No time for panic

--Originally published at (Not so) Random talk

Imagine you own a very important company, constantly attacked or under possible attacks from spies. You are vulnerable, you are at risk. But what can you do know? You might start to panic thinking nothing can save you.

Ah, but there is something you could do. No, don’t look at us with those big, hopeful eyes.

timmy_eyes

We don’t have the magic solution to your problem. But we can tell you something you could do, maybe not to prevent those spies, but actually, the first step before that. They are called Risk Assessment Methodologies.

Risk assessment is about finding out exactly in which parts or places are the risks (for example your vault code), which of those risks are more important, and how to make the risk smaller. After doing risk assessment, you and our personnel will know which actions to take to reduce risk or to reduce those actions that put you more at risk (like stop leaving

There are two types of risk assessment: quantitative and qualitative. As the names suggest, one has a very rigorous metrics to assess risks, it puts a great effort into asset value determination and risk mitigation, but the calculations can be complex and time consuming, as well as requiring a lot of preliminary work. The second one is much simpler in calculations, not even quantifying threat frequency, and the value of the assets is not necessarily monetary. On the other hand, as the name suggests, it is subjective, depend on the expertise of the assessment team and there is no basis for the cost/benefit analysis of risk mitigation.

24682766

Now that we know what is risk assessment, let’s see the methodologies:

Asset Audit

Your company (the one attacked by spies), actually manages lots of money, information and valuables from very important and influential people

lurking
around the world. In this methodology, you would see if this are correctly protected, like if the values are resistant or safe, or the computers in which the information is secured are actually, well, secured. It follows the following steps:

  1. Information asset identification
  2. Data flow – how the information (valuables) enters and leaves the system.
  3. Threat analysis – are there any risk in any of the steps above or when the data is stored? Like, is it possible the valuables could be stolen when moving them into the company or outside or could the vaults could be hijacked?
  4. Likelihood of occurrence- are the threats of above likely to occur, what are the chances?
  5. Impact Analysis – How bad would it be if a valuable were to be missing or a piece of information to be disclosed?
  6. Safeguard identification – Do you need stronger vaults? Maybe laser beams?

Pipeline Model

In this methodology, you would create imaginary pipelines to process each movement within the organization that is related with the valuables. This pipelines have five components:

  1. Active processes
  2. Communication processes
  3. Stable Data processes
  4. Enquiry processes
  5. Access Control processes

Attack Trees

This trees provide a methodical way to describe who, when, how, why and with what probability will an attack happen. To do so, you would need to:

  1. Identify all your enemies (threat agents), like spies, betrayers within the organization, possible mistakes, etc.
  2. Identify what would be the ultimate goal, or the ultimate value someone would want to take.
  3. Identify all the possible routes the spy could take to steal the valuable, these attack methods become second level goals.
  4. Make the last three steps until there are no more sub goals.
  5. Review

Know that you know, go and quickly do your assessment, buy your laser beams if needed. But do it quick, a spy could be lurking already around you by now.

lurking

Reference: https://www.giac.org/paper/gsec/3287/overview-practical-risk-assessment-methodologies/105426

Blog post made in colaboration with The Machetero (Francisco) . Check out his blog for other cool posts! :3