Assessing and Managing Security Risk in IT Systems

Assessing and Managing Security Risk in IT Systems

by John McCumber
Released August 2004
Publisher(s): Auerbach Publications
ISBN: 9781135488963

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

This book begins with an overview of information systems security, offering the basic underpinnings of information security and concluding with an analysis of risk management. Part II describes the McCumber Cube, providing the original paper from 1991 and detailing ways to accurately map information flow in computer and telecom systems. It also explains how to apply the methodology to individual system components and subsystems. Part III serves as a resource for analysts and security practitioners who want access to more detailed information on technical vulnerabilities and risk assessment analytics. McCumber details how information extracted from this resource can be applied to his assessment processes.

Table of contents

  1. COVER PAGE
  2. OTHER INFORMATION SECURITY BOOKS FROM AUERBACH
  3. TITLE PAGE
  4. COPYRIGHT PAGE
  5. DEDICATION
  6. INTRODUCTION
    1. HOW TO USE THIS TEXT
    2. WHAT YOU WILL NOT SEE
    3. ACKNOWLEDGMENTS
    4. THE TEXT
    5. TERMS AND DEFINITIONS
    6. REFERENCES
  7. I SECURITY CONCEPTS
    1. 1: USING MODELS
      1. INTRODUCTION: UNDERSTANDING, SELECTING, AND APPLYING MODELS
      2. UNDERSTANDING ASSETS
      3. LAYERED SECURITY
      4. USING MODELS IN SECURITY
      5. SECURITY MODELS FOR INFORMATION SYSTEMS
      6. SHORTCOMINGS OF MODELS IN SECURITY
      7. SECURITY IN CONTEXT
      8. REFERENCE
    2. 2: DEFINING INFORMATION SECURITY
      1. CONFIDENTIALITY, INTEGRITY, AND AVAILABILITY
      2. INFORMATION ATTRIBUTES
      3. INTRINSIC VERSUS IMPUTED VALUE
      4. INFORMATION AS AN ASSET
      5. THE ELEMENTS OF SECURITY
        1. CONFIDENTIALITY
        2. INTEGRITY
        3. AVAILABILITY
      6. SECURITY IS SECURITY ONLY IN CONTEXT
    3. 3: INFORMATION AS AN ASSET
      1. INTRODUCTION
      2. DETERMINING VALUE
      3. MANAGING INFORMATION RESOURCES
      4. REFERENCES
    4. 4: UNDERSTANDING THREAT AND ITS RELATION TO VULNERABILITIES
      1. INTRODUCTION
      2. THREAT DEFINED
      3. ANALYZING THREAT
      4. ASSESSING PHYSICAL THREATS
      5. INFRASTRUCTURE THREAT ISSUES
    5. 5: ASSESSING RISK VARIABLES: THE RISK ASSESSMENT PROCESS
      1. INTRODUCTION
      2. LEARNING TO ASK THE RIGHT QUESTIONS ABOUT RISK
      3. THE BASIC ELEMENTS OF RISK IN IT SYSTEMS
      4. INFORMATION AS AN ASSET
      5. DEFINING THREAT FOR RISK MANAGEMENT
      6. DEFINING VULNERABILITIES FOR RISK MANAGEMENT
      7. DEFINING SAFEGUARDS FOR RISK MANAGEMENT
      8. THE RISK ASSESSMENT PROCESS
  8. II THE MCCUMBER CUBE METHODOLOGY
    1. 6: THE MCCUMBER CUBE
      1. INTRODUCTION
      2. THE NATURE OF INFORMATION
      3. CRITICAL INFORMATION CHARACTERISTICS
      4. CONFIDENTIALITY
      5. INTEGRITY
      6. AVAILABILITY
      7. SECURITY MEASURES
      8. TECHNOLOGY
      9. POLICY AND PRACTICE
      10. EDUCATION, TRAINING, AND AWARENESS (HUMAN FACTORS)
      11. THE MODEL
        1. OVERVIEW
        2. USE OF THE MODEL
      12. REFERENCES
    2. 7: DETERMINING INFORMATION STATES AND MAPPING INFORMATION FLOW
      1. INTRODUCTION
      2. INFORMATION STATES: A BRIEF HISTORICAL PERSPECTIVE
      3. AUTOMATED PROCESSING: WHY CRYPTOGRAPHY IS NOT SUFFICIENT
      4. SIMPLE STATE ANALYSIS
      5. INFORMATION STATES IN HETEROGENEOUS SYSTEMS
      6. BOUNDARY DEFINITION
      7. DECOMPOSITION OF INFORMATION STATES
        1. STEP 1: DEFINING THE BOUNDARY
        2. STEP 2: MAKE AN INVENTORY OF ALL IT RESOURCES
        3. STEP 3: DECOMPOSE AND IDENTIFY INFORMATION STATES
      8. DEVELOPING AN INFORMATION STATE MAP
      9. REFERENCE
    3. 8: DECOMPOSING THE CUBE FOR SECURITY ENFORCEMENT
      1. INTRODUCTION
      2. A WORD ABOUT SECURITY POLICY
      3. DEFINITIONS
      4. THE MCCUMBER CUBE METHODOLOGY
      5. THE TRANSMISSION STATE
        1. TRANSMISSION: CONFIDENTIALITY
        2. TRANSMISSION: INTEGRITY
        3. TRANSMISSION: AVAILABILITY
      6. THE STORAGE STATE
        1. STORAGE: CONFIDENTIALITY
        2. STORAGE: INTEGRITY
        3. STORAGE: AVAILABILITY
      7. THE PROCESSING STATE
        1. PROCESSING: CONFIDENTIALITY
        2. PROCESSING: INTEGRITY
        3. PROCESSING: AVAILABILITY
      8. RECAP OF THE METHODOLOGY
    4. 9: INFORMATION STATE ANALYSIS FOR COMPONENTS AND SUBSYSTEMS
      1. INTRODUCTION
      2. SHORTCOMINGS OF CRITERIA STANDARDS FOR SECURITY ASSESSMENTS
      3. APPLYING THE MCCUMBER CUBE METHODOLOGY FOR PRODUCT ASSESSMENTS
      4. STEPS FOR PRODUCT AND COMPONENT ASSESSMENT
      5. INFORMATION FLOW MAPPING
        1. DEFINE THE BOUNDARY
        2. TAKE AN INVENTORY OF INFORMATION RESOURCES AND COMPONENTS
        3. DECOMPOSE AND IDENTIFY ALL INFORMATION STATES
      6. CUBE DECOMPOSITION BASED ON INFORMATION STATES
        1. CALL OUT THE INFORMATION STATE COLUMN
        2. DECOMPOSE BLOCKS BY ATTRIBUTE
        3. IDENTIFY EXISTING AND POTENTIAL VULNERABILITES
      7. DEVELOP SECURITY ARCHITECTURE
        1. DESCRIBE REQUIRED SAFEGUARDS
        2. COST OUT ARCHITECTURE COMPONENTS AND ENFORCEMENT MECHANISMS
      8. RECAP OF THE METHODOLOGY FOR SUBSYSTEMS, PRODUCTS, AND COMPONENTS
      9. REFERENCES
    5. 10: MANAGING THE SECURITY LIFE CYCLE
    6. 11: SAFEGUARD ANALYSIS
      1. INTRODUCTION
      2. TECHNOLOGY SAFEGUARDS
      3. PROCEDURAL SAFEGUARDS
      4. HUMAN FACTORS SAFEGUARDS
      5. VULNERABILITY-SAFEGUARD PAIRING
      6. HIERARCHICAL DEPENDENCIES OF SAFEGUARDS
      7. SECURITY POLICIES AND PROCEDURAL SAFEGUARDS
      8. DEVELOPING COMPREHENSIVE SAFEGUARDS: THE LESSONS OF THE SHOGUN
      9. IDENTIFYING AND APPLYING APPROPRIATE SAFEGUARDS
      10. COMPREHENSIVE SAFEGUARD MANAGEMENT: APPLYING THE MCCUMBER CUBE
      11. THE ROI OF SAFEGUARDS: DO SECURITY SAFEGUARDS HAVE A PAYOFF?
    7. 12: PRACTICAL APPLICATIONS OF MCCUMBER CUBE ANALYSIS
      1. INTRODUCTION
      2. APPLYING THE MODEL TO GLOBAL AND NATIONAL SECURITY ISSUES
      3. PROGRAMMING AND SOFTWARE DEVELOPMENT
      4. USING THE MCCUMBER CUBE IN AN ORGANIZATIONAL INFORMATION SECURITY PROGRAM
      5. USING THE MCCUMBER CUBE FOR PRODUCT OR SUBSYSTEM ASSESSMENT
      6. USING THE MCCUMBER CUBE FOR SAFEGUARD PLANNING AND DEPLOYMENT
      7. TIPS AND TECHNIQUES FOR BUILDING YOUR SECURITY PROGRAM
      8. ESTABLISHING THE SECURITY PROGRAM: DEFINING YOU
      9. AVOIDING THE SECURITY COP LABEL
      10. OBTAINING CORPORATE APPROVAL AND SUPPORT
      11. CREATING PEARL HARBOR FILES
      12. DEFINING YOUR SECURITY POLICY
      13. DEFINING WHAT VERSUS HOW
      14. SECURITY POLICY: DEVELOPMENT AND IMPLEMENTATION
      15. REFERENCE
  9. III APPENDICES
    1. APPENDIX A VULNERABILITIES
      1. INTRODUCTION
      2. THE PROBLEM: VULNERABILITY MEANS DIFFERENT THINGS
      3. THE APPROACH: INTRODUCING A NEW TERM—EXPOSURE
      4. DISTINGUISHING BETWEEN VULNERABILITIES AND EXPOSURES
      5. DEFINITION
      6. SHORT DESCRIPTION
      7. DEFINITIONS
      8. RATIONALE
      9. EXAMPLES
      10. WHAT IS A CVE CANDIDATE?
      11. THE TWO WAYS NEW SECURITY ISSUES BECOME CANDIDATES
        1. DATA SOURCES
        2. CANDIDATE NUMBERING AUTHORITIES
      12. HOW LONG IT TAKES FOR CANDIDATES TO BECOME OFFICIAL CVE ENTRIES
      13. HOW CANDIDATES ARE AFFECTED BY CVE CDS
      14. THE CANDIDATE NUMBERING PROCESS
        1. CVE CANDIDATES
        2. CANDIDATE NUMBERING AUTHORITY
        3. CVE EDITOR
        4. PHASES OF A CVE CANDIDATE
      15. FROM CANDIDATE TO CVE ENTRY
      16. TO LEARN MORE
      17. MITRE
      18. REFERENCE
    2. APPENDIX B RISK ASSESSMENT METRICS
      1. OVERVIEW OF THE BASIC RISK ASSESSMENT PROCESS
      2. RISK ASSESSMENT METRICS
      3. THREAT METRICS
      4. VULNERABILITY METRICS
      5. ASSET METRICS
      6. BASELINE RISK FACTORS
      7. SAFEGUARD CALCULATIONS
      8. OBTAINING RISK ASSESSMENT DATA
      9. RISK ASSESSMENT DECISION SUPPORT TOOLS
      10. REFERENCE
    3. APPENDIX C DIAGRAMS AND TABLES
      1. INTRODUCTION
      2. REFERENCE
    4. APPENDIX D OTHER RESOURCES
      1. INTRODUCTION
      2. THREAT INFORMATION
      3. VULNERABILITY AND SAFEGUARD INFORMATION
      4. ASSET INFORMATION

Product information

  • Title: Assessing and Managing Security Risk in IT Systems
  • Author(s): John McCumber
  • Release date: August 2004
  • Publisher(s): Auerbach Publications
  • ISBN: 9781135488963