We are increasingly aware of the vulnerability of infrastructure (water systems, telecommunications companies, banks, power grids, healthcare systems, etc.) to all types of cyberattacks. According to McAfee, cybercrime increased by 53% in 2008. In April 2010, Optus's customers, their Internet service providers, and a large group of major corporate clients suffered traffic degradation as a result of a DDoS attack originating from China. According to Gartner & McAfee, intellectual property theft in 2009 was estimated at around one trillion dollars. Network attacks affect infrastructure throughout the network, damaging routers, changing routing tables, overloading DNS servers, causing email server failures, poisoning ARP and DNS caches, and so on.

Elements of Risk Analysis:
A vulnerability is a weakness or flaw/bug in a system that can be exploited to compromise or attack it. Threats are a set of circumstances or agents that have the potential to cause loss or damage to a system by taking advantage of existing vulnerabilities. Attacks target key security services such as confidentiality (encryption, privacy, anonymity/steganography), integrity (conventional and blind digital signatures, hashes, MAC addresses), and availability (backup, hot/cold sites, redundancy), collectively known as CIA/Confidentiality-Integrity-Availability. Attacks also target security objectives such as authentication (using man-in-the-middle attacks and identity/address spoofing), identification, authorization, non-repudiation, accountability/logging/auditing, etc. Threats exploit vulnerabilities and can be accidental (unintentional human error) or malicious (viruses). Controls (safeguards, countermeasures, protective elements, or security measures) are mechanisms or procedures for mitigating vulnerabilities (using the three directions of prevention, detection, and recovery, and sometimes even deterrence). It is essential to be aware of the costs and scope of controls. Furthermore, controls are subject to vulnerability and threat analysis. For example, an outdated antivirus program poses a significant danger (due to user ignorance, negligence, or malicious intent, or because the antivirus manufacturer does not allow manual updates, instead opting for automatic updates, for example, from the cloud).

A completely isolated asset (a server without a network connection) is secure but not useful; therefore, a trade-off must be established between security and availability. Likewise, resources should not be spent protecting entities without relevant value. Control should be good enough to deter an attacker, but not absolutely good for cost reasons. Risk is the probability that a specific threat will exploit a specific vulnerability; there is never certainty of it. Examples of critical assets include people, hardware/software, data, documentation, physical plant, etc. The impact of risk is the loss associated with exploitation. Therefore, it is necessary to systematically understand the risks of a system and decide how to control them. Risk analysis is the process of identifying, assessing, and reducing risks to an acceptable level. It defines and controls threats and vulnerabilities and implements risk reduction measures. Risk analysis is a discipline with three parts: (i) Risk assessment: Determining what risks exist. (ii) Risk management: Evaluating alternatives to mitigate risk. (iii) Risk communication. It presents the above results in a way that is understandable to decision-makers, not only to security managers but, more importantly, to the business leaders ultimately responsible for what they want in their organizations. To organize the risk analysis process, assets, vulnerabilities, and threats must be considered. Risk is a function of assets, vulnerabilities, and threats: (risk) = (assets) x (threats) x (vulnerabilities). During risk analysis, values ​​are assigned to assets, vulnerabilities, and threats. The basic structure of risk analysis is: (1) Evaluate. Assess information and computing assets. Determine system vulnerabilities. Consider threats from within and outside the organization. Prioritize risks. (2) Examine. Review the availability of security countermeasures, assess their effectiveness, and determine their costs (installation, hidden licenses, operation, updates, etc.). (3) Implement and monitor. Those who should be involved in this process include: security experts, internal domain experts (those who best understand how things actually work), managers responsible for implementing controls, lawyers, and business/organizational leaders. Identifying assets (or individuals/entities/objects/things of value) can include people, physical assets (such as buildings, networks, and computers), and logical assets (such as reputation, intellectual property, legal compliance, and software). When addressing risk, several approaches are possible, such as: (i) Avoiding the risk by implementing a control or changing the design. (ii) Transferring the risk by changing the design to introduce a different risk or by hiring an insurance company. (iii) Accepting the risk. This involves detecting and recovering from the risk by establishing a rigorous plan in case of an attack (for example, using fault-tolerant infrastructure, failover, high availability, redundancy, backups, cold sites, or hot sites).

Types of risk analysis

Two approaches can be identified when addressing risk analysis: (1) Quantitative analysis. This assigns real numbers to the costs of safeguards and the potential damage. Here, the Annual Loss Exposure (ALE), the Risk of Injury Statement (ROSI), and the probability of an event occurring are defined. This approach can be imprecise and unreliable. The phases of this type of analysis are: (i) Identify and value assets. (ii) Determine vulnerabilities and their impact. (iii) Estimate the probability of exploitation. (iv) Calculate the ALE. (v) Summarize applicable controls and their costs. (vi) Project annual savings from the controls. Risk exposure (or expected loss) is the product of the risk impact multiplied by the risk probability. For example, in the case of the loss of a server, the risk impact is the cost to replace the server, for example, €17,000, and the probability of loss is, for example, 0.10. This results in a risk exposure of 17,000 x 0.10 = 1,700. The overall exposure measured per year is the ALE. In this type of analysis, a cost-benefit analysis of the controls should be performed.

Risk influences the evaluation of the value of a control. A useful measure is the ratio: (risk exposure before implementing the control) minus (risk exposure after implementing the control) divided by (the cost of the control). (2) Qualitative analysis. This judges the organization's relative risk to threats. It is based on judgment, intuition, and experience. It classifies the severity of threats according to the sensitivity of assets. It is subjective and lacks numerical data to justify the return on investment. The stages of qualitative risk analysis are: (i) Identify the scope. Define the problem. (ii) Create a team. Include experts knowledgeable about the subject, managers in charge of implementation, and users. (iii) Identify threats. Select from lists of known threats. Brainstorm new threats, combining threats and vulnerabilities. (iv) Prioritize threats for each asset. Identify the probability of occurrence. Define a fixed threat rating, for example, from low (value 1) to high (value 5). Assign a value to each threat. This is an approximation of the probability of risk from the quantitative approach. (v) Loss Impact. For each threat, determine the loss impact. A fixed ranking is defined, for example, low (value 1) to high (value 5). This is used to prioritize the damage to assets due to the threat. (vi) Total Impact or Risk Factor. This is the sum of the threat priority and the impact priority. For example, for the threat of theft, if the threat priority is 2 and the impact priority is 3, the risk factor is 5; for the threat of fire, if the threat priority is 3 and the impact priority is 5, the risk factor is 8; for the threat of flood, if the threat priority is 2 and the impact priority is 5, the risk factor is 7. (vii) Identify Controls/Safeguards. An initial set of potential controls is established. The controls are associated with each threat. Start with the highest priority risks. (viii) Cost-benefit analyses are performed. This phase can iterate with phase 6. (ix) Classify controls—evaluate safeguards. They are ordered by risk factor. For example, for a fire threat, if the risk factor is 8, a possible safeguard is a fire suppression system, and the cost of the safeguard is €18,000. For a flood or hurricane threat, if the risk factor is 7, a possible safeguard is a business continuity plan, and the cost of the safeguard is €87,000. (x) Communicate the results. This concludes with a written report and is presented to all members in the form of specific meetings according to the hierarchical level of the individuals within the organization. The meeting with managers is not the same as the meeting with lower-level employees.

Final Considerations
Our research group has been working for over twenty years in the field of risk analysis at a global level in all types of organizations and scenarios where information and knowledge must be adequately protected, from embedded systems to large organizations with Web/Web 2.0 network deployments and virtualization and cloud infrastructures.

This article is part of the activities carried out within the LEFIS-APTICE project (funded by Socrates, European Commission).

Bibliography

- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2010.
- Areitio, J. “Analysis of Information Vulnerability”. Conectrónica Magazine. No. 131. October 2009.
- Areitio, J. “Security Testing to Evaluate and Improve the Level of Security Risks”. Conectrónica Magazine. No. 134. February 2010.
- Norman, TL “Risk Analysis and Security Countermeasure Selection”. CRC Press. 2009.
- Kelsey, T. “Social Networking Spaces: From Facebook to Twitter and Everything in Between”. Apress. 2010.
- Zittrain, J. “The Future of the Internet and How to Stop It”. Yale University Press. 2009.
- Solove, DJ “Understanding Privacy”. Harvard University Press. 2010.
- Wacks, R. “Privacy: A Very Short Introduction”. Oxford University Press. 2010.
- Nissenbaum, H. “Privacy in Context: Technology, Policy and the Integrity of Social Life.” Stanford Law Books. 2009.
- Schneier, B. “Secrets and Lies: Digital Security in a Networked World.” Wiley. 2004.
- O'Harrow, R. “No Place to Hide.” Free Press. 2006.
- Solove, DJ “The Digital Person: Technology and Privacy in the Information Age”. NYU Press. 2006.
- Solove, DJ and Schwartz, P. “Information Privacy Law”. Aspen Publishers, Inc. 2008.
- Solove, DJ and Schwartz, P. “Privacy and the Media.” Aspen Publishers, Inc. 2008.
- Schwartz, P. and Solove, DJ “Information Privacy: Statutes and Regulations”. Aspen Publishers, Inc. 2008.
- Benkler, Y. “The Wealth of Networks: How Social Production Transforms Markets and Freedom.” YaleUniversity. 2007.
- Mather, T., Kmaraswamy, S. and Latif, S. “Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance”. O'Reilly Media. 2009.
- Solove, DJ and Schwartz, P. “Privacy, Information and Technology”. Aspen Publishers, Inc. 2008.

Author:

Prof. Dr. Javier Areitio Bertolín – E.Mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
Professor at the Faculty of Engineering.
Director of the Networks and Systems Research Group. University of Deusto.

More information or a quote