Professional Documents
Culture Documents
Cism Domain 2 Information Risk Management and Compliance
Cism Domain 2 Information Risk Management and Compliance
Certified Information
Security Manager
Firebrand Custom Designed Courseware
© 2016 Firebrand
5/6/2016
Chapter 2
Information Risk
Management and
Compliance
© 2016 Firebrand
5/6/2016
Exam Relevance
© 2016 Firebrand
ISACA CISM Review Manual Page 78
5/6/2016
Chapter 2 Task Statements
© 2016 Firebrand
ISACA CISM Review Manual Page 78
5/6/2016
Chapter 2 Task Statements cont.
© 2016 Firebrand
ISACA CISM Review Manual Page 78
5/6/2016
Risk Management
© 2016 Firebrand
ISACA CISM Review Manual Page 93
5/6/2016
Definition of Risk
NIST/CNSSI Definition
© 2016 Firebrand
5/6/2016
Why is Risk Important?
© 2016 Firebrand
ISACA CISM Review Manual Page 93
5/6/2016
Risk Management Definition
Analyzing
Evaluating
Treating
Monitoring,
© 2016 Firebrand
5/6/2016
Risk Management Objective
© 2016 Firebrand
ISACA CISM Review Manual Page 94
5/6/2016
Risk Management Overview
© 2016 Firebrand
ISACA CISM Review Manual Page 94
5/6/2016
Risk Management Process
Risk
Identification
(Assessment Risk
and Analysis) Treatment
(Control
Selection) Evaluation
and
Assessment
© 2016 Firebrand
ISACA CISM Review Manual Page 98
5/6/2016
Defining the Risk Environment
The most
critical • Key business drivers
prerequisite • The organization’s SWOT (strengths,
weaknesses, opportunities and
to a threats)
successful risk • Internal and external stakeholders
management • Organizational structure and culture
program is • Assets (resources, information,
customers, equipment)
understanding • Goals and objectives, and the
the strategies already in place to achieve
organization them
including:
© 2016 Firebrand
ISACA CISM Review Manual Page 95
5/6/2016
Threats to Information and
Information Systems
© 2016 Firebrand
ISACA CISM Review Manual Page 95
5/6/2016
Effective Risk Management
Integrated with the business mission
Supported by Senior Management
Integration with other business areas
© 2016 Firebrand
ISACA CISM Review Manual Page 96
5/6/2016
Developing a Risk Management Program
Establish context and purpose
Define scope
Define authority, structure and reporting
Ensure asset identification, classification and
ownership
Determine objectives
Determine risk methodology to be used
© 2016 Firebrand
ISACA CISM Review Manual Page 96
5/6/2016
Alignment of Risk Assessment and BIA
© 2016 Firebrand
ISACA CISM Review Manual Page 104
5/6/2016
Threat Analysis
Threats affected by
• The skill and motivation of the attacker
• The existence of attack tools
© 2016 Firebrand
ISACA CISM Review Manual Page 112
5/6/2016
Aggregate Risk
© 2016 Firebrand
Added value in examination but not in Student Manual
5/6/2016
Cascading Risk
© 2016 Firebrand
Added value in examination but not in Student Manual
5/6/2016
Identification of Vulnerabilities
Weaknesses in security
controls
• Patches not applied
• Non-hardened systems
• Inappropriate access levels
• Unencrypted sensitive data
• Software bugs or coding issues
(buffer overflow)
• Physical security
© 2016 Firebrand
ISACA CISM Review Manual Page 113
5/6/2016
The Effect of Risk
© 2016 Firebrand
ISACA CISM Review Manual Page 117
5/6/2016
Impact
• Direct loss of money (cash or
credit)
• Criminal or civil liability
• Loss of
reputation/goodwill/image
Examples of direct • Reduction of share value
and indirect • Conflict of interests to staff or
financial losses: customers or shareholders
© 2016 Firebrand
ISACA CISM Review Manual Page 117
5/6/2016
Impact cont.
• Breach of confidence/privacy
• Loss of business opportunity/competition
• Loss of market share
• Reduction in operational
efficiency/performance
• Interruption of business activity
• Noncompliance with laws and regulations
resulting in penalties
© 2016 Firebrand
ISACA CISM Review Manual Page 117
5/6/2016
Risk Assessment Methodology
Quantitative
• Determine the impact of a single event
• Single Loss Expectancy
• SLE = Asset Value x Exposure
Factor
• Calculate frequency of events
• Annualized rate of occurrence (ARO)
• ARO = Incidents per year
© 2016 Firebrand
ISACA CISM Review Manual Page 119
5/6/2016
Annualized Loss
Expectancy (ALE)
© 2016 Firebrand
ISACA CISM Review Manual Page 119
5/6/2016
Semiquantitative Analysis
Combination of qualitative analysis with
financial impact levels
Brings together the benefits of both
qualitative and quantitative analysis
Often used in workshops with representatives
of the business
© 2016 Firebrand
ISACA CISM Review Manual Page 118
5/6/2016
Qualitative Risk Assessment
Impact
Likelihood
High 3 6 9
Moderate 2 4 6
Low 1 2 3
© 2016 Firebrand
ISACA CISM Review Manual Page 121
5/6/2016
Data Gathering Techniques
Surveys /
Questionnaires
Observation
Workshops
Delphi techniques
© 2016 Firebrand
ISACA CISM Review Manual Page 120
5/6/2016
Risk Acceptance
The level of risk that senior management is
willing to accept – retention of the risk
Must include the calculation of the total risk
level being accepted to ensure management
has accurate data to work from.
© 2016 Firebrand
ISACA CISM Review Manual Page 121
5/6/2016
Results of Risk Assessment
© 2016 Firebrand
ISACA CISM Review Manual Page 120
5/6/2016
Risk Treatment
© 2016 Firebrand
5/6/2016
Risk Treatment
© 2016 Firebrand
ISACA CISM Review Manual Page 120
5/6/2016
Risk Treatment
© 2016 Firebrand
ISACA CISM Review Manual Page 121
5/6/2016
Risk Mitigation and Controls
© 2016 Firebrand
ISACA CISM Review Manual Page 121
5/6/2016
Control Recommendations
• Cost-benefit analysis
Factors to be • Anticipated effectiveness
considered • Compatibility with other controls,
systems, and processes
when
• Legislation and regulation
recommending • Organizational policy, standards,
new or and culture
enhanced • Impact of control on business
controls are: processes
• Control reliability
© 2016 Firebrand
ISACA CISM Review Manual Page 122
5/6/2016
Cost Benefit
Analysis of Controls
© 2016 Firebrand
ISACA CISM Review Manual Page 122
5/6/2016
Cost Benefit
Analysis of Controls cont.
© 2016 Firebrand
ISACA CISM Review Manual Page 123
5/6/2016
Risk Mitigation Schematic
Owners
Wish to minimize Value
Countermeasures
Impose
To
Reduce
Risk
To
Threat Agents That
increase
Give Rise to
Threats Assets
To
Wish to abuse and/or may damage
© 2016 Firebrand
5/6/2016 From the Common Criteria
Control Types
• Directive
• Deterrent
• Preventative
• Detective
• Recovery
• Corrective
• Compensating
© 2016 Firebrand
Added value in the examination but not in Student Manual
5/6/2016
Security Control Baselines
© 2016 Firebrand
ISACA CISM Review Manual Page 123
5/6/2016
Information Asset Classification
© 2016 Firebrand
ISACA CISM Review Manual Page 125
5/6/2016
Information
Asset Classification
Need to
know what
information
to protect
Need to •Ownership
know who is
responsible •Roles and
to protect it responsibilities
© 2016 Firebrand
ISACA CISM Review Manual Page 126
5/6/2016
Roles and Responsibilities
© 2016 Firebrand
ISACA CISM Review Manual Page 125
5/6/2016
Roles and Responsibilities
© 2016 Firebrand
ISACA CISM Review Manual Page 121
5/6/2016
Information Classification Considerations
© 2016 Firebrand
ISACA CISM Review Manual Page 126
5/6/2016
Regulations and Legislation
© 2016 Firebrand
ISACA CISM Review Manual Page 125
5/6/2016
Asset Valuation
Determine ownership
Determine number of
classification levels
© 2016 Firebrand
ISACA CISM Review Manual Page 126
5/6/2016
Information Protection
© 2016 Firebrand
ISACA CISM Review Manual Page 126
5/6/2016
Information Asset Protection
• Communicated
• Enforced
Policies • Clean desk / Clear screen
• Need to know – Least privilege
• Labeling
Procedures • Destruction
© 2016 Firebrand
ISACA CISM Review Manual Page 126
5/6/2016
Recovery Time Objectives (RTO)
Business needs determine recovery time
objectives
The RTO indicates the time by which critical
services should be restored
Includes identification of dependencies
between systems and processes
Calculated as part of Business Impact Analysis
(BIA)
© 2016 Firebrand
ISACA CISM Review Manual Page 129
5/6/2016
Recovery Point Objectives (RPO)
Based on acceptable data loss in case of a
crisis or major failure
Drives the frequency of backups as well as
the type of backup used to enable recovery
of systems within acceptable timeframes.
© 2016 Firebrand
ISACA CISM Review Manual Page 130
5/6/2016
Service Delivery Objectives (SDO)
Defined as the minimal level of service that
must be restored to meet business
requirements until normal levels of business
can be restored.
© 2016 Firebrand
ISACA CISM Review Manual Page 130
5/6/2016
Third Party Providers
External support functions
Adequate controls and monitoring in place
Ensure that controls are addressed in
contracts
Obtain assurance that control requirements
are being met
• SLAs, SOC2 report, ISO27001
Remember that liability for a breach remains
with the outsourcing organization
© 2016 Firebrand
ISACA CISM Review Manual Page 131
5/6/2016
Risk Related to Physical Controls
Unsecure physical environment
Poor environmental controls
Shared premises
External parties on site
© 2016 Firebrand
ISACA CISM Review Manual Page 132
5/6/2016
Risk Related
to Change Control
Interruption to service
© 2016 Firebrand
ISACA CISM Review Manual Page 132
5/6/2016
Controlling Risk
in Change Control
© 2016 Firebrand
ISACA CISM Review Manual Page 133
5/6/2016
Risk in Project Management
© 2016 Firebrand
ISACA CISM Review Manual Page 134
5/6/2016
Ongoing Risk Management Monitoring
and Analysis
© 2016 Firebrand
ISACA CISM Review Manual Page 135
5/6/2016
Audit and Risk Management
© 2016 Firebrand
ISACA CISM Review Manual Page 135
5/6/2016
Ongoing Risk Assessment
© 2016 Firebrand
ISACA CISM Review Manual Page 135
5/6/2016
Measuring Control Effectiveness
© 2016 Firebrand
ISACA CISM Review Manual Page 135
5/6/2016
New Employee Initiation
Require signing of
•Non-disclosure agreements (NDA)
•Non-compete agreements
•Ethics statement
Review security policy
•Awareness training
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Risk During Employment
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Risk at
Termination of Employment
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Risk During
Employment Process
Hiring Procedures
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Risks During Procurement
• Improper buying
Need to practices
purchase • Influence
the ‘right’ • Kickbacks
equipment • Piracy / imitations
at the
• Inappropriate relations
right price / selection of vendors
© 2016 Firebrand
5/6/2016
Risk During Procurement cont.
© 2016 Firebrand
5/6/2016
Reporting to Management
Regular reporting
• Standard format
• Scheduled basis
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Training and Awareness
Creates accountability
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Training and Awareness
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Training for End Users
© 2016 Firebrand
ISACA CISM Review Manual Page 136
5/6/2016
Documentation
• A risk register
• An inventory of information assets
• Threat and vulnerability analysis
• Control effectiveness report
Typical risk • Initial risk rating
management • Risk report - consequences and
likelihood of compromise
documentation • A risk mitigation and action plan
includes:
© 2016 Firebrand
ISACA CISM Review Manual Page 137
5/6/2016