Title: Risk Identification
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Risk Identification

A risk management strategy calls on information security professionals to identify, classify and prioritize their organizations’ information assets.
A threat assessment process is then undertaken to identify and quantify the risks facing each asset.  This process is made up of steps to document the circumstances and settings of each information asset and to identify the vulnerabilities of those assets.
When vulnerabilities are found, controls are identified and assessed as to their capability to limit possible losses in the eventuality of attack.
Plan and Organize the Process
1. A risk management process requires applying the organization’s project management principles to the risk management process.

1. The process will need a proper project plan with periodic deliverables, including a task list and appropriate assignments.

Asset Identification and Valuation
This iterative process begins with the identification of assets, including all of the following elements of an organization’s system: people, procedures, data, software, hardware and networking components.

Then, we classify and categorize the assets, adding details as we dig deeper into the analysis.

People, Procedures, and Data Asset Identification
Identifying human resources, documentation, and data information is more difficult than identifying hardware and software assets.  As the people, procedures and data assets are identified, they should be recorded using a reliable data-handling process.
When deciding which information assets to track, consider the following asset attributes:
- People: Position name/number/ID (try to avoid names and stick to identifying positions, roles or functions); supervisor; security clearance level; special skills
- Procedures: Description; intended purpose; relationship to software, hardware and networking elements; storage location for reference; storage location for update
- Data: Classification; owner, creator, and manager; size of data structure; data structure used (sequential or relational); online or offline; location; backup procedures employed

As you develop the data-tracking process, consider carefully how much data should be tracked and for which specific assets. Most large organizations find that that they can only effectively track a few valuable facts about the most critical devices.
Hardware, Software, and Network Asset Identification
Depending on the needs of the organization and its risk management efforts, as well as the preferences and needs of the management of the information security and information technology communities, when deciding which information assets to track, you may want to consider including these asset attributes:
- Name
- IP address
- MAC address
- Element type
- DeviceClass = S (server)
- DeviceOS = W2K (Windows 2000)
- DeviceCapacity = AS (advanced server)
- Hardware, software, and network asset identification
- Serial number
- Manufacturer’s name
- Manufacturer’s model number or part number
- Software version, update revision or FCO number
- Physical location
- Logical location
- Controlling entity

Automated Risk Identification Tools
Automated tools can sometimes identify the system elements that make up the hardware, software and network components.

Once stored, typically in a database or in a form that can be exported to a database, the inventory list must be kept current by using a tool that periodically refreshes the data.
In the later steps of risk management, which require involved calculations, the case is strong for the use of automated risk management tools for tracking information assets.  At this point in the process, however, simple word-processing, spreadsheet and database tools can provide adequate record keeping.
Data Classification and Management
Corporate and military organizations use a variety of data classification schemes.
Information owners are responsible for classifying the information assets for which they are responsible. Annually, they must review information classifications to ensure the information is still classified correctly and appropriate access controls are in place.

The typical information classification scheme has three categories:

- Confidential: Used for corporate information that must be tightly controlled, even within the company. Access to this information is strictly on a need-to-know basis or as required by the terms of a contract.
- Internal: Used for internal information that does not meet the criteria for the confidential category. It is to be viewed only by corporate employees, authorized contractors, and other third parties.
- External: This includes all information that has been approved by management for public release.

The U.S. Military Classification Scheme has a more complex categorization system than required by most corporations. For most information, the military uses a five-level classification scheme: Unclassified, Sensitive But Unclassified (SBU), Confidential, Secret and Top Secret.
The military also has some specialty classification ratings, such as Personnel Information and Evaluation Reports, to protect related areas of information.  Federal agencies such as the FBI and CIA also use specialty classification schemes, like Need-to-Know and Named Projects.
Most organizations do not need the detailed level of classification used by the military or federal agencies. A simple scheme, such as Public, For Official Use Only, Sensitive and Classified, will allow the organization to protect its sensitive information.
Security Clearances
The other side of the data classification scheme is the personnel security clearance structure.  For each user of data in the organization, a single level of authorization must be assigned that indicates the level of classification he or she is authorized to view.
Before an individual is allowed access to a specific set of data, he or she must meet the need-to-know requirement. This extra level of protection ensures that the confidentiality of information is properly maintained.
Management of Classified Data
Management of classified data includes its storage, distribution, portability and destruction.
Information that is not unclassified or public must be clearly marked as such.
When classified data is stored, it must be available only to authorized individuals.
When an individual carries classified information, it should be transported via inconspicuous means, such as in a locked briefcase or portfolio.
The clean desk policy requires employees to secure all information in appropriate storage containers at the end of each day.
When copies of classified information are no longer valuable or excessive copies exist, proper care should be taken to destroy them by means of shredding, burning or transferring to an authorized document destruction service.
It is important to enforce policies to ensure that no classified information is disposed of in trash or recycling areas since some individuals would not hesitate to engage in dumpster diving to retrieve information that could embarrass an organization or compromise information security.
Classifying and Prioritizing Information Assets
Many organizations already have a classification scheme. Examples of these kinds of classifications are confidential data, internal data, and public data.  Informal organizations may have to organize themselves to create a usable data classification model.
Classification of components must be specific enough to allow determination of priority levels because the next step is to rank the components based on criteria established by the categorization.  It is important that the categories be comprehensive and mutually exclusive.  Comprehensive means that all information assets must fit in the list somewhere, and mutually exclusive means that an information asset should fit in only one category.
The other side of the data classification scheme is the personnel security clearance structure, which identifies the level of information individuals are authorized to view based on what each person needs to know.
Information Asset Valuation
As each asset of the organization is assigned to a category, posing a number of questions assists in developing the weighting criteria to be used for asset valuation. These questions include:
- Which information asset is the most critical to the success of the organization?
- Which information asset generates the most revenue?
- Which information asset generates the most profitability?
- Which information asset would be the most expensive to replace?
- Which information asset would be the most expensive to protect?
- Which information asset would be the most embarrassing or cause the greatest liability if revealed?

When it is necessary to calculate, estimate or derive values for information assets, consideration might be given to the following:
- Value retained from the cost of creating the information asset
- Value retained from past maintenance of the information asset
- Value implied by the cost of replacing the information
- Value from providing the information
- Value incurred from the cost of protecting the information
- Value to owners
- Value of intellectual property
- Value to adversaries

Additional company-specific criteria may add value to the asset evaluation process and should be identified, documented, and added to the process.  To finalize this step, the organization should assign a weight to each asset based on their given answers.

Information Asset Prioritization
Once the process of inventorying and assessing value is complete, you can prioritize each asset using weighted factor analysis.  In this process, each information asset is assigned a score for each critical factor.  In addition, each critical factor is also assigned a weight (ranging from 1 to 100) to show that criteria’s assigned importance for the organization.
Identify and Prioritize Threats
Realistic threats must be investigated further, while the unimportant threats are set aside.  If you assume every threat can and will attack every information asset, the project scope quickly becomes so complex it overwhelms the ability to plan.
Each threat must be examined to assess its potential impact on the organization.  This is referred to as a threat assessment.
To frame the discussion of threat assessment, address each threat with a few questions:
- Which threats present a danger to the organization’s assets in the given environment?
- Which threats represent the most danger to the organization’s information?
- How much would it cost to recover from a successful attack?
- Which of these threats would require the greatest expenditure to prevent?

Answering these questions helps establish a framework for the discussion of threat assessment.  This list may not cover everything that affects the information security threat assessment.  An organization's guidelines and/or policies should influence this process and may require the posing of additional questions.
Vulnerability Identification
After identification of the organization’s information assets and documentation of criteria for beginning to assess the threats it faces, review each information asset for each threat it faces and create a list of vulnerabilities.
Vulnerabilities are specific avenues that threat agents can exploit to attack an information asset.
Each of the threats that are possible or likely and how they could be perpetrated are examined.  A list of the organization’s assets and their vulnerabilities is created.  This process works best when groups of people with diverse backgrounds within the organization work iteratively in a series of brainstorming sessions.
The end deliverable of the risk identification process is a list of threats, assets and their vulnerabilities.  This list, along with any supporting documentation, is the starting point for the next step, risk assessment.