ISO27001 Risk Assessment Methodology

Question

I'm in the process of defining a risk assessment methodology for a company that would like to be aligned with ISO 27001. The standard states clearly that the aim is the protection of CIA (confidentiality, integrity, availability).

Do I have in my risk methodology to give scores for the consequences for each asset/process compared to confidentiality, integrity and availability separately or is it enough to give a single score for each asset/process. In most of the approved tools I have the treat it a single score for the consequences.

Is NOT scoring the consequences independently for each of CIA the right approach?

Answer 1

No you do not need to rate each control area on C.I. & A. One score for the overall state of the control item in the organization is sufficient. A single score in each area also reduces confusion. Ultimately, the decision on how the assessment will be conducted is part of the clause in 6.1.2. See below for additional info.

There are many myths regarding what the risk assessment should look like, but in reality ISO 27001:2013 requirements are not very difficult – here is what clause 6.1.2 requires:

1) Define how to identify the risks that could cause the loss of confidentiality, integrity and/or availability of your information

2) Define how to identify the risk owners

3) Define criteria for assessing consequences and assessing the likelihood of the risk

4) Define how the risk will be calculated

5) Define criteria for accepting risks

So essentially, you need to define these 5 elements – anything less won’t be enough, but more importantly – anything more is not needed, which means: don’t complicate things too much.

SOURCE Note: I wouldn't consider this guy definitive but he sums up what I would have said pretty well.

Answer 2

I'm not too familiar with ISO 27001 but I know how the CISSP authors think about this. They suggest qualitative and quantitative methods for risk assessment. Outcome is a priority list and (I believe) a monetary value for each asset. CIA doesn't play a big role in this equation (according to CISSP) and I think that is correct, as the following example demonstrates:

Let's say the vulnerability is the fact that employees are prone to social engineering attacks and the threat is ransomware. Let's further assume that HR people are the ones most exposed to this. Analysis shows that if ransomware would encrypt the local box, not spread on file servers and you have backups of the local machines. You quantify the restore effort at sum X and the loss of work from the last backup point until the point in time the attack happened is said to by Y in average. Then the single loss expectancy is (X + Y) * #(HR employees) * (probability this happens). None of the CIA is really affected (your HR department remains operational) but you have a pretty good figure of the risk in monetary terms.

Disclaimer: I'm of course simplifying, I left out qualitative considerations, threats to technical/operations departments asf but I think you get my point.