The Security Risk Assessment Handbook

by Landoll; Douglas J.

• ISBN13: 9780849329982
• ISBN10: 0849329981
• Edition: 1st
• Format: Hardcover
• Copyright: 2005-12-12
• Publisher: CRC Press

Summary

The Security Risk Assessment Handbook: A Complete Guide for Performing Security Risk Assessments provides detailed insight into precisely how to conduct an information security risk assessment from a practical point of view. Designed for security professionals who want a more in-depth understanding of the risk assessment process, this volume contains real-world advice that promotes professional development and experience. It also enables security consumers to better negotiate the scope and rigor of a security assessment, effectively interface with a security assessment team, deliver insightful comments on a draft report, and have a greater understanding of final report recommendations.

Table of Contents

Introduction	p. 1
The Need for an Information Security Program	p. 2
Elements of an Information Security Program	p. 4
Security Control Standards and Regulations	p. 5
Common Core Information Security Practices	p. 5
Unanimous Core Security Practices	p. 6
Majority Core Security Practices	p. 7
Core Security Practice Conclusions	p. 8
Security Risk Assessment	p. 8
The Role of the Security Risk Assessment	p. 8
Definition of a Security Risk Assessment	p. 10
The Need for a Security Risk Assessment	p. 11
Security Risk Assessment Secondary Benefits	p. 14
Related Activities	p. 15
Gap Assessment	p. 16
Compliance Audit	p. 16
Security Audit	p. 19
Vulnerability Scanning	p. 20
Penetration Testing	p. 20
Ad Hoc Testing	p. 20
Social Engineering	p. 20
Wardialing	p. 21
The Need for This Book	p. 21
Who Is This Book For?	p. 23
Notes	p. 24
References	p. 25
Information Security Risk Assessment Basics	p. 27
Phase 1: Project Definition	p. 27
Phase 2: Project Preparation	p. 29
Phase 3: Data Gathering	p. 29
Phase 4: Risk Analysis	p. 29
Assets	p. 30
Threat Agents and Threats	p. 30
Vulnerabilities	p. 34
Security Risk	p. 34
Phase 5: Risk Mitigation	p. 35
Safeguards	p. 36
Residual Security Risk	p. 37
Phase 6: Risk Reporting and Resolution	p. 38
Risk Resolution	p. 38
Note	p. 39
References	p. 40
Project Definition	p. 41
Ensuring Project Success	p. 41
Success Definition	p. 42
Setting the Budget	p. 53
Determining the Objective	p. 54
Limiting the Scope	p. 55
Identifying System Boundaries	p. 60
Specifying the Rigor	p. 63
Sample Scope Statements	p. 64
Project Description	p. 64
Project Variables	p. 64
Statement of Work	p. 64
Notes	p. 74
References	p. 75
Security Risk Assessment Preparation	p. 77
Introduce the Team	p. 77
Introductory Letter	p. 78
Pre-Assessment Briefing	p. 79
Obtain Proper Permission	p. 80
Review Business Mission	p. 83
What Is a Business Mission	p. 83
Obtaining Business Mission Information	p. 84
Identify Critical Systems	p. 85
Determining Criticality	p. 86
Identify Assets	p. 89
Checklists and Judgment	p. 91
Asset Sensitivity/Criticality Classification	p. 91
Asset Valuation	p. 95
Identifying Threats	p. 99
Threat Components	p. 100
Listing Possible Threats	p. 100
Threat Statements	p. 105
Validating Threat Statements	p. 105
Determine Expected Controls	p. 108
Notes	p. 112
References	p. 114
Data Gathering	p. 115
Sampling	p. 117
Sampling Objectives	p. 119
Sampling Types	p. 120
Use of Sampling in Security Testing	p. 121
The RIIOT Method of Data Gathering	p. 123
RIIOT Method Benefits	p. 123
RIIOT Method Approaches	p. 123
Using the RIIOT Method	p. 148
Notes	p. 148
References	p. 149
Administrative Data Gathering	p. 151
Threats and Safeguards	p. 151
Human Resources	p. 154
Organizational Structure	p. 159
Information Control	p. 163
Business Continuity	p. 166
System Security	p. 168
The RIIOT Method: Administrative Data Gathering	p. 172
Review Administrative Documents	p. 174
Interview Administrative Personnel	p. 186
Inspect Administrative Security Controls	p. 190
Observe Administrative Behavior	p. 200
Test Administrative Security Controls	p. 200
Notes	p. 211
References	p. 213
Technical Data Gathering	p. 215
Technical Threats and Safeguards	p. 215
Information Control	p. 215
Business Continuity	p. 220
System Security	p. 221
Secure Architecture	p. 223
Components	p. 226
Configuration	p. 228
Data Security	p. 229
The RIIOT Method: Technical Data Gathering	p. 230
Review Technical Documents	p. 230
Interview Technical Personnel	p. 245
Inspect Technical Security Controls	p. 247
Observe Technical Personnel Behavior	p. 259
Test Technical Security Controls	p. 259
Notes	p. 280
References	p. 282
Physical Data Gathering	p. 285
Physical Threats and Safeguards	p. 286
Utilities and Interior Climate	p. 286
Fire	p. 292
Flood and Water Damage	p. 302
Lightning	p. 305
Earthquakes	p. 306
Volcanoes	p. 307
Landslides	p. 307
Hurricanes	p. 308
Tornadoes	p. 308
Natural Hazards Summary	p. 308
Human Threats to Physical Security	p. 310
The RIIOT Method: Physical Data Gathering	p. 322
Review Physical Documents	p. 324
Interview Physical Personnel	p. 330
Inspect Physical Security Controls	p. 332
Observe Physical Personnel Behavior	p. 341
Test Physical Security Safeguards	p. 344
Notes	p. 350
References	p. 351
Security Risk Analysis	p. 353
Determining Risk	p. 353
Uncertainty and Reducing Uncertainty	p. 354
Creating Risk Statements	p. 362
Team Review of Security Risk Statements	p. 363
Obtaining Consensus	p. 363
Deriving Overall security Risk	p. 365
Notes	p. 365
References	p. 366
Security Risk Mitigation	p. 367
Selecting Safeguards	p. 367
Safeguard Solution Sets	p. 368
Safeguard Cost Calculations	p. 369
Justifying Safeguard Selections	p. 370
Establishing Risk Parameters	p. 375
Notes	p. 375
References	p. 376
Security Risk Assessment Reporting	p. 377
Cautions in Reporting	p. 377
Pointers in Reporting	p. 379
Report Structure	p. 380
Executive-Level Report	p. 380
Base Report	p. 380
Appendices and Exhibits	p. 381
Document Review Methodology: Create the Report Using a Top-Down Approach	p. 382
Document Specification	p. 383
Draft	p. 384
Final	p. 384
Assessment Brief	p. 387
Action Plan	p. 387
Notes	p. 388
References	p. 388
Security Risk Assessment Project Management	p. 389
Project Planning	p. 389
Project Definition	p. 389
Project Planning Details	p. 390
Project Resources	p. 393
Project Tracking	p. 405
Hours Tracking	p. 405
Calendar Time Tracking	p. 406
Project Progress Tracking	p. 407
Taking Corrective Measures	p. 407
Obtaining More Resources	p. 407
Using Management Reserve	p. 408
Project Status Reporting	p. 411
Report Detail	p. 411
Report Frequency	p. 412
Status Report Content	p. 412
Project Conclusion and Wrap-Up	p. 412
Eliminating "Scope Creep"	p. 413
Eliminating Project Run-On	p. 413
Notes	p. 413
Reference	p. 414
Security Risk Assessment Approaches	p. 415
Quantitative vs. Qualitative Analysis	p. 416
Quantitative Analysis	p. 417
Qualitative Analysis	p. 423
Tools	p. 426
Lists	p. 426
Templates	p. 426
Security Risk Assessment Methods	p. 427
FAA Security Risk Management Process	p. 427
OCTAVE	p. 427
FRAP	p. 430
CRAMM	p. 430
NSA IAM	p. 430
Notes	p. 430
References	p. 431
Relevant Standards and Regulations	p. 433
GAISP	p. 433
CobiT	p. 435
ISO 17799	p. 436
NIST Handbook	p. 439
Management Controls	p. 439
Operational Controls	p. 440
Technical Controls	p. 441
HIPAA: Security	p. 441
Administrative Safeguards	p. 442
Physical Safeguards	p. 448
Technical Safeguards	p. 450
Gramm-Leach-Bliley Act (GLB Act)	p. 451
Notes	p. 453
Index	p. 455
Table of Contents provided by Ingram. All Rights Reserved.