book

The Security Risk Assessment Handbook, 3rd Edition

Name: The Security Risk Assessment Handbook, 3rd Edition
Author: Douglas Landoll
ISBN: 9781000413250

by Douglas Landoll

September 2021

Intermediate to advanced

512 pages

19h 44m

English

CRC Press

Read now

Unlock full access

Cover
Half Title
Title Page
Copyright Page
Dedication
Contents
List of Tables
List of Figures
Author
1 Introduction
1.1 The Role of the Chief Information Security Officer1.1.1 Audit as a Driver for Security Initiatives1.1.2 Technology as a Driver for Security Initiatives1.1.3 Compliance as a Driver for Security Initiatives1.1.4 Security Risk as a Driver for Security Initiatives1.2 Ensuring a Quality Information Security Risk Assessment1.3 Security Risk Assessment1.3.1 The Role of the Security Risk Assessment1.3.2 Definition of a Security Risk Assessment1.3.3 The Need for a Security Risk Assessment1.3.3.1 Checks and Balances1.3.3.2 Periodic Review1.3.3.3 Risk-Based Spending1.3.3.4 Requirement1.3.4 Security Risk Assessment Secondary Benefits1.4 Related Activities1.4.1 Gap Assessment1.4.2 Compliance Audit1.4.3 Security Audit1.4.4 Vulnerability Scanning1.4.5 Penetration Testing1.4.6 Ad Hoc Testing1.4.7 Social Engineering1.4.8 War Dialing1.5 The Need for This Book1.6 Who Is This Book For?ExercisesNoteBibliography

2 Information Security Risk Assessment Basics
2.1 Phase 1: Project Definition2.2 Phase 2: Project Preparation2.3 Phase 3: Data Gathering2.4 Phase 4: Risk Analysis2.4.1 Assets2.4.2 Threat Agents and Threat Actions2.4.2.1 Threat Agents2.4.2.2 Threat Actions2.4.3 Vulnerabilities2.4.4 Security Risk2.5 Phase 5: Risk Mitigation2.5.1 Safeguards2.5.2 Residual Security Risk2.6 Phase 6: Risk Reporting and Resolution2.6.1 Risk ResolutionExercisesNotesBibliography
3 Project Definition
3.1 Ensuring Project Success3.1.1 Success Definition3.1.1.1 Customer Satisfaction3.1.1.2 Identifying the Customer3.1.1.3 Quality of Work3.1.1.3.1 Quality Aspects3.1.1.4 Completion within Budget3.1.2 Setting the Budget3.1.3 Determining the Objective3.1.4 Limiting the Scope3.1.4.1 Under-scoping3.1.4.2 Over-scoping3.1.4.3 Security Controls3.1.4.3.1 Administrative Security Controls3.1.4.3.2 Physical Security Controls3.1.4.3.3 Technical Security Controls3.1.4.4 Assets3.1.4.4.1 Tangible Assets3.1.4.4.2 Intangible Assets3.1.4.5 Reasonableness in Limiting the Scope3.1.5 Identifying System Boundaries3.1.5.1 Physical Boundary3.1.5.2 Logical Boundaries3.1.6 Specifying the Rigor3.1.7 Sample Scope Statements3.2 Project Description3.2.1 Project Variables3.2.2 Statement of Work (SOW)3.2.2.1 Specifying the Service Description3.2.2.2 Scope of Security Controls3.2.2.3 Specifying Deliverables3.2.2.4 Contract Type3.2.2.4.1 Time and Materials Contract3.2.2.4.2 Firm-Fixed-Price Contract3.2.2.5 Contract Terms3.2.2.5.1 Determining Needs3.2.2.5.2 Determining Next-Best Alternative3.2.2.5.3 Negotiating Project MembershipExercisesBibliography
4 Security Risk Assessment Preparation
4.1 Introduce the Team4.1.1 Introductory Letter4.1.2 Project Kickoff Call4.1.3 Pre-Assessment Briefing4.1.4 Obtain Proper Permission4.1.4.1 Policies Required4.1.4.2 Permission Required4.1.4.3 Scope of Permission4.1.4.4 Accounts Required4.2 Review Business Mission4.2.1 What Is a Business Mission?4.2.2 Obtaining Business Mission Information4.3 Identify Critical Systems4.3.1 Determining Criticality4.3.1.1 Determine Protection Requirements4.3.1.2 Determine Mission Criticality4.3.1.3 Define Critical Systems4.4 Identify Asset Classes4.4.1 Checklists and Judgment4.4.2 Asset Sensitivity/Criticality Classification4.4.2.1 Approach 1: Find Asset Classification Information Elsewhere4.4.2.2 Approach 2: Create Asset Classification Information4.4.2.3 Approach 3: Determine Asset Criticality4.4.3 Asset Valuation4.4.3.1 Approach 1: Binary Asset Valuation4.4.3.2 Approach 2: Classification-Based Asset Valuation4.4.3.3 Approach 3: Rank-Based Asset Valuation4.4.3.4 Approach 4: Consensus Asset Valuation4.4.3.5 Approaches 5–7: Accounting Valuation Approaches4.4.3.5.1 Approach 5: Cost Valuation4.4.3.5.2 Approach 6: Market Valuation4.4.3.5.3 Approach 7: Income Valuation4.5 Identifying Threats4.5.1 Threat Components4.5.1.1 Threat Agent4.5.1.2 Threat Action4.5.1.3 Threat Agent and Threat Action Pairing4.5.2 Threat Statements4.5.3 Validating Threat Statements4.5.3.1 Factors Affecting Threat Statement Validity4.6 Determine Expected ControlsExercisesNoteBibliography
5 Data Gathering
5.1 Security Control Representation5.1.1 Data Gathering on the Population5.1.2 Data Gathering on a Sample5.1.2.1 Determining Sample Size5.1.2.2 Sampling Objectives5.1.2.3 Sampling Types5.1.3 Use of Sampling in Security Testing5.1.3.1 Approach 1: Representative Testing5.1.3.2 Approach 2: Selected Sampling5.1.3.3 Approach 3: Random Sampling5.2 Evidence Depth5.3 The RIIOT Method of Data Gathering5.3.1 RIIOT Method Benefits5.3.2 RIIOT Method Approaches5.3.2.1 Review Documents or Designs5.3.2.1.1 The Importance of Security Documents5.3.2.1.2 Documents to Request5.3.2.1.3 Policy Review within Regulated Industries5.3.2.1.4 RIIOT Document Review Technique5.3.2.2 Interview Key Personnel5.3.2.2.1 Selecting the Interviewer5.3.2.2.2 Interview Requests5.3.2.2.3 Preparing for the Interview5.3.2.2.4 Conducting the Interview5.3.2.2.5 Documenting the Interview5.3.2.2.6 Flexibility in the Process5.3.2.2.7 Questionnaire Preparation5.3.2.3 Inspect Security Controls5.3.2.4 Observe Personnel Behavior5.3.2.4.1 Observation Guidance5.3.2.5 Test Security Controls5.3.2.5.1 Security Testing Documentation5.3.2.5.2 Coverage of Testing5.3.2.5.3 Types of Security Testing5.3.2.5.3.1 Information Accuracy Testing5.3.2.5.3.2 Vulnerability Testing5.3.2.5.3.3 Penetration Testing5.3.3 Using the RIIOT Method5.3.3.1 Determining Appropriate RIIOT Approaches5.3.3.2 Assigning RIIOT Activities5.3.3.3 RIIOT Applied to Administrative, Physical, and Technical ControlsExercisesBibliography
6 Administrative Data Gathering
6.1 Administrative Threats and Safeguards6.1.1 Human Resources6.1.1.1 Human Resource Threats6.1.1.2 Human Resource Safeguards6.1.1.2.1 Recruitment6.1.1.2.2 Employment6.1.1.2.3 Termination6.1.2 Organizational Structure6.1.2.1 Organizational Structure Threats6.1.2.2 Organizational Structure Safeguards6.1.2.2.1 Senior Management6.1.2.2.2 Security Program6.1.2.2.3 Security Operations6.1.2.2.4 Audit6.1.3 Information Control6.1.3.1 Information Control Threats6.1.3.2 Information Control Safeguards6.1.3.2.1 Sensitive Information6.1.3.2.2 User Accounts6.1.3.2.3 User Error6.1.3.2.4 Asset Control6.1.4 Business Continuity6.1.4.1 Business Continuity Threats6.1.4.2 Business Continuity Safeguards6.1.4.2.1 Contingency Planning6.1.4.2.2 Incident Response Program6.1.5 System Security6.1.5.1 System Security Threats6.1.5.2 Organizational Structure Safeguards6.1.5.2.1 System Controls6.1.5.2.2 Application Security6.1.5.2.3 Configuration Management6.1.5.2.4 Third-Party Access6.2 The RIIOT Method: Administrative Data Gathering6.2.1 Determining Appropriate RIIOT Approaches for Administrative Controls6.2.2 Review Documents Regarding Administrative Controls6.2.2.1 Documents to Review6.2.2.2 Review Documents for Clarity, Consistency, and Completeness6.2.2.3 Review Documents for Expected Elements6.2.2.3.1 Reviewing Information Security Policies6.2.2.3.1.1 Senior Management Statement6.2.2.3.1.2 Acceptable-Use Policy6.2.2.3.1.3 Access Control Policy6.2.2.3.1.4 Authentication and Account Management Policy6.2.2.3.1.5 Backup and Restoration Policy6.2.2.3.1.6 Cryptographic Control Policy6.2.2.3.1.7 Data Classification, Handling and Retention Policy6.2.2.3.1.8 Media Protection Policy6.2.2.3.1.9 Mobile Device Policy6.2.2.3.1.10 Physical Security/Environmental Controls Policy6.2.2.3.1.11 Privacy Program Policy6.2.2.3.1.12 Privacy—Web Privacy Notice6.2.2.3.1.13 Systems and Communications Security Policy6.2.2.4 Reviewing Information Security Plans, Processes, and Procedures6.2.2.4.1.1 Business Contingency Plan6.2.2.4.1.2 Change Control Procedures6.2.2.4.1.3 Disaster Recovery Plan6.2.2.4.1.4 Incident Response Plan6.2.2.4.1.5 Information Security Program Procedures6.2.2.4.1.6 Other Operational Procedures6.2.2.4.1.7 Security Awareness and Training Program6.2.2.4.1.8 Software Development Life Cycle Process6.2.2.4.1.9 Termination Procedures6.2.2.4.1.10 Vendor Security Risk Management Program6.2.2.5 Security Work Product Review6.2.3 Interview Personnel Regarding Administrative Controls6.2.3.1 Administrative Interview Planning6.2.3.2 Administrative Interview Topics6.2.3.3 Administrative Interview Subjects6.2.3.4 Administrative Interview Questions6.2.3.4.1 Incident Response Interview Questions6.2.3.4.2 Security Operations Interview Questions6.2.3.4.3 Security Program Interview Questions6.2.4 Inspect Administrative Security Controls6.2.4.1 Inspection—Listing Administrative Security Controls6.2.4.2 Inspection—Verify Information Gathered6.2.4.3 Inspection—Determine Vulnerabilities6.2.4.4 Inspection—Document and Review Findings6.2.4.5 Inspection—The Security Organization6.2.4.5.1 Organizational Structure6.2.4.5.2 Budget and Resources6.2.4.5.3 Roles and Responsibilities6.2.5 Observe Administrative Behavior6.2.6 Test Administrative Security Controls6.2.6.1 Information Labeling Testing6.2.6.2 Media Destruction Testing6.2.6.2.1 Approach 1: TRASHINT6.2.6.2.2 Approach 2: Sanitization Test6.2.6.3 Account and Access Control Procedures Testing6.2.6.3.1 Approach 1: Process Test6.2.6.3.2 Approach 2: Process Audit—Sample6.2.6.3.3 Approach 3: Process Audit—Complete6.2.6.4 Outsourcing and Information Exchange6.2.6.4.1 Outsourcing Review6.2.6.4.1.1 Approach 1: Review Contracts6.2.6.4.1.2 Approach 2: Review Available Assessments6.2.6.4.1.3 Approach 3: Review Questionnaire ResponsesExercisesBibliography
7 Technical Data Gathering
7.1 Technical Threats and Safeguards7.1.1 Information Control7.1.1.1 Information Control Threats7.1.1.2 Information Control Safeguards7.1.1.2.1 User Error7.1.1.2.2 Sensitive and Critical Information7.1.1.2.3 User Accounts7.1.2 Business Continuity7.1.2.1 Business Continuity Threats7.1.2.2 Business Continuity Safeguards7.1.2.2.1 Contingency Planning7.1.2.2.2 Incident Response Program7.1.3 System Security7.1.3.1 System Security Threats7.1.3.2 System Security Safeguards7.1.3.2.1 System Controls7.1.3.2.2 Application Security7.1.3.2.3 Change Management7.1.4 Secure Architecture7.1.4.1 Secure Architecture Threats7.1.4.2 Secure Architecture Safeguards7.1.4.2.1 Topology7.1.4.2.2 Transmission7.1.4.2.3 Perimeter Network7.1.5 Security Components7.1.5.1 Security Component Threats7.1.5.2 Security Component Safeguards7.1.5.2.1 Access Control7.1.5.2.2 Continuous Monitoring7.1.6 Secure Configuration7.1.6.1 Secure Configuration Threats7.1.6.2 Secure Configuration Safeguards7.1.6.2.1 System Settings7.1.7 Data Security7.1.7.1 Data Security Threats7.1.7.2 Data Security Safeguards7.1.7.2.1 Storage7.1.7.2.2 Transit7.2 The RIIOT Method: Technical Data Gathering7.2.1 Determining Appropriate RIIOT Approaches for Technical Controls7.2.2 Review Documents Regarding Technical Controls7.2.2.1 Technical Documents to Request7.2.2.2 Review Technical Documents for Information7.2.2.3 Review Documents for Clarity, Consistency, and Completeness7.2.2.4 Review Documents for Expected Elements7.2.2.5 Reviewing System Information Documents7.2.2.5.1 Network Diagram7.2.2.6 Reviewing Previous Security Assessment Documents7.2.2.6.1 Vulnerability Scan Report7.2.2.6.2 Penetration Test Report7.2.2.6.3 Security Risk Assessment Report7.2.2.6.4 Information Technology/Security Audit Report7.2.2.7 Reviewing Technical Manuals7.2.2.8 Review Technical Security Designs7.2.2.8.1 Determine Security Requirements7.2.2.9 Basic Security Design Principles7.2.2.9.1 Common Areas for Investigation7.2.3 Interview Personnel Regarding Technical Controls7.2.3.1 Technical Interview Topics7.2.3.2 Technical Interview Subjects7.2.3.3 Technical Interview Questions7.2.3.3.1 Security Testing and Review Interview Questions7.2.3.3.2 Security Components Interview Questions7.2.3.3.3 Security Operations and Procedures Interview Questions7.2.4 Inspect Technical Security Controls7.2.4.1 List Technical Security Controls7.2.4.2 Verify Information Gathered7.2.4.2.1 Audit Logs7.2.4.2.2 Identity Management System7.2.4.2.3 Data Backup Technologies7.2.4.2.4 Vulnerability Scanning Tools7.2.4.2.5 Penetration Testing Tools7.2.4.2.6 Patch Management System7.2.4.2.7 Web and E-mail Filtering Tools7.2.4.2.8 Configuration Management7.2.4.2.9 Firewalls7.2.4.2.10 Intrusion Detection Systems7.2.4.2.11 System Hardening Guidance7.2.4.2.12 Operating Systems and Applications7.2.4.2.12.1 Sources of Checklists7.2.4.2.12.2 Use of Checklists7.2.4.3 Determine Vulnerabilities7.2.4.4 Document and Review Findings7.2.5 Observe Technical Personnel Behavior7.2.6 Test Technical Security Controls7.2.6.1 Monitoring Technology7.2.6.2 Audit Logs7.2.6.3 Anti-Virus Systems7.2.6.4 Automated Password Policies7.2.6.5 Virtual Private Network7.2.6.6 Firewalls, IDS, and System Hardening7.2.6.7 Vulnerability Scanning7.2.6.7.1 Stages of Vulnerability Scanning7.2.6.7.2 Vulnerability Scanning Tools7.2.6.7.2.1 Network Mapping7.2.6.7.2.2 Vulnerability Scanners7.2.6.7.2.3 Virus and Pest Scanning7.2.6.7.2.4 Application Scanners7.2.6.8 Penetration Testing7.2.6.9 Testing Specific Technology7.2.6.9.1 Modem Access Testing7.2.6.9.2 Wireless Network Testing7.2.6.9.3 PBX Testing7.2.6.9.4 VOIP TestingExercisesNotesBibliography
8 Physical Data Gathering
8.1 Physical Threats and Safeguards8.1.1 Utilities and Interior Climate8.1.1.1 Utility and Interior Climate Threats8.1.1.2 Utility and Interior Climate Safeguards8.1.1.2.1 Power Utility8.1.1.2.1.1 Power Safeguards8.1.1.2.2 Cooling Interior Climate8.1.1.2.2.1 Cooling Safeguards8.1.1.2.3 Humidity8.1.1.2.3.1 Humidity Safeguards8.1.2 Fire8.1.2.1 Fire Threats8.1.2.2 Fire Safeguards8.1.2.2.1 Fire Prevention8.1.2.2.1.1 Fire Prevention Safeguards8.1.2.2.2 Fire Detection8.1.2.2.2.1 Fire Detection Safeguards8.1.2.2.3 Fire Alarm8.1.2.2.3.1 Fire Alarm Safeguards8.1.2.2.3.1.1 Fire Alarm Installation Types8.1.2.2.4 Fire Suppression8.1.2.3 Fire Suppression Safeguards8.1.2.3.1 Stationary Suppression Systems8.1.3 Flood and Water Damage8.1.3.1 Flood and Water Threats8.1.3.2 Flood and Water Safeguards8.1.3.2.1 Flood and Water Exposure8.1.3.2.1.1 Flood and Water Exposure Safeguards8.1.3.2.2 Flood and Water Monitoring8.1.3.2.2.1 Flood and Water Exposure Safeguards8.1.3.2.3 Flood and Water Response8.1.3.2.3.1 Flood and Water Response Safeguards8.1.4 Other Natural Disasters8.1.4.1 Other Natural Disaster Threats8.1.4.2 Other Natural Disaster Safeguards8.1.4.2.1 General Natural Disasters8.1.4.2.1.1 Natural Disasters—General Protection Safeguards8.1.4.2.2 Lightning8.1.4.2.2.1 Lightning Safeguards8.1.4.2.3 Earthquake8.1.4.2.3.1 Earthquake Safeguards8.1.4.2.4 Volcano8.1.4.2.4.1 Volcano Safeguards8.1.4.2.5 Hurricane8.1.4.2.5.1 Hurricane Safeguards8.1.5 Workforce8.1.5.1 Workforce Threats8.1.5.2 Workforce Safeguards8.1.5.2.1 Personnel Screening8.1.5.2.2 Personnel Termination8.1.6 Perimeter Protections8.1.6.1 Perimeter Protection Threats8.1.6.2 Perimeter Protection Safeguards8.1.6.2.1 Barriers8.1.6.2.2 Lighting8.1.6.2.3 Physical Intrusion Detection8.1.6.2.3.1 Exterior Sensors8.1.6.2.3.2 Interior Sensors8.1.6.2.3.3 Video Surveillance Systems8.1.6.2.3.3.1 Video Surveillance System Capabilities8.1.6.2.4 Physical Access Control8.1.6.2.4.1 Badges8.1.6.2.4.2 Card Readers8.1.6.2.4.3 Biometrics8.1.6.2.4.4 Visitor Control8.1.6.2.4.5 Property Removal Prevention8.2 The RIIOT Method: Physical Data Gathering8.2.1 Determining Appropriate RIIOT Approaches for Physical Controls8.2.2 Review Documents Regarding Physical Controls8.2.2.1 Physical Documents to Request8.2.2.2 Review Physical Documents for Information8.2.2.3 Review Documents for Currency and Capability8.2.2.4 Review Documents for Expected Elements8.2.2.5 Reviewing Physical Safeguard Information Documents8.2.2.6 Reviewing Previous Physical Assessment Documents8.2.2.7 Reviewing Building and Site Architecture Documents8.2.2.8 Reviewing Procedures and Procedure Work Products8.2.3 Interview Physical Personnel8.2.3.1 Physical Security Interview Topics8.2.3.2 Physical Security Interview Subjects8.2.3.3 Physical Security Interview Questions8.2.3.3.1 Utilities Interview Questions8.2.3.3.2 Physical Security Procedures Interview Questions8.2.4 Inspect Physical Security Controls8.2.4.1 Listing Physical Security Controls8.2.4.2 Verify Information Gathered8.2.4.2.1 Logs, Records, and Audit Files8.2.4.2.2 Perimeter Security8.2.4.3 Determine Physical Vulnerabilities8.2.4.4 Document and Review Physical Findings8.2.5 Observe Physical Personnel Behavior8.2.6 Test Physical Security Safeguards8.2.6.1 Doors and Locks8.2.6.2 Intrusion DetectionExercisesNotesBibliography
9 Security Risk Analysis
9.1 Obtaining Measurement Data for Security Risk Analysis9.2 Qualitative Security Risk Analysis Techniques9.2.1 Qualitative Security Risk Analysis Advantages9.2.2 Qualitative Security Risk Analysis Disadvantages9.3 Quantitative Security Risk Analysis Techniques9.3.1 Classic Quantitative Security Risk Assessment Formulas9.3.2 Estimation9.3.3 Probability Distributions9.3.4 Monte Carlo Simulation9.3.4.1 Ransomware Example—Monte Carlo Simulation9.3.4.2 Building Monte Carlo Simulation Models9.3.4.3 Quantitative Analysis Advantages9.3.4.4 Quantitative Analysis Disadvantages9.4 Summarizing Security Risk Analysis9.4.1 Team Review of Security Risk Summary9.4.2 Deriving Overall Security Risk9.4.3 Prioritization of Security RiskExercisesNotesBibliography
10 Security Risk Analysis Worked Examples
10.1 RIIOT FRAME10.1.1 RIIOT FRAME—Qualitative10.1.1.1 Qualitative Threat Assessment: (Phase 1)10.1.1.2 Qualitative Vulnerability Assessment: (Phases 2A and 2B)10.1.1.2.1 The RIIOT FRAME for Qualitative Vulnerability Review Approach10.1.1.3 Qualitative Threat Occurrence Likelihood10.1.1.4 Qualitative Expected Impact10.1.1.4.1 Qualitative Impact Assessment (Phase 3)10.1.1.4.2 Qualitative Vulnerability Assessment: Detective and Corrective Controls (Phase 2B)10.1.1.5 Qualitative Expected Impact10.1.1.6 Qualitative Security Risk Calculation10.1.2 RIIOT FRAME—Quantitative10.1.2.1 Obtaining Quantitative Data10.1.2.1.1 Direct Threat Frequency or Impact Data10.1.2.1.2 Indirect Threat Frequency or Impact Data10.1.2.2 Quantitative Threat Occurrence Likelihood (Phase 1 and 2A)10.1.2.3 Quantitative Expected Impact: Phase 3 and 2B10.1.2.4 Quantitative Security Risk Calculation10.1.3 Qualitative and Quantitative ComparisonExercisesNotes
11 Security Risk Mitigation
11.1 Defining Security Risk Appetite11.2 Selecting Safeguards11.2.1 Method 1: Missing Control Leads to Safeguard Selection11.2.2 Method 2: People, Process, Technology11.2.3 Method 3: The “Nine-Cell”11.2.4 Method 4: Available Technology11.3 Safeguard Solution Sets11.3.1 Safeguard Cost Calculations11.3.2 Safeguard Effectiveness11.3.2.1 Justification through Judgment11.3.2.2 Cost–Benefit Analysis11.4 Establishing Security Risk ParametersExercisesNotes
12 Security Risk Assessment Reporting
12.1 Cautions in Reporting12.2 Pointers in Reporting12.3 Report Structure12.3.1 Executive-Level Report12.3.2 Base Report12.3.3 Appendices and Exhibits12.4 Document Review Methodology: Create the Report Using a Top-Down Approach12.4.1 Document Specification12.4.2 Draft12.4.3 Final12.5 Assessment Brief12.6 Action PlanExercisesBibliography
13 Security Risk Assessment Project Management
13.1 Project Planning13.1.1 Project Definition13.1.2 Project Planning Details13.1.2.1 Project Phases and Activities13.1.2.2 Phases and Activities Scheduling13.1.2.3 Allocating Hours to Activities13.1.3 Project Resources13.1.3.1 Objectivity vs. Independence13.1.3.2 Internal vs. External Team Members13.1.3.3 Skills Required13.1.3.3.1 Specific Security Risk Assessment Skills13.1.3.3.2 Certifications13.1.3.3.3 General Consulting Skills13.1.3.3.3.1 Criticisms of Consultants13.1.3.3.3.2 Overcoming Critics13.1.3.3.3.3 Conflict of Interest13.1.3.3.4 General Writing Skills13.2 Project Tracking13.2.1 Hours Tracking13.2.1.1 Calendar Time Tracking13.2.2 Project Progress Tracking13.3 Taking Corrective Measures13.3.1 Obtaining More Resources13.3.2 Using Management Reserve13.4 Project Status Reporting13.4.1 Report Detail13.4.2 Report Frequency13.4.3 Status Report Content13.5 Project Conclusion and Wrap-Up13.5.1 Eliminating “Scope Creep”13.5.2 Eliminating Project Run-OnExercisesNotesBibliography
14 Security Risk Assessment Approaches
14.1 Security Risk Assessment Methods14.1.1 14.1.2 OCTAVE14.1.2.1 OCTAVE (Original)14.1.2.2 OCTAVE-S14.1.2.3 OCTAVE-Allegro14.1.3 Information Security Assessment Methodology 2 (IRAM2)14.1.4 Factor Analysis of Information Risk (FAIR): Basic Risk Assessment Guide (BRAG)14.1.5 Factor Analysis of Information Risk (FAIR): Quantitative14.1.6 Review, Interview, Inspect, Observe, Test (RIIOT) Framework Risk Assessment Method: Example (FRAME)—Qualitative14.1.7 Review, Interview, Inspect, Observe, Test (RIIOT) Framework Risk Assessment Method: Example (FRAME)—Quantitative14.2 Security Risk Assessment FrameworksExercisesBibliography
Index

Content preview from The Security Risk Assessment Handbook, 3rd Edition

5 Data Gathering

One of the core phases of the security risk assessment project is the gathering of data on security controls within scope of the assessment. This phase involves the collection of evidence with respect to the security control existence and effectiveness within their existing environment and against the organizational security requirements. This phase of the security risk assessment is at the heart of the process and involves volumes of data, scores of activities, and many hours of effort. The data gathering phase is perhaps the most labor-intensive phase of the security risk assessment process and covers all of the organization’s security controls within the boundaries of the project.

The preparation for the data gathering phase ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

The Security Risk Assessment Handbook, 2nd Edition

Publisher Resources

ISBN: 9781000413250

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Security Risk Assessment Handbook, 3rd Edition

by Douglas Landoll

5 Data Gathering

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.