situation?
- Risk acceptance
- Risk avoidance
- Risk mitigation
- Risk transference
- Which one of the following U.S. government classification levels requires the highest degree of security control?
- Secret
- Confidential
- Top Secret
- Unclassified
- Asa believes that her organization is taking data collected from customers for technical support and using it for marketing without their permission. What principle is most likely being violated?
- Data minimization
- Data retention
- Purpose limitation
- Data sovereignty
- A U.S. company stores data in an EU data center and finds that it is now subject to the requirements of GDPR. This is an example of __________.
- Data minimization
- Data retention
- Purpose limitation
- Data sovereignty
Questions 15–17 refer to the following scenario: Golden Dome Enterprises is conducting a cybersecurity exercise designed to test the effectiveness of its security controls. Participants have been divided into different teams to perform different functions. The team led by Ed is responsible for facilitating the exercise and arbitrating rules disputes. Barb's team is responsible for securing the systems in the exercise environment and defending them against attacks. Sofia's team is conducting offensive operations and attempting to break into the systems protected by Barb's team.
- What term best describes the role that Sofia's team is playing in the exercise?
- Black team
- White team
- Red team
- Blue team
- What term best describes the role that Ed's team is playing in the exercise?
- Black team
- White team
- Red team
- Blue team
- What term best describes the role that Barb's team is playing in the exercise?
- Black team
- White team
- Red team
- Blue team
- Which one of the following data protection techniques is reversible when conducted properly?
- Tokenization
- Masking
- Hashing
- Shredding
- What security control can be used to clearly communicate to users the level of protection required for different data types?
- Classification policies
- Retention standards
- Life cycle practices
- Confidentiality controls
- Alfonso is concerned that users might leave his organization and then share sensitive information that they retained with future employers. What security control would best protect against this risk?
- IPS
- DRM
- DLP
- NDA