More Related Content
Similar to Crash Course: Managing Cyber Risk Using Quantitative Analysis
Crash Course: Managing Cyber Risk Using Quantitative Analysis
- 1.
- 2. Crash Course: Managing CyberRisk Using Quantitative Analysis
- 3. Disclaimer: I am nota lawyer This is not legal advice
- 4. Cost of cybercrime by 2019 – Juniper Networks
- 7. $231.94 Billion Cyber SecurityMarket by 2022
- 8.
- 9.
- 10. Agenda Part 1 –Case Study Part 2 – Concepts and Theory Part 3 – Application of Concepts
- 11. Part 1 –Case Study:
- 13. Part 2 –Concepts and Theory
- 14. Concepts • Risk &Uncertainty • Risk Management • Risk Analysis
- 15.
- 16. COBIT: Risk isgenerally defined as the combination of the probability of an event and its consequence. FAIR: The probable frequency and magnitude of future loss. AIE/Hubbard: 1) The probability and magnitude of a loss, disaster, or other undesirable event. 2) A state of uncertainty where some of the possibilities involve a loss, catastrophe, or other undesirable outcome. Risk
- 17. Measurement of Risk:A set of possibilities each with quantified probabilities, and quantified losses. For example: “we believe there is a 40% chance the proposed oil well will be dry with a loss of $12 million in exploratory drilling costs.” Risk
- 18. AIE/Hubbard: The lackof complete certainty, that is, the existence of more than one possibility. The “true” outcome/state/result/value is not known. Measurement of Uncertainty: A set of probabilities assigned to a set of possibilities. For example: “there is a 60% chance this market will more than double in five years, a 30% chance it will grow at a slower rate, and a 10% chance the market will shrink in the same period”. Uncertainty
- 19.
- 20. FAIR: The combinationof personnel, policies, processes, and technologies that enable an organization to cost-effectively achieve an acceptable level of loss exposure. AIE/Hubbard: Long definition: The identification, assessment, and prioritization of risks followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of unfortunate events Shorter definition: Being smart about taking chances Risk Management
- 21. ISO Guide 73:2002:Coordinated activities to direct and control an organization with regard to risk ISACA CRISC: The coordinated activities to direct and control an enterprise with regard to risk. Risk management is the identification, assessment and prioritization of risk followed by coordinated and economical application of resources to minimize, monitor, and control the probability and/or impact of adverse events or to maximize the realization of opportunities. Risk Management
- 22. • Avoid • Mitigate •Transfer • Accept • Progress • Risk Indicators • Operating Environment Risk Factors • Threat • Vulnerabilities • Impact • Issues • Tolerance / Appetite Discover Analyze TreatMonitor iskManagementProcess
- 24.
- 25. You can’t manage whatyou don’t measure.
- 26. Why do wemeasure (aka analyze) risk?
- 27. Informing Decisions ● Howmuch risk do we have? ● How much should we invest in security? ● Where should we invest? ● What are we getting for our investment?
- 28. What if wemeasured everything like we measure cyber risk?
- 29.
- 30.
- 31. Mental Models AnalyticalModels How do we assess risk?
- 32. Analytical Methods Source: NIST800-30r1 – Guide for Conducting Risk Assessments
- 33.
- 34.
- 35.
- 38.
- 40. Quantitative risk analysis: Howdo we do it?
- 41. Risk Analysis Basics 1.Risk Scenarios 2. Risk Models 3. Simulations
- 42. Risk Scenario Scenarios area powerful tool in a risk manager’s armory— they help professionals ask the right questions and prepare for the unexpected. Scenario analysis has become a ‘new’ and best practice in enterprise risk management (ERM) (Source: isaca.org)
- 43. Example Risk ScenarioStatement Risk scenario statement: What is the risk associated with PHI being exposed via a lost/stolen laptop?
- 45. Essentially, all models arewrong, but some are useful. - George E. P. Box
- 46. Risk Models HelpUs: ●Decompose complex risk issues. ●Understand correlated relationships between variables/risk factors. ●Diagnose disagreements/issues. ●Bring credibility to our findings. ●Enable conversations.
- 49. Simulations Two primary tools: a)Probability Distributions (PERT) b) Monte Carlo Simulation (Stochastic Modeling)
- 50. Monte Carlo Simulation Computerizedmathematical technique that allows people to account for risk in quantitative analysis and decision making.
- 51. Pert Distibutions Form ofprobability distribution used to model expert data.
- 52.
- 53.
- 54. What is FAIR? FactorAnalysis of Information Risk Published by Jack Jones in 2005 Adopted by the Open Group in 2014 ● Risk Taxonomy Standard ● Risk Analysis Standard
- 55. Forms of Loss ●Productivity ● Response ● Replacement ● Fines/Judgement ● Competitive Advantage ● Reputation
- 56. Loss Magnitude Risk Loss Event Frequency The probablefrequency and probable magnitude of loss.
- 57. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 58. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 59. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 60. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 61. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 62. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 63. Loss Event Frequency Loss Magnitude Threat Event Frequency Risk Vulnerability Contact Frequency Probability ofAction Threat Capability Resistance Strength
- 64. Loss Event Frequency Loss Magnitude Secondary Loss Factors Risk PrimaryLoss Factors Organizational Loss Factors External Loss Factors Asset Loss Factors Threat Loss Factors
- 65. Loss Event Frequency Loss Magnitude Secondary Loss Factors Risk PrimaryLoss Factors Organizational Loss Factors External Loss Factors Asset Loss Factors Threat Loss Factors
- 66. Loss Event Frequency Loss Magnitude Secondary Loss Factors Risk PrimaryLoss Factors Organizational Loss Factors External Loss Factors Asset Loss Factors Threat Loss Factors
- 67. Part 3 –Exercises
- 68. Exercise 1: GuessMy Weight
- 69. Exercise 1: PertDistribution Guess my weight ●Min: ●Max: ●Most Likely: ●Confidence:
- 70. Exercise 2: Guess MyWeight…in Hot Tamales!
- 71. Hot Tamale vsPlain M&M
- 72. Exercise 3: Auditors reportlack of laptop encryption is a “high risk” issue. Encryption will require a $200-250K investment. CFO wants to know if this is worth the investment.
- 73. Laptop Theft Breach Investigation ClassAction Fine Judgement 50% probability (once every 2 years) 50% prob. 0 – 100K records 5% prob. 10% prob. 10% prob. 5% prob. $50K - $4.5M $100K - $20M
- 74. Primary Loss EventFrequency Min (95% CI) Most Likely Max (95% CI) LEF 0 1 5
- 75. Primary Loss Magnitude Min (95%CI) Most Likely Max (95% CI) Replacement Costs $1,200 $1,750 $2,500 Response Costs $2,500 $75K $250K
- 76. Secondary Loss Magnitude Min (95%CI) Most Likely Max (95% CI) Response Costs $100K $250K $8M Fines / Judgement $0 $0 $10M
- 78.
- 79.
- 80.
- 81. “The significant problemswe face cannot be solved at the same level of thinking with which we created them.”
- 82.