Risk Measurement and Management Using Open Source Tooling
•
1 like•196 views
From the September 24, 2020 OWASP Columbus meetup
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to Risk Measurement and Management Using Open Source Tooling
Similar to Risk Measurement and Management Using Open Source Tooling (20)
Recently uploaded
Recently uploaded (20)
Risk Measurement and Management Using Open Source Tooling
- 1. @jkuemerle Risk Measurement and Management Using Open Source Tooling Joe Kuemerle / joe@kuemerle.com / @jkuemerle https://www.flickr.com/photos/carlbob/3983465822
- 2. @jkuemerle Building CTFs To Teach Non-Security Folks Everyone Can Play! Joe Kuemerle / joe@kuemerle.com / @jkuemerle https://upload.wikimedia.org/wikipedia/commons/5/5a/Muggle_Quidditch_Game_in_Vancouver_2.jpg https://www.bsidesbos.org/
- 13. @jkuemerle Likelihood ★ Who has access to the system? ○ Restricted Internal Only ○ Internal only ○ Partner users ○ Authenticated customers ○ Anonymous Internet users ★ How exposed is the knowledge of the system? ○ Confidential ○ Internal ○ Partner ○ Public knowledge (public documentation, open source, etc.) Impact ★ What types of information could be disclosed? ○ Public data ○ User/partner data or metadata ○ Administrative data or metadata ○ Authentication secrets ○ Compliance Data ★ What is the use case of the system? ○ Internal use only ○ Internal and Partner use only ○ Deprecated customer use ○ Deprecated public use ○ Standard customer use ○ Standard public use ○ Strategic customer use ○ Strategic public use
- 15. @jkuemerle Likelihood Score = SUM(Likelihood) / COUNT(Likelihood) Impact Score = SUM(Impact) / COUNT(Impact) https://www.flickr.com/photos/83346641@N00/5002736203
- 16. @jkuemerle Likelihood ★ Who has access to the system? ○ Restricted Internal Only ○ Internal only ○ Partner users ○ Authenticated customers ○ Anonymous Internet users ★ How exposed is the knowledge of the system? ○ Confidential ○ Internal ○ Partner ○ Public knowledge (public documentation, open source, etc.)
- 17. @jkuemerle Likelihood Score = [SUM(Likelihood) / COUNT(Likelihood)] || Override Impact Score = [SUM(Impact) / COUNT(Impact)] || Override
- 19. @jkuemerle Mitigating Factors ★ Technical debt ○ Very Low ○ Low ○ Moderate ○ High ○ Very High ★ Security Coverage ○ None ○ Some ○ Full
- 21. @jkuemerle Mitigation = (Value * Weightage) / Scale Factor https://www.flickr.com/photos/83346641@N00/5016097457
- 22. @jkuemerle ★ Technical debt ○ Very Low ○ Low ○ Moderate ○ High ○ Very High
- 23. @jkuemerle Residual Risk = Inherent Risk - Mitigation Very Low - 1 Low - 2 Moderate - 3 High - 4 Very High - 5
- 32. @jkuemerle Recap ★ Why ★ What ★ How
- 33. @jkuemerle Next Steps ★ Take it with you ★ Feedback and suggestions http://bit.ly/jkuemerle-feedback ★ Discuss & contribute
- 34. @jkuemerle Resources ★ https://wiki.owasp.org/index.php/OWASP_Risk_Rating_Methodology ★ https://github.com/salesforce/salesforce-risk ★ Application Security Risk: Assessment and Modeling: https://www.isaca.org/resources/isaca-journal/issues/2016/volume-2/a pplication-security-risk-assessment-and-modeling ★ https://help.veracode.com/reader/kJC1iOtXp8N~rCtV8P9jhw/29ydXhnfF nCOc5Rue0~3uA ★ OWASP SAMM Application Risk Profile: https://owaspsamm.org/model/design/threat-assessment/stream-a/