Fluent Essays

Introduction to Risk Individuals, businesses and governments face risk daily. Risk is manifested in different forms and may be described as business, non-business, or financial. Irrespective of the type of risk, it’s important to remember the basic goals of security - to maintain confidentiality and integrity, while also ensuring the availability of data and systems. Organizations and governments usually employ different approaches to mitigating risks, but with a good understanding and consideration for risk elements including (i) vulnerabilities, (ii) threats & threat agents, (iii) impact, and (iv) likelihood. Other considerations include an organization or government’s appetite for risk, business goals, as well as internal and external drivers (laws, regulations, and standards). Proven strategies to deal with risk employ an enterprise risk management approach, and also rely on risk management frameworks including but not limited to: NIST’s risk management framework, ISACA’s risk IT framework, and COBIT 2019. Overview Follow these directions to complete the assignment: Identify a cybersecurity-related attack: Using scholarly sources and/or the web, research, identify, and share an example of a cybersecurity-related attack. Examples may include cyber warfare such as “Stuxnet” or the “Equifax” data breach. Feel free to use any of these. Once you’ve decided on the example you will share, “claim” it by posting it to the discussion. Do not post about the same type of attack as your classmates. Create your post: In a discussion post of approximately 600 to 800 words, explain risk and risk elements related to this attack, including a synopsis, attack type, characteristics, vulnerabilities, threats & threat agents, impact, and likelihood of this attack. You may need to make some assumptions as you write about the risk elements. Clearly state any assumptions that you make. Do not offer a potential solution to the attack;   Action Items Complete all of the reading for this module. Claim the cybersecurity-related attack you intend to discuss by posting it to the discussion. Create your discussion post according to the directions in the overview.CHAPTER 1 Risk Concepts In this chapter, you will: •  Review basic security concepts •  Learn about standards, frameworks, and best practices related to risk identification, assessment, and evaluation •  Learn to describe how business goals, information criteria, and organizational structures affect risk •  Determine how information systems architecture presents risk to the organization •  Learn about risk ownership and awareness •  Recognize legal, regulatory, and contractual requirements for risk management within the organization This chapter will review a large portion of Certified in Risk and Information Systems Control (CRISC) Domain 1: Risk Identification with coverage of fundamental information security and risk management concepts. We’ll cover a good deal of the terminology associated with risk management and many of the core concepts you’ll need to be familiar with for the exam, but we will go into more depth on many of these concepts in later chapters. The CRISC exam topics that we cover in this chapter are as follows and include the following domain objectives and knowledge statements: •  1.6 Identify risk appetite and tolerance defined by senior leadership and key stakeholders to ensure alignment with business objectives •  1.7 Collaborate in the development of a risk awareness program, and conduct training to ensure that stakeholders understand risk and to promote a risk-aware culture NOTE    Throughout the book, the task and knowledge statements are listed in the order they are described in the CRISC Job Practice areas, not necessarily how they are presented in the chapter. Basic Security Concepts To successfully sit for the CRISC exam, you should be familiar with some basic security concepts. You can’t be expected to know how to manage risk in a security environment if you don’t understand the basics of security. We’ll assume you have some level of experience already as a security professional since risk management is a significant portion of (and a logical career progression from) the information security profession. You may also have had some level of experience in specific risk management processes during your career. As such, we won’t go into detail on the basic security concepts in the upcoming sections; this chapter will just serve as a quick refresher to remind you of certain security concepts. The CRISC exam is not a technical exam; it is more of a process- and management-oriented exam, so we won’t delve into firewall configuration rules, protocol filtering, encryption, or any of the other fun stuff that security professionals do. We will, however, discuss a couple of other security concepts that are important to know for the exam since risk affects all of these concepts in different ways. Goals of Information Security Traditional security doctrine, as well as fundamental security knowledge you may learn from various training courses and on-the-job experience over the years, teaches that there are three fundamenArchived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated below). Archived Publication Series/Number: Title: Publication Date(s): Withdrawal Date: Withdrawal Note: Superseding Publication(s) The attached publication has been superseded by the following publication(s): Series/Number: Title: Author(s): Publication Date(s): URL/DOI: Additional Information (if applicable) Contact: Latest revision of the attached publication: Related information: Withdrawal announcement (link): Date updated: June 9, 2015 NIST Special Publication 800-30 Risk Management Guide for Information Technology Systems July 2002 September 2012 SP 800-30 is superseded in its entirety by the publication of SP 800-30 Revision 1 (September 2012). NIST Special Publication 800-30 Revision 1 Guide for Conducting Risk Assessments Joint Task Force Transformation Initiative September 2012 http://dx.doi.org/10.6028/NIST.SP.800-30r1 Computer Security Division (Information Technology Lab) SP 800-30 Revision 1 (as of June 19, 2015) http://csrc.nist.gov/ N/A NATL INST. OF STAND & TECH I NISI PUBUCATSOt^S National Institute of Standards and Technology Technology Administration U.S. Department of Commerce NIST Special Publication 800-30 Risk Management Guide for Information Technology Systems Recommendations ofthe National Institute of Standards and Technology Gary Stoneburner, Alice Goguen, and Alexis Feringa COMPUTER SECURITY rhe National Institute of Standards and Teciinology was established in 1988 by Congress to assist industry in the development of technology . . . needed to improve product quality, to modernize manufacturing processes, to ensure product reliability . . . and to facilitate rapid commercialization ...of products based on new scientific discoveries. NIST, originally founded as the National Bureau of Standards in 1901, works to strengthen U.S. industrys competitiveness; advance science and engineering; and improve public health, safety, and the environment. One of the agencys basic functions is to develop, maintain, and retain custody of the national standards of measurement, and provide the means and methods for comparing standards used in science, engineering, manufacturing, commerce, industry, and education with the standards adopted or recognized by the Federal Government. As an agency of the U.S. Commerce Departments Technology Administration, NIST conducts basic and applied research in the physical sciences and engineering, and develops measurement techniques, test methods, standards, and related services. The Institute does generic and precompetitive work on new and advanced technologies. NISTs research facilities are located at Gaithersburg, MD 20899, and at Boulder, CO 80303. Major technical operating units and their principalTHE DIGITAL AGE T H E D E F I N I T I V E C Y B E R S E C U R I T Y G U I D E F O R D I R E C T O R S A N D O F F I C E R S NAVIGATING THE DIGITAL AGE: The Defi nitive Cybersecurity Guide for Directors and Offi cers Published by SecurityRoundtable.org Navigating the Digital Age: The Defi nitive Cybersecurity Guide for Directors and Offi cers Publisher: Tim Dempsey Editor: Matt Rosenquist Design and Composition: Graphic World, Inc. Printing and Binding: Transcontinental Printing Navigating the Digital Age: The Defi nitive Cybersecurity Guide for Directors and Offi cers is published by: Caxton Business & Legal, Inc. 27 North Wacker Drive, Suite 601 Chicago, IL 60606 Phone: +1 312 361 0821 Email: [email protected] First published: 2015 ISBN: 978-0-9964982-0-3 Navigating the Digital Age: The Defi nitive Cybersecurity Guide for Directors and Offi cers © October 2015 Cover illustration by Tim Heraldo Copyright in individual chapters rests with the authors. No photocopying: copyright licenses do not apply. DISCLAIMER Navigating the Digital Age: The Defi nitive Cybersecurity Guide for Directors and Offi cers (the Guide) contains summary information about legal and regulatory aspects of cybersecurity governance and is current as of the date of its initial publication (October 2015). Although the Guide may be revised and updated at some time in the future, the publishers and authors do not have a duty to update the information contained in the Guide, and will not be liable for any failure to update such information. The publishers and authors make no representation as to the completeness or accuracy of any information contained in the Guide. This guide is written as a general guide only. It should not be relied upon as a substitute for specifi c professional advice. Professional advice should always be sought before taking any action based on the information provided. Every effort has been made to ensure that the information in this guide is correct at the time of publication. The views expressed in this guide are those of the authors. The publishers and authors do not accept responsibility for any errors or omissions contained herein. It is your responsibility to verify any information contained in the Guide before relying upon it. iii ■ Introduction New York Stock Exchange – Tom Farley, President No issue today has created more concern within corporate C-suites and boardrooms than cybersecurity risk. With the ability to shatter a company’s reputation with their customers and draw criticism from shareholders, lawsuits from affected parties, and attention from the media, the threat of cyber risk is ubiquitous and insidious. No com- pany, region, or industry is immune, which makes the responsibility to oversee, manage, and mitigate cyber risk a top-down priority in every organization. The New York Stock Exchange has long advocated that exemplary governance and risk oversight is fundament