Documente Academic
Documente Profesional
Documente Cultură
Networks
Wireless
Databases
Internet
Smart cards
Keys
Cryptography
Intrusion detection
..
Real world
IS or ICT Security?
Information and Communication
Technologies Security
Confidentiality, Integrity, Availability etc.
Information System
An Information System comprises five
interdependent elements: hardware,
software, data, procedures, and people.
These elements interact for the purpose of
processing data and delivering information.
An IS exists to serve an enterprise or
organization and, consequently, it may only
be studied in the context of the organization
it serves.
Information Systems
overview
In such a complex
environment
Total security is out of the question
Peoples behaviour is unpredictable
We cannot account for all possible threats
and we cannot detect all vulnerabilities.
Security costs money; and also time,
people and other resources.
R= f(A, I, T, V)
Conceptualisation of IS Sec
A set of methods
SBA check
SBA scenario
CRAMM
CCTA Risk Analysis and Management
Method
Developed in the UK in the late 80s
Used in many countries; it has been
applied in many hundreds of cases
It includes a countermeasures
library
CRAMM overview
Stage 1: Initiation and asset valuation
Model the IS; Valuate the assets;
Management review
Octave
What is OCTAVE?
A comprehensive, repeatable
methodology for identifying risks in
networked systems through
organizational self-assessment.
Helps organizations apply
information security risk
management to secure their existing
information infrastructure and to
protect their critical information
assets.
Goal of OCTAVE
Plan how to apply good security practices
to address organizational and technical
vulnerabilities that could impact critical
assets
Two versions: One for large organisations
(> 300 employees) and one for small
organisations
Organizational issues
Policies or security practices
Technical issues
Technology infrastructure
The process
Phase 1 Organizational
View
Data gathering of the organizational
perspectives on
assets
threats to the assets
security requirements of the assets
current protection strategy practices
organizational vulnerabilities
Phase 1 Questions
What are your organizations critical
information-related assets?
What is important about each critical
asset?
Who or what threatens each critical asset?
What is your organization currently doing
to protect its critical assets?
What weaknesses in policy and practice
currently exist in your organization?
Asset
Something of value to the organization that
includes one or more of the following:
information
systems
services and applications
people
Asset protection
requirements
Prioritize the qualities of an asset
that are important to the
organization:
confidentiality
integrity
availability
Threat
An indication of a potential
undesirable event involving a critical
asset
Examples
A disappointed student could set a fire.
A virus could interrupt access to the
university network.
An operator may set the firewall to deny
all access without noticing
Threat Properties
Critical Asset
Actor (human, system, other)
Motive (deliberate or accidental) human
actor only
Access (network or physical) human
actor only
Outcome
Disclosure or viewing of sensitive information
Modification of important or sensitive
information
Destruction or loss of important information,
hardware, or software
Interruption of access to important information,
software, applications, or services
Methods / Tools
You can use a variety of methods and
tools:
Interviews with people
Documentation analysis
Network scanners
Log analysers
Vulnerability assessment tools
etc.
Phase 2 Questions
How do people access each critical
asset?
What infrastructure components are
related to each critical asset?
What technological weaknesses
expose your critical assets to
threats?
Expression of Risk
A risk is expressed using
a threat scenario (a branch on a threat
tree)
the resulting impact on the organization
Example
Viruses can interrupt staff members
from accessing the network. They will
not prepare their lectures on time.
Impact value: medium
Threat scenario
accidental
disclosure
modification
loss/destruction
interruption
High
Low
deliberate
disclosure
modification
loss/destruction
interruption
Medium
High
High
Low
accidental
disclosure
modification
loss/destruction
interruption
deliberate
disclosure
modification
loss/destruction
interruption
inside
asset
network
outside
asset
access
actor
motive
outcome
Medium
High
High
Low
impact
Phase 3 Questions
What is the potential impact on your
organization due to each threat? What are
your organizations risks?
Which are the highest priority risks to your
organization?
What policies and practices does your
organization need to address?
What actions can your organization take to
mitigate its highest priority risks?
Which technological weaknesses need to
be addressed immediately?
Outputs of Octave
Protection
Strategy
Defines
organizational
direction
Mitigation
Plan
Plans
designed to
reduce risk
Action
List
Near-term
action items
Protection Strategy
Structured around the catalog of practices
and addresses the following areas:
Mitigation Plan
Defines the activities required to remove or
reduce unacceptable risk to a critical
asset.
Focus is on activities to
recognize or detect threats when they occur
resist or prevent threats from occurring
recover from threats if they occur
OCTAVE-S
Defines a more structured method for
evaluating risks in small (less than 100
employees) or simple organizations
requires less security expertise in analysis
team
requires analysis team to have a full, or nearly
full, understanding of the organization and
what is important
uses fill-in-the-blank as opposed to essay
style
OCTAVE Information
Visit http://www.cert.org/octave
Introduction to the OCTAVE Approach
OCTAVE Method Implementation Guide
OCTAVE-S (version 0.9)