Risk Analysis using open FAIR and Adoption of right Security Controls

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1 | Copyright © 2015 Tata Consultancy Services Limited
Adoption of O-RA for Secure Architecture of an
E-commerce Platform
...

2
Agenda
Introduction to O-RA1
Security challenges in E-commerce2
Control considerations3
Summary4

3
Click to edit Master title styleIntroduction to O-RA Standard

4
O-RA (Risk Analysis)
A Standard that is intended to be applied toward the problem of managing the
frequency and magnitud...

5
Risk Analysis
Risk Assessment
Risk Analysis
Identify Evaluate Report
Determines the
significance of the
identified risk
...

6
A Few Key Objectives of O-RA
Used with companion O-RT standard to,
Establish a common language for the information secur...

7
Click to edit Master title styleIntroduction to O-RT Standard

8
O-RT (Risk Taxonomy)
A Standard to provide a single logical and rational taxonomical framework to
understand and/or anal...

9
Risk
Why do we Need a Taxonomy for Risk?
Software
Flaws or Faults
So , Is Risk = (Threat *
Vulnerability) / Controls?
If...

10
Risk Taxonomy – High Level
Estimates probable frequency
and magnitude of future loss
Probable frequency within a given
...

11
Risk Taxonomy – Loss Event Frequency
Threat Event
Frequency
Vulnerability
Probable frequency within a given timeframe t...

12
Risk Taxonomy – Loss Magnitude
Primary Loss
Secondary
Loss
Occurs directly as a result of threat
agent’s action on the ...

13
Click to edit Master title styleRisk Analysis – Deep Dive

14
Risk Analysis Stages
01
02
03
04
Scope the Analysis
Evaluate Loss Magnitude
Evaluate Loss Event
Frequency
Derive and Ar...

15
FAIR Basic Risk Analysis Methodology
 Identify the asset
at risk
 Identify the
threat
community
under
consideration
...

16
Click to edit Master title styleData Breaches in Retail Environment

17
Categories of Data Breach
Year 2013 may be remembered as the “year of the retailer breach”
*Source – Verizon 2014 Data ...

18
Breaches Per Asset
*Source – Verizon 2014 Data Breach investigations Report

19
Incident Classification
*Source – Verizon 2014 Data Breach investigations Report

20
Click to edit Master title styleMapping of O-RA to E-commerce Domain

21
The Scenario
An E-commerce portal specialized in selling gift items such as fragrance,
books, watches, sunglasses, bags...

22
Mapping of Stage 1 to E-commerce Platform
Scoping E-commerce Platform
Key Assets:
 Customer Data - personal details li...

23
Mapping of Stage 2 to E-commerce Platform
Evaluate LEF
Estimate the
Threat Event
Frequency
Estimate the
Threat Capabili...

24
Mapping of Stage 2 to E-commerce Platform
Evaluate LEF
Estimate
Resistance
Strength
Rating Description
Very High(VH) Pr...

25
Deriving Vulnerability and LEF using Monte Carlo Simulation
Loss Event frequency is Medium, meaning it can happen betwe...

26
Possible set of ranges to characterize Loss Magnitude for customer data misuse
Stage 3 – Loss Magnitude (Primary)
Prima...

27
Estimating Secondary Loss Probability
Estimating SLEF
Rating Description
Very High(VH) 90% to 100%
High(H) 70% to 90%
M...

28
Stage 3 – Loss Magnitude (Secondary)
Secondary Loss Magnitude
Loss Forms
Productivity Response Replacement Fines/
Judgm...

29
Stage 4 : Deriving Primary and Secondary Risk
Primary Risk is derived
as probable loss event
frequency(Medium) and prob...

30
Stage 4 : Deriving Overall Risk
Overall risk is very
High based on the
combination of
Primary and
Secondary risk
Qualit...

31
Click to edit Master title styleBasic Control Considerations in FAIR Analysis

32
Risk Controls
Risk
Loss
Magnitude
Loss Event
Frequency
Threat Event
Frequency
Vulnerability
Primary
Loss
Secondary
Loss...

33
Information Security Controls Mapping to E-commerce Platform
Avoidance Controls
 Firewall Filters – datacenter as well...

34
Information Security Controls Mapping to E-commerce Platform
(Contd..)
Vulnerability Controls
 Confidentiality, Integr...

35
References
Risk Taxonomy (O-RT),
Version 2.0, Open Group
Standard, C13K, published
by The Open Group,
October 2013; ref...

Thank You
IT Services
Business Solutions
Consulting

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Network Forensics and Practical Pac... by Priyanka Aash 5596 views
Practical Applications of Block Cha... by Priyanka Aash 11750 views
Security Strategy and Tactic with C... by Priyanka Aash 1960 views
Enterprise Security Architecture by Priyanka Aash 2496 views
Keynote Session : NIST - Cyber Secu... by Priyanka Aash 1544 views
SOC Architecture - Building the Nex... by Priyanka Aash 4914 views

View on Slideshare

1 of 36 Ad

View on Slideshare

1 of 36 Ad