2.

Managementul riscurilor de
securitate

Managementul riscurilor

If you know the enemy and know yourself, you need not fear
the result of a hundred battles.

If you know yourself but not the enemy, for every victory
gained you will also suffer a defeat.

If you know neither the enemy nor yourself, you will succumb
in every battle. (Sun Tzu The Art of War)

Ion BICA

Definiii

Risc - probabilitatea ca o un eveniment s aib consecine
negative
R = probabilitate x impact
(asset, thread, vulnerability)

Managementul riscurilor - procesul de identificare, evaluare i

reducere al riscurilor
Risk Management = Risk Assessment + Risk Treatment

Riscul nu poate fi niciodat eliminat ci redus la un nivel

acceptabil pentru organizaie

Ion BICA

Relaii i procese

Ion BICA

Evaluarea riscurilor

Metode cantitative
cuantificarea exact a elementelor

Metode calitative
folosirea de termeni aproximativi: low, medium, high

Etape:

Ion BICA

Inventariere bunuri (assets)

Identificare ameninri
Identificare vulnerabiliti
Estimare probabiliti
Determinare impact
Calcul risc

Inventariere bunuri

Identificarea bunurilor critice pentru organizaie i stabilirea
valorii acestora

Bunuri tangibile sau intangibile

Primary assets
Business processes & activities
Information

Supporting assets

Ion BICA

Equipment
Software
Networks
Personnel
Premises
Organisational support
6

Identificare ameninri

De natur uman
Aciuni deliberate

acces neautorizat la date i sisteme

denial of service
interceptare / modificare trafic
mascarada
cod maliios (virus, troian, vierme, spyware)
furt sau distrugere de date i echipamente
social engineering

Accidente
erori de operare
omisiuni

De natur tehnic
ntrerupere alimentare cu energie
defectare echipamente

De mediu
dezastre naturale (cutremure, inundaii, incendii, furtuni, tsunami)
condiii exterioare (contaminare, interferen electromagnetic)

Ion BICA

Identificare vulnerabiliti

Mecanisme control acces

Configuraie echipamente
Defecte software (bug-uri)
Tehnologii utilizate
Mod de organizare
ncadrare cu personal
Instruire utilizatori
Amplasare cldire, camere servere

Ion BICA

Estimare probabiliti

Frecvena cu care o ameninare poate exploata o vulnerabilitate

Se estimeaz pentru fiecare combinaie (asset, thread, vulnerability)

Probability

Ion BICA

Definition

Scale

Negligible

Unlikely to occur

Very Low

2-3 times every 5 years

Low

<= once per year

Medium

<= once every 6 months

High

<= once per month

Very High

=> once per month

Extreme

=> once per day

Determinare impact

Consecina materializrii unei ameninri

Se estimeaz pentru fiecare combinaie (asset, thread, vulnerability)
Harm

Ion BICA

Definition

Scale

Insignificant No impact

Minor

No extra effort required to repair

Significant

Tangible harm / extra effort required to repair

Damaging

Significant expenditure of resources required

Damage to reputation and confidence

Serious

Extended outage and / or loss of connectivity

Compromise of large amounts of data or service

Grave

Permanent shutdown
Complete compromise

10

Calcul risc
Risk = Probability x Harm

Ion BICA

Scale

Definition

NIL

1-3

Low

4-7

Medium

8-14

High

15-19

Critical

20-30

Extreme

11

Calcul risc - Exemplu

Asset

Threat

Vulnerability

Prob Harm

Risk

Data Center

Flood

Proximity to river

NIL

System
Administrator

Absence

Lack of cross
training

HIGH

Web Server

Disk crash

Insufficient backup

MEDIUM

Research work

Theft

Communication
channel security

MEDIUM

Organization
Reputation

Server
unavailability

External internet
interfaces

EXTREME

Ion BICA

12

Strategii de control al riscurilor

Reducerea riscului
eliminare vulnerabiliti sau reducere impact
msuri tehnice, procedurale sau administrative

Transferarea riscului (ctre o alt organizaie)

polie de asigurare
managed security services

Acceptarea / asumarea riscului

cost benefit analysis

Ion BICA

13

Metodologii i unelte pentru managementul riscurilor

CRAMM
EBIOS
ISO/IEC IS 13335-2
IT-Grundschutz (IT Baseline Protection Manual)
NIST SP 800-30 - Risk Management for Information Technology
Systems

Operationally Critical Threat, Asset, and Vulnerability
Evaluation (OCTAVE)

Unelte: Cobra, Proteus, Callio, GStool, RiskWatch, etc.

ENISA - Survey of existing Risk Management and Risk
Assessment Methods
Ion BICA

14

Metodologii pentru evaluarea / managementul riscurilor

Ion BICA

15

Metodologii pentru evaluarea / managementul riscurilor (cont.)

Ion BICA

16

 Ion BICA

17