Information Security Risk Analysis

458 Pages·2010·9.167 MB·English

by  Thomas R. Peltier

Information Security
Risk Analysis
Third Edition

Information Security
Risk Analysis
Third Edition
THOMAS R. PELTIER
Auerbach Publications
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
© 2010 by Taylor and Francis Group, LLC
Auerbach Publications is an imprint of Taylor & Francis Group, an Informa business
No claim to original U.S. Government works
Printed in the United States of America on acid-free paper
10 9 8 7 6 5 4 3 2 1
International Standard Book Number: 978-1-4398-3956-0 (Hardback)
This book contains information obtained from authentic and highly regarded sources. Reasonable
efforts have been made to publish reliable data and information, but the author and publisher cannot
assume responsibility for the validity of all materials or the consequences of their use. The authors and
publishers have attempted to trace the copyright holders of all material reproduced in this publication
and apologize to copyright holders if permission to publish in this form has not been obtained. If any
copyright material has not been acknowledged please write and let us know so we may rectify in any
future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or
hereafter invented, including photocopying, microfilming, and recording, or in any information stor-
age or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.copy-
right.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that pro-
vides licenses and registration for a variety of users. For organizations that have been granted a pho-
tocopy license by the CCC, a separate system of payment has been arranged.
Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are
used only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com
and the Auerbach Web site at
http://www.auerbach-publications.com
To Lisa and Winston, my two best buddies.

Contents
Acknowledgments ..........................................................................................xi
About the Author ........................................................................................xiii
Introduction ..................................................................................................xv
1 The Facilitated Risk Analysis and Assessment Process (FRAAP) ...........1
1.1 Introduction .......................................................................................1
1.2 FRAAP Overview ..............................................................................2
1.3 FRAAP History ..................................................................................3
1.4 Introducing the FRAAP .....................................................................5
1.4.1 Key Concepts ..........................................................................6
1.5 The Pre-FRAAP Meeting ...................................................................8
1.5.1 Pre-FRAAP Meeting Checklist .............................................13
1.5.2 Pre-FRAAP Meeting Summary ............................................18
1.6 The FRAAP Session .........................................................................18
1.6.1 Overview ...............................................................................18
1.6.2 FRAAP Session Introduction ................................................19
1.6.3 FRAAP Session Talking Points .............................................20
1.6.4 FRAAP Threats Identification ...............................................22
1.6.5 Identifying Threats Using a Checklist ...................................25
1.6.6 Identifying Existing Controls ................................................26
1.6.7 Establishing Risk Levels ........................................................26
1.6.8 Residual Risk ........................................................................30
1.7 Using a Threats Identification Checklist ...........................................38
1.7.1 FRAAP Session Summary ....................................................43
1.8 Post-FRAAP Process.........................................................................47
1.8.1 Complete the Action Plan .....................................................50
1.9 Conclusion .......................................................................................54
2 Risk Analysis (Project Impact Analysis) ...............................................57
2.1 Overview ..........................................................................................57
vii
viii ◾ Contents
2.2 The Difference between Risk Analysis and Risk Assessment .............57
2.3 Risk Analysis and Due Diligence ......................................................58
2.4 Risk Assessment and Fiduciary Duty ................................................58
2.5 Performing a Risk Analysis ...............................................................59
2.6 Risk Analysis Elements .....................................................................61
2.7 Other Considerations .......................................................................62
2.8 When to Conduct a Risk Analysis ...................................................64
2.9 Final Words .....................................................................................64
2.10 Sample Risk Analysis Questionnaire.................................................65
2.11 Sample Risk Analysis Report Outline ...............................................65
3 Pre-Screening .......................................................................................67
3.1 Introduction .....................................................................................67
3.2 Background ......................................................................................71
3.2.1 Pre-Screening Example 1 .......................................................71
3.2.2 Pre-Screening Example 2 .......................................................73
3.2.3 Pre-Screening Example 3 .......................................................75
3.2.4 Pre-Screening Example 4 .......................................................78
3.3 Summary ..........................................................................................78
4 Business Impact Analysis .....................................................................81
4.1 Overview ..........................................................................................81
4.2 BIA versus Risk Assessment ..............................................................82
4.3 Creating a BIA Process .....................................................................83
4.4 Creating the Financial Impact Table ................................................84
4.5 Working the BIA Process ..................................................................86
4.6 Additional Examples .........................................................................88
4.7 Objectives of the BIA........................................................................93
4.8 Using Questionnaires for a BIA ........................................................93
4.9 Data Collection and Analysis ...........................................................95
4.10 Prepare Management Presentation ....................................................96
4.11 Final Thoughts..................................................................................97
5 Gap Analysis .........................................................................................99
5.1 Introduction .....................................................................................99
5.2 Background ......................................................................................99
5.3 GAP Analysis Process .....................................................................100
5.3.1 Gap Analysis Example 1 ......................................................103
5.3.2 Gap Analysis Example 2 ......................................................106
5.3.3 How to Use the Self-Assessment Checklist ..........................107
5.4 Summary ........................................................................................108
Contents ◾ ix
Appendix A Facilitator Skills ................................................................111
Appendix B FRAAP Team Members ....................................................117
Introduction ............................................................................................117
The Risk Assessment Team ......................................................................118
Conclusion ...............................................................................................123
Appendix C Project Scope Statement ....................................................125
Overview .................................................................................................125
Summary .................................................................................................128
Appendix D Laws, Standards, and Regulations ....................................129
Appendix E Frequently Asked Questions about Risk Management .....131
Introduction ............................................................................................131
Is There a Difference between Risk Analysis and Risk Assessment? .........131
Why Should a Risk Analysis Be Conducted? ...........................................132
When Should a Risk Assessment Be Conducted? .....................................132
Who Should Conduct the Risk Assessment? ............................................133
How Long Should a Risk Assessment Take? ............................................134
What Can a Risk Analysis or Risk Assessment Analyze? .........................134
Who Should Review the Results of a Risk Analysis and
Risk Assessment? ............................................................................134
How Is the Success of the Risk Analysis Measured? .................................135
Summary .................................................................................................135
Appendix F Risk Analysis versus Risk Assessment ...............................137
Overview .................................................................................................137
The Difference between Risk Analysis and Risk Assessment ....................137
Risk Analysis and Due Diligence .............................................................138
Risk Assessment and Fiduciary Duty .......................................................138
Conducting a Risk Assessment ................................................................139
Risk Assessment Timetable ......................................................................140
Risk Assessment and Risk Analysis Results ..............................................140
Risk Management Metrics .......................................................................140
Summary .................................................................................................141
Appendix G Sample Threat Checklist ...................................................143
Appendix H Sample BIA Questionnaire ...............................................153