4

Following on from the post regarding risks assessments and critical assets, how are assets assessed for criticality be it infrastructure, processes, people (possibly), etc?

If using the security triad of confidentiality, integrity and availability, are these the only factors that define criticality?

How does one calculate the cost of the associated risks? For example, if the business deems a given set of assets as high across the entire triad, how does one determine the impact, costs and risks?

  • Depends on your organization. CIA is a beginning but there are other assets - reputation, business function, etc. Most risk management guides suggest that you establish the asset categories early in the process (confusingly, they call them "categories") – Mark C. Wallace Jan 22 '16 at 19:53
  • @Mark C. Wallace - Thanks. Is there a starting list i can leverage? Secondly, if i needed the ability to cycle through these quickly to ascertain criticality, what's the best way since every project is now deemed "agile" and security is seen as slowing down the "agility"? I would like to be able to manage the perception and process but deliver the risk profile to management as quickly as possible. – Motivated Jan 22 '16 at 20:14
  • @MarkC.Wallace - The post at bloginfosec.com/2010/08/23/… doesn't recommend the use of the formula Risk = Threat x Vulnerabilities however others in the post such as "Henry" suggest an approach which i believe will resonate with management. – Motivated Jan 22 '16 at 20:14
  • Nontrivial questions. I don't have a starting list - I argue against starting lists because selecting that list is a critical part of the process; risk management is about the discussion/process, not the goal. 2) Security is a non-functional requirement like all other nonfunctional requirements. If requirements impede your agility, then you are pursuing a dangerous path. – Mark C. Wallace Jan 22 '16 at 21:28
  • I'm not a huge fan of R=TxV - that formula generates more argument than solutions. Risk = (Likelihood x Impact )/control is better. Best is to collect data for a year and then figure out what formulas make sense. That isn't always practical, so I suggest that you concentrate on analyzing the risk and proposing mitigation. – Mark C. Wallace Jan 22 '16 at 21:30
5

If using the security triad of confidentiality, integrity and availability, are these the only factors that define criticality?

While the CIA triad is important to us as security professionals when defining various criteria, the business often defines severity levels based on $$$.

They ask questions (from a business perspective) such as:

  • What infrastructure / applications do we need in place to accept money from customers? (think POS systems)
  • What infrastructure / applications do we need in place to move money? (think wire/ACH systems)
  • How much money do we lose per day if XYZ application is not available?
  • Are there operations / processes that can be completed manually (paper, pen) until the systems are back online?

How does one calculate the cost of the associated risks? For example, if the business deems a given set of assets as high across the entire triad, how does one determine the impact, costs and risks?

This is where your quantitative and / or qualitative analysis comes into play from a risk perspective.

Below are a few good links that cover the formula in detail:

http://www.pearsonitcertification.com/articles/article.aspx?p=418007&seqNum=4

http://www.sans.edu/research/leadership-laboratory/article/risk-assessment

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.