Title: Selecting a Risk Control Strategy
Course: IN 2001 Principle of Information Assurance > Section: Module 4: Chapter Four

Selecting a Risk Control Strategy
1. The level of threat and value of the asset should play a major role in the selection of a risk control strategy.
2. The following rules of thumb can be applied in selecting the preferred strategy:
  - When a vulnerability exists, implement security controls to reduce the likelihood of a vulnerability being exercised.
  - When a vulnerability can be exploited, apply layered protections, architectural designs and administrative controls to minimize the risk or prevent this occurrence.
  - When the attacker’s cost is less than his potential gain, apply protections to increase the attacker’s cost (e.g., use system controls to limit what a system user can access and do, thereby significantly reducing an attacker’s gain).

When potential loss is substantial, apply design principles, architectural designs and technical and nontechnical protections to limit the extent of the attack, thereby reducing the potential for loss.

Feasibility Studies
Before deciding on the strategy for a specific vulnerability, all the economic and non-economic consequences of the vulnerability facing the information asset must be explored.

1. We need to ask, “What are the actual and perceived advantages of implementing a control as opposed to the actual and perceived disadvantages of implementing the control?”
2. Cost avoidance is the process of avoiding the financial impact of an incident by implementing a control.

Cost Benefit Analysis (CBA)
An organization begins by evaluating the worth of the information assets to be protected and the loss in value if those information assets are compromised by the specific vulnerability.

1. It is only common sense that an organization should not spend more to protect an asset than the asset is worth.
2. The formal decision-making process used to consider the economic feasibility of implementing information security controls and safeguards is called a cost benefit analysis or an economic feasibility study.
3. Just as it is difficult to determine the value of information, it is also difficult to determine the costs of safeguards.  Some of the items that impact the cost of a control or safeguard include:
  - Cost of development or acquisition
  - Training fees
  - Cost of implementation
  - Service costs
  - Cost of maintenance
4. Benefit is the value that the organization realizes by using controls to prevent losses associated with a specific vulnerability. This is usually determined by valuing the information asset or assets exposed by the vulnerability and then determining how much of that value is at risk and how much risk there is for the asset.
5. Asset valuation is the process of assigning financial value or worth to each information asset. Some will argue that it is virtually impossible to accurately determine the true value of information and information-bearing assets.
6. The valuation of assets involves the estimation of real and perceived costs associated with the design, development, installation, maintenance, protection, recovery, and defense against market loss, and litigation for every set of information-bearing systems or information assets.
7. Some information assets acquire value over time that is beyond the intrinsic value of the asset itself. This value gained over time is referred to as acquired value.
8. Some of the components of asset valuation include:
  - Value retained from the cost of creating or acquiring the information asset
  - Value retained from past maintenance of the information asset
  - Value implied by the cost of replacing the information
  - Value from providing the information
  - Value incurred from the cost of protecting the information
  - Value to owners
  - Value of intellectual property
  - Value to adversaries
  - Loss of productivity while the information assets are unavailable
  - Loss of revenue while information assets are unavailable
9. The organization must be able to place a dollar value on each collection of information and the information assets it comprises.  This value is based on the answers to these questions:
  - How much did it cost to create or acquire this information?
  - How much would it cost to recreate or recover this information?
  - How much does it cost to maintain this information?
  - How much is this information worth to the organization?
  - How much is this information worth to the competition?
10. Once an organization has estimated the worth of various assets, it can begin to examine the potential loss that could occur from the exploitation of a vulnerability or a threat occurrence. This process results in the estimate of potential loss per risk.
11. The questions that must be asked here include:
  - What damage could occur, and what financial impact would it have?
  - What would it cost to recover from the attack, in addition to the financial impact of damage?
  - What is the single loss expectancy for each risk?
12. A single loss expectancy (SLE) is the calculation of the value associated with the most likely loss from an attack. It is a calculation based on the value of the asset and the exposure factor (EF), which is the expected percentage of loss that would occur from a particular attack, as follows:
  - SLE = asset value x exposure factor (EF)
  - Where EF equals the percentage loss that would occur from a given vulnerability being exploited.
13. As difficult as it is to estimate the value of information, the estimation of the probability of a threat occurrence or attack is even more difficult.
14. In most cases, an organization can rely only on its internal information to calculate the security of its information assets. Even if the data has been actively and accurately tracked, the organization’s information is sketchy at best. As a result, this information is usually estimated.
15. The annualized rate of occurrence (ARO) is simply how often you expect a specific type of attack to occur. To standardize calculations, you convert the rate to a yearly (annualized) value.  This is expressed as the probability of a threat occurrence.
16. The expected value of a loss can be stated in the following equation
  - Annualized Loss Expectancy = Single Loss Expectancy * Annualized Rate of Occurrence
  - or
  - ALE = SLE * ARO
17. The Cost Benefit Analysis Formula
  - In its simplest definition, the CBA determines whether or not a particular control is worth its cost.  The CBA is calculated using the ALE from earlier assessments.
  - CBA = ALE(prior) – ALE(post) – ACS
  - ALE (prior) is the annualized loss expectancy of the risk before the implementation of the control. ALE(post) is the ALE examined after the control has been in place for a period of time.  ACS is the annual cost of the safeguard.
  - Once controls are implemented, it is crucial to continue to examine their benefits to determine when they must be upgraded, supplemented or replaced.

Evaluation, Assessment and Maintenance of Risk Controls

1. The selection and implementation of a control strategy is not the end of a process.
2. The strategy and its accompanying controls must be monitored and reevaluated on an ongoing basis to determine their effectiveness and to calculate more accurately the estimated residual risk.