//Cyber Battlefield/Risk

As an Officer, a leader and manager, one of your jobs will be to assess and manage risk; fortunately you have been managing risk your entire life and continue to do so each day. All we are doing here is honing your risk management skills with a more formalized process and applying that process to the Cyber Domain.

Learning Outcomes

After completing this discussion and the activities you should be able to:

Introduction

You assess and manage risk on a daily basis, and you have been doing so your entire life. Why do we look both ways before we walk across a road? Because there is a risk of being hit by a car. The impact of a pedestrian being hit by a car is high (serious injury or death) so we mitigate (reduce) the risk of being hit by looking both ways before we cross the road. Just as in the physical world, there are threats in the cyberspace.

Terminology

risk
A measure of the extent to which an entity is threatened by a potential circumstance or event.
impact
An adverse effect that results from an event occurring.
vulnerability
A weakness in a system that can be exploited by a threat that adversely affects the system, results in an adverse impact. [general context]
A weakness in an information system that can be exploited to compromise a pillar of cyber security. [cyber domain context]
threat
An actor or event with the potential to adversely impact an information system.
capability
The knowledge and skill set required by a threat to carry out an event.
opportunity
The resources and positioning required by a threat to carry out an action.
intent
The motivation of a threat to carry out an action.

The Risk Management Tradeoff

Risk Management Tradeoff There is a fundamental tension between the services an information system provides (functionality), and security. A building with no doors or windows is quite secure, but pretty limited in its utility. Similarly, an information system with no way for data to flow in or out is very secure, but it is unable to provide a service. The more services you provide/allow, the more ways in and out of your system that need securing. Thus, for each service one needs to weigh the value of the service against the security implications of providing/allowing it. We weigh the risk against the functionality (benefits) and cost to make a decision on how to proceed.

Often times there is no one right answer as to whether a service should be provided/allowed, and the answer is highly situational. The amount of risk that is acceptable for your grandmother's computer is likely different than the computer used by the Chief of Naval Operations (CNO).

What process do we need to go through to assess risk? What are the factors we need to consider? You already have an intuition of what many of the important factors are. What are the benefits of providing or using the service? What are the impacts if the service is compromised? What vulnerabilities are there in providing or using the service? What threats are working to compromise the service? What are the risks inherent in providing/allowing that service? This requires a better understanding of the factors that comprise risk, and leads to developing a repeatable process to assess risk.

Risk Factors

Risk Factors In the cyber domain, just as in all domains, there are various factors that go into assessing risk. Risk Assessment can be viewed as a function with inputs, a process, and outputs. In general risk is viewed as a function of likelihood of occurence of an event and impact of an event, risk( likelihood, impact ).

Intuitively, if we increase the likelihood of a negative event occurring, the risk severity increases, and vice versa. This is also the case with impact, if the impact of a negative event occurring increases, the risk severity increases.

Likelihood of Occurrence

Likelihood of occurence can be decomposed into two main components: threat and vulnerability. Threat is any circumstance or event that has the potential to adversely impact our system. Threat can be adversarial (purposely caused by a person) or non-adversarial (caused by an accident or natural event such as a hurricane). Vulnerability represents a weakness in an information system that can be exploited, often by an adversarial threat actor.

Not all vulnerabilities are equal, there are factors that we can assess a vulnerability with. The risk assessment team will ask and answer questions such as (OWASP):

Just as vulnerabilities, threats are also assessed using various factors. The risk assessment team will ask and answer questions such as (OWASP):

Impact

Common Vulnerability Scoring System

The National Institute of Standards and Technology (NIST) maintains the National Vulnerability Database (NVD). One of the tools provided with the NVD is the Common Vulnerability Scoring System (CVSS). The CVSS supports cyber domain risk assessment efforts.
Example: CVSS – ShellShock

Impact assessments focus on the resulting damage if a vulnerability is exploited. A single vulnerability may have multiple impacts within the cyber domain, both technological and non-technological. We can apply concepts from conventional operations such as: deceive, deny, disrupt, degrade, and destroy.

Technical impacts are associated to the Pillars of Cyber Security. For example, if the password file for a web based service is compromised, the Authentication pillar is impacted.

Non-technical impacts are associated with the operations and relationships of an organization:

The to what extent part of assessing impact is not always simple to quantify or qualify.

Operational Risk Management

Operational Risk Management (ORM) is a formalized continual cyclic process used across the Fleet and Corps at all levels to assess and manage risk for strategic operations down to the most routine tasks.
In this course we are focusing on assessing cyber domain risks and mitigating those risks with the discussed security tools. The foundation we cover in this course fits into the ORM processes you will use in the Fleet and Corps.

The Risk Management Process

Risk Management Process A common first question when presented with a formalized process is: Why is this process necessary?. Following a formalized method allows for the a given process to be repeated; the repeatability allows us to assess process changes and determine if improvement efforts actually achieved the desired results or not. In other words, formalized processes allow us to compare and contrast.

There a number of different methods for assessing risk, most of the methods include a feedback (process improvement) step at the end, making a risk assessment a continual cyclic process. The following are general steps to assessing and managing risk:

  1. Identify risks

    Risk assessment begins with identifying risks associated with a task or system. We will use crossing a road as an example. Here are some of the risks associated with crossing a road:

    Risk
    Trip and fall
    Hit by bike
    Hit by car
    Fined for jaywalking

    We can look at risk from the viewpoint of the pedestrian or from the driver. In the cyber domain we look at risk from the offensive or defensive viewpoint. In fact, being proficient at assessing and managing risks in the cyber domain requires looking at risks from both an offensive and defensive perspective; a yin and yang.

  2. Analyze the Risk

    Risks are assessed to determine severity based on the event's likelihood and impact. Risks can be assessed using a quantitative (assigned a numeric value) or a qualitative scale (assigned to a category such as low or high). The tables below are extracted from NIST SP800-30 and provide general guidance on how to define likelihood and impact both qualitatively and quantitatively.

    NIST SP800-30 Likelihood Assessment Scale
    NIST SP800-30 Impact Assessment Scale

    Going back to the crossing the road example, we can now assign a qualitative value to each of the risks that were identified in the first step.

    Risk Likelihood of Occurrence Impact
    Trip and fall Low Very Low
    Hit by bike Moderate Moderate
    Hit by car High High
    Fined for jaywalking Low Very Low
  3. Prioritize the Risks

    Organizations do not have infinite resources and therefore cannot eliminate or even address all possible risks. Risks must be prioritized by severity so that an appropriate strategy can be developed in line with resource constraints. Generally this just consists of ordering the identified risks from most severe to least severe.

    Priority Risk Likelihood of Occurrence Impact
    1 Hit by car High High
    2 Hit by bike Moderate Moderate
    3 Fined for jaywalking Low Very Low
    4 Trip and fall Low Very Low
  4. Address the Risk

    Once a risk has been identified, assigned a severity, and prioritized we can determine how the risk will be addressed. There are four strategies for addressing risk:

    • Avoid - Avoid activities that would make you incur the risk
    • Control - Apply measures to reduce (mitigate) the risk
    • Accept - Accept all of the risk and continue the activity
    • Transfer - Transfer the risk to someone else

    Note that ignoring risk is not a legitimate strategy. The table below shows our road crossing example with risk strategies applied.

    Priority Risk Likelihood of Occurrence Impact Strategy
    1 Hit by car High High Control - Look both ways before crossing
    2 Hit by bike Moderate Moderate Control - Look both ways before crossing
    3 Fined for jaywalking Low Very Low Avoid - Only cross at designated crosswalks
    4 Trip and fall Low Very Low Accept

    It is impossible to nullify risk; there is risk in any action. Any risk that remains after a strategy has been applied is known as residual risk. For example, we choose to control our risk of being hit by a car by looking both ways before crossing. While this greatly reduces our risk it does not eliminate it. There is residual risk that a car may suddenly accelerate or take some other unexpected action.

  5. Monitor the Risk

    Risk management is a process. After strategies have been applied to each risk they need to be continually monitored to determine their effectiveness. Questions to ask include:

    • Are you using resources effectively?
    • Is the risk management strategy working as expected?
    • Have any new risks been identified?
    • Have any risks changed?
    • Have any new threats or vulnerabilities been identified?
    • Are new controls available?

    If you can answer yes to any of those questions the risk management process should be repeated and results updated. Regardless, the risk management process should be executed on a periodic basis.

References

  1. OWASP. OWASP Risk Rating Methodology. retrieved: 30 Oct 2014.
  2. Risk Equation
  3. Risk Equation is Nonsense
  4. National Institute for Standards and Technology (NIST) Special Publication 800-30: Guide for Conducting Risk Assessments