1. Asset ID
2. Vulnerability ID
3. Threat Assessment
4. Probability quantification
5. Financial Impact Eval.
6. Countermeasures Determination

ID vulnerabilities/threat to assets; confirms asset protection problems.

Locating weaknesses that expose critical areas susceptible to vulnerabilities

ID/Development of countermeasures to threat

-must be ECONOMICAL

-must provide EXPECTED level of protection

1. Disclosure of critical asset
2. Modification of critical asset
3. Loss/destruction of critical asset
4. Interruption of critical asset

1. Avoidance: elminate threats
2. Reduction: reduce severity of risk/probability of loss
3. Transfer: reallocate liability to 3rd Party (iie. Insurance Co.) via contract
4. Acceptance: analyze/determine asset loss < cost of countermeasure

determining asset's worth to organization; all costs considered; depend on financial impact

• what requires protection?
• cost if asset loss/damaged

1. Asset Mgt System
2. Accounting System
3. Insurance Valuation
4. Delphi Method

Asset Mgt System

Accounting System

Insurance Valuation

Delphi Method

3rd party panel of experts who determine value of assets.

• systematic
• interactive communication
• 2 or more rounds to revise estimated value of assets; uses median score of estimates
• also determines risk

1. Physical Structure: physical factors that expose threat (no security guards, unlocked doors, etc)
2. Electrical: power to building where data stored; affects availability
3. Software: Virus/Malware protection; exposing systems to damage/loss due to lack of anti-virus software
4. Network: possibility of data transmitted over network to be intercepted; encryption
5. Personnel: human factor; lack of training, hiring of personnel that may damage/threat organization (no background check)

1. Natural Disasters: related to weather or non-controllable events due to nature
2. Man-Made: Intensional (arson, theft, damage, file destruction, info disclosure) & Non-intensional (mistakes, power outage, illness, info disclosure)

1. Perform risk analysis on individual basis
2. List the various/ensuing risks discovered via analysis
3. Determine risk probability
4. Prioritize risks by probability levels; focus on high-probability risks during response process

• estimates based on historical incidents/likelihood of risk reoccurance
• numerical basis
• historical/accouting reporting basis

• not based on numbers/history
• best guess
• group acceptance of risk probability (via Delphi)
• Delphi assigns risk value:
  • Not at all likely
  • Somewhat likely
  • More likely
  • Will occur
• Not historical, but prioritize risks based on analysts' opinions

1. Likelihood: Annualized Rate of Occurrence (ARO) % factor estimates # of times event/threat occurs
2. Impact: Single Loss Expectancy (SLE) $ = Exposure Factor (EF) % * Asset Value (AV) $
3. Risk: Annualized Loss Expectancy (ALE) $ = ARO % * SLE $

1. Cost Effectiveness: eliminates/reduces risk is acceptable to org
2. Risk Reduction: reduces risk, not incurs it
3. Practicality: makes sense

ethics: org's principles of acceptable & proper conduct/system of moral values

Enforcement:

• documents expectations
• defines responsibilities
• regulates security by minimizing risk
• enables org ethical behavior

Organizations that enforce:

• American Medical Assoc (AMA)
• Federal Govt
  

Laws & Regulations:

• Sarbanes-Oxley (SOX) Act
• Health Insurance Portability & Accountability (HIPPA) Act
• Gramm-leach-Bliley (GLBA) Act

1. Free Information: information is yearning to be free; helps to escape
2. Computer Game: if it lets you do something, its ok (like a video game)
3. Taking Candy from a Baby: if people are negligent enough to do it, why shouldn't I be able to do it?
4. Shatterproof: it didnt break anything, so must be ok to use
5. The Ends Justify the Means: he/she is learning from act to help themself or society

• seeking to gain unauthorized access
• disrupting inteded Internet use
• wasting resources such as people, capacity, & computers through unprincipled actions
• destroying integrity of computer-based info
• compromising user privacy

(ISC)2 Code of Ethics:

International Information Systems Security Certification Consortium

Preamble

• ensuring safety/protecting commonwealth
• require & acknowledge adherence to ethical values of behavioral std
• observe code for compliance & cert. purposes

Canons

• protect society, commonwealth, infrastructure
• act honorably, honesty, justly, responsibly, legally
• provide diligent/competent service to principles
• advance/protect the profession