4

Following on from the post regarding risks assessments and critical assets, how are assets assessed for criticality be it infrastructure, processes, people (possibly), etc?

If using the security triad of confidentiality, integrity and availability, are these the only factors that define criticality?

How does one calculate the cost of the associated risks? For example, if the business deems a given set of assets as high across the entire triad, how does one determine the impact, costs and risks?

Improve this question
7
  • Depends on your organization. CIA is a beginning but there are other assets - reputation, business function, etc. Most risk management guides suggest that you establish the asset categories early in the process (confusingly, they call them "categories")
    – MCW
    Jan 22, 2016 at 19:53
  • @Mark C. Wallace - Thanks. Is there a starting list i can leverage? Secondly, if i needed the ability to cycle through these quickly to ascertain criticality, what's the best way since every project is now deemed "agile" and security is seen as slowing down the "agility"? I would like to be able to manage the perception and process but deliver the risk profile to management as quickly as possible.
    – Motivated
    Jan 22, 2016 at 20:14
  • @MarkC.Wallace - The post at bloginfosec.com/2010/08/23/… doesn't recommend the use of the formula Risk = Threat x Vulnerabilities however others in the post such as "Henry" suggest an approach which i believe will resonate with management.
    – Motivated
    Jan 22, 2016 at 20:14
  • Nontrivial questions. I don't have a starting list - I argue against starting lists because selecting that list is a critical part of the process; risk management is about the discussion/process, not the goal. 2) Security is a non-functional requirement like all other nonfunctional requirements. If requirements impede your agility, then you are pursuing a dangerous path.
    – MCW
    Jan 22, 2016 at 21:28
  • I'm not a huge fan of R=TxV - that formula generates more argument than solutions. Risk = (Likelihood x Impact )/control is better. Best is to collect data for a year and then figure out what formulas make sense. That isn't always practical, so I suggest that you concentrate on analyzing the risk and proposing mitigation.
    – MCW
    Jan 22, 2016 at 21:30

1 Answer 1

Reset to default
5

If using the security triad of confidentiality, integrity and availability, are these the only factors that define criticality?

While the CIA triad is important to us as security professionals when defining various criteria, the business often defines severity levels based on $$$.

They ask questions (from a business perspective) such as:

  • What infrastructure / applications do we need in place to accept money from customers? (think POS systems)
  • What infrastructure / applications do we need in place to move money? (think wire/ACH systems)
  • How much money do we lose per day if XYZ application is not available?
  • Are there operations / processes that can be completed manually (paper, pen) until the systems are back online?

How does one calculate the cost of the associated risks? For example, if the business deems a given set of assets as high across the entire triad, how does one determine the impact, costs and risks?

This is where your quantitative and / or qualitative analysis comes into play from a risk perspective.

Below are a few good links that cover the formula in detail:

http://www.pearsonitcertification.com/articles/article.aspx?p=418007&seqNum=4

http://www.sans.edu/research/leadership-laboratory/article/risk-assessment

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .