As an Officer, a leader and manager, one of your jobs will be to assess and manage risk; fortunately you have been managing risk your entire life and continue to do so each day. All we are doing here is honing your risk management skills with a more formalized process and applying that process to the Cyber Domain.

Introduction

You assess and manage risk on a daily basis, and you have been doing so your entire life. Why do we look both ways before we walk across a road? Because there is a risk of being hit by a car. The impact of a pedestrian being hit by a car is high (serious injury or death) so we mitigate (reduce) the risk of being hit by looking both ways before we cross the road. Just as in the physical world, there are threats in the cyberspace.

Terminology

risk

A measure of the extent to which an entity is threatened by a potential circumstance or event.

impact

An adverse effect that results from an event occurring.

vulnerability

A weakness in a system that can be exploited by a threat that adversely affects the system, results in an adverse impact. [general context]

A weakness in an information system that can be exploited to compromise a pillar of cyber security. [cyber domain context]

threat

An actor or event with the potential to adversely impact an information system.

capability

The knowledge and skill set required by a threat to carry out an event.

opportunity

The resources and positioning required by a threat to carry out an action.

intent

The motivation of a threat to carry out an action.

The Risk Management Tradeoff

There is a fundamental tension between the services an information system provides (functionality), and security. A building with no doors or windows is quite secure, but pretty limited in its utility. Similarly, an information system with no way for data to flow in or out is very secure, but it is unable to provide a service. The more services you provide/allow, the more ways in and out of your system that need securing. Thus, for each service one needs to weigh the value of the service against the security implications of providing/allowing it. We weigh the risk against the functionality (benefits) and cost to make a decision on how to proceed.

Often times there is no one right answer as to whether a service should be provided/allowed, and the answer is highly situational. The amount of risk that is acceptable for your grandmother's computer is likely different than the computer used by the Chief of Naval Operations (CNO).

What process do we need to go through to assess risk? What are the factors we need to consider? You already have an intuition of what many of the important factors are. What are the benefits of providing or using the service? What are the impacts if the service is compromised? What vulnerabilities are there in providing or using the service? What threats are working to compromise the service? What are the risks inherent in providing/allowing that service? This requires a better understanding of the factors that comprise risk, and leads to developing a repeatable process to assess risk.

Risk Factors

In the cyber domain, just as in all domains, there are various factors that go into assessing risk. Risk Assessment can be viewed as a function with inputs, a process, and outputs. In general risk is viewed as a function of likelihood of occurrence of an event and impact of an event, risk( likelihood, impact ).

Intuitively, if we increase the likelihood of a negative event occurring, the risk severity increases, and vice versa. This is also the case with impact, if the impact of a negative event occurring increases, the risk severity increases.

Likelihood of Occurrence

Likelihood of occurrence can be decomposed into two main components: threat and vulnerability. Threat is any circumstance or event that has the potential to adversely impact our system. Threat can be adversarial (purposely caused by a person) or non-adversarial (caused by an accident or natural event such as a hurricane). Vulnerability represents a weakness in an information system that can be exploited, often by an adversarial threat actor.

Not all vulnerabilities are equal, there are factors that we can assess a vulnerability with. The risk assessment team will ask and answer questions such as (OWASP):

• (Discoverable) How easy is it for an adversary to discover the vulnerability?
• (Exploitable) How easy is it for an adversary to exploit the vulnerability?
• (Awareness) How well known is the vulnerability?
• (Detectable) How likely is an exploit to be detected?

Just as vulnerabilities, threats are also assessed using various factors. The risk assessment team will ask and answer questions such as (OWASP):

• (Capability) How technically skilled is an adversary?
• (Capability) How much does the adversary know about the target system?
• (Opportunity) Does the adversary have the resources (technology) to exploit a vulnerability?
• (Opportunity) Is the adversary in a position to exploit a vulnerability?
• (Intent) How motivated is an adversary to find and exploit a vulnerability?
• (Intent) Does the actor performing the exploit intend harm?

Impact

Impact assessments focus on the resulting damage if a vulnerability is exploited. A single vulnerability may have multiple impacts within the cyber domain, both technological and non-technological. We can apply concepts from conventional operations such as: deceive, deny, disrupt, degrade, and destroy.

Technical impacts are associated to the Pillars of Cyber Security. For example, if the password file for a web based service is compromised, the Authentication pillar is impacted.

Non-technical impacts are associated with the operations and relationships of an organization:

• (Personnel) To what extent are personnel put in physical danger if the vulnerability is exploited?
• (Equipment) To what extent is equipment put in physical danger if the vulnerability is exploited?
• (Operations) To what extent will the success of operations be endangered?
• (Capabilities) To what extent will the capabilities of the organization be damaged?
• (Reputation) To what extent will the organization's reputation be damaged?
• (Financial) What will the financial damage to the organization be?

The to what extent part of assessing impact is not always simple to quantify or qualify.

The Risk Management Process

A common first question when presented with a formalized process is: Why is this process necessary?. Following a formalized method allows for the a given process to be repeated; the repeatability allows us to assess process changes and determine if improvement efforts actually achieved the desired results or not. In other words, formalized processes allow us to compare and contrast.

There a number of different methods for assessing risk, most of the methods include a feedback (process improvement) step at the end, making a risk assessment a continual cyclic process. The following are general steps to assessing and managing risk:

Identify Risks

Risk assessment begins with identifying risks associated with a task or system. We will use crossing a road as an example. Here are some of the risks associated with crossing a road:

Risk
Trip and fall
Hit by bike
Hit by car
Fined for jaywalking

We can look at risk from the viewpoint of the pedestrian or from the driver. In the cyber domain we look at risk from the offensive or defensive viewpoint. In fact, being proficient at assessing and managing risks in the cyber domain requires looking at risks from both an offensive and defensive perspective; a yin and yang.

Analyze the Risk

Risks are assessed to determine severity based on the event's likelihood and impact. Risks can be assessed using a quantitative (assigned a numeric value) or a qualitative scale (assigned to a category such as low or high). The tables below are extracted from NIST SP800-30 and provide general guidance on how to define likelihood and impact both qualitatively and quantitatively.




Going back to the crossing the road example, we can now assign a qualitative value to each of the risks that were identified in the first step.

Risk	Likelihood of Occurrence	Impact
Trip and fall	Low (2)	Very Low (0)
Hit by bike	Moderate (5)	Moderate (5)
Hit by car	High (8)	High (8)
Fined for jaywalking	Low (2)	Very Low (0)




Prioritize the Risk

Organizations do not have infinite resources and therefore cannot eliminate or even address all possible risks. Risks must be prioritized by severity so that an appropriate strategy can be developed in line with resource constraints. Generally this just consists of ordering the identified risks from most severe to least severe by assigning quantitative values based on the qualitative values above.

Priority	Risk	Likelihood of Occurrence	Impact
1	Hit by car	High (8)	High (8)
2	Hit by bike	Moderate (5)	Moderate (5)
3	Fined for jaywalking	Low (2)	Very Low (0)
4	Trip and fall	Low (2)	Very Low (0)




Address the Risk

Once a risk has been identified, assigned a severity, and prioritized we can determine how the risk will be addressed. There are four strategies for addressing risk:

• Avoid - Avoid activities that would make you incur the risk
• Control - Apply measures to reduce (mitigate) the risk
• Accept - Accept all of the risk and continue the activity
• Transfer - Transfer the risk to someone else

Note that ignoring risk is not a legitimate strategy. The table below shows our road crossing example with risk strategies applied.

Priority	Risk	Likelihood of Occurrence	Impact	Strategy
1	Hit by car	High	High	Control - Look both ways before crossing
2	Hit by bike	Moderate	Moderate	Control - Look both ways before crossing
3	Fined for jaywalking	Low	Very Low	Avoid - Only cross at designated crosswalks
4	Trip and fall	Low	Very Low	Accept

It is impossible to nullify risk; there is risk in any action. Any risk that remains after a strategy has been applied is known as residual risk. For example, we choose to control our risk of being hit by a car by looking both ways before crossing. While this greatly reduces our risk it does not eliminate it. There is residual risk that a car may suddenly accelerate or take some other unexpected action.




Monitor the Risk

Risk management is a process. After strategies have been applied to each risk they need to be continually monitored to determine their effectiveness. Questions to ask include:

• Are you using resources effectively?
• Is the risk management strategy working as expected?
• Have any new risks been identified?
• Have any risks changed?
• Have any new threats or vulnerabilities been identified?
• Are new controls available?

If you can answer yes to any of those questions the risk management process should be repeated and results updated. Regardless, the risk management process should be executed on a periodic basis.

Review Questions

1. Why use formalized risk assessments?
2. In your own words, describe each term given pertaining to risk assessments.
3. What is the risk management trade off?
4. What are the general steps of a risk assessment and how can they be applied to cyber?

References

1. OWASP. OWASP Risk Rating Methodology. retrieved: 30 Oct 2014.
2. Risk Equation
3. National Institute for Standards and Technology (NIST) Special Publication 800-30: Guide for Conducting Risk Assessments