This document summarizes a presentation on risk management 101. It defines key terms like threat, vulnerability, risk, and types of risk. It outlines the components of risk management frameworks including identifying threats, assessing risk, evaluating options, and taking action. It discusses different risk management standards and frameworks. Finally, it provides an overview of information risk management practices at the Minnesota Department of Human Services.

1. Risk Management 101 Barry Caplin Chief Information Security Officer MN Department of Human Services MN Government IT Symposium Thurs. Dec. 13, 2007 Session 74

2. Agenda In the beginning… Definitions – Threat, Vulnerability, Risk Types of Risk Risk Management components Frameworks and standards Information Risk Management at DHS

3. In The Beginning…

4. In The Beginning… There were Humans…

5. In The Beginning… And Beasts…

6. And the concept of Risk was born...

7. Risk Always been with us Viewed as a negative Attempt to reduce

8. Magic?

9. Definitions

10. Threat Defn : Source or warning of probable impending danger (Actor) - wikipedia Direct/Intended – malicious hacker, thief, malware Indirect/Unintended – user, weather Person or Thing Task : Must analyze assets and environment to determine threats

11. Vulnerability Defn : the state of being exposed; liable to succumb – dictionary.com Measures – physical, financial, operational Task : Must analyze vulnerability to identified threats

12. Impact Defn : to effect, influence or alter – dictionary.com Measures – cost, time delays, damage Task : determine impact of action of threat to which we are vulnerable

13. Threat, Vulnerability, Impact => Risk (probability of event × impact = risk)

14. Risk Defn : Exposure to the chance of injury or loss (Event) – dictionary.com Based on action of threat Components: Probability of occurrence Impact of event Task : Identification and Disposition Accept (or Ignore) Mitigate Transfer

15. Types of Risk Prof. John Adams, University College London UK risk expert Direct – directly perceived – obvious Scientific – determined via science Virtual Risk – everything else!

16. D irectly perceived

17. Types of Risk Perceived through science

18. Types of Risk Virtual Risk What we are all involved in! Project risk/Operational risk Physical/Data security risk Terrorism/Homeland Security Weather

19. Virtual Risk Virtual Risk Difficult to “prove” Experts don’t know or do not agree We don’t know what we don’t know

20. Risk Management A discipline for living with the possibility that future events may cause adverse effects. http://www.sei.cmu.edu/risk/index.html

21. Risk Management The iterative framework and processes for: Identifying threats (imagining virtual threats) Assessing Evaluating options Acting.

22. Identify Threats Research Survey Brainstorm

23. Assess Threat Assessment Vulnerability Assessment Impact Assessment Risk Assessment Qualitative – subjective scoring Quantitative – objective or measured values

24. Disposition of Risk Accept (or Ignore) – what is the? Mitigate – what is the cost? Transfer – via contract or insurance – what terms? Cost?

25. Economics of Risk Management Cost of control < Cost of loss Cost of compliance (pain) < Cost of circumvention (gain)

26. Ineffective Risk Mitigation

27. Evaluate and Act Risk Management Committee or SMT Document decisions Get it done!

28. Frameworks for Risk Management CarnegieMellon (CMU SEI) – software NIST/FISMA – information systems CRESP – Consortium for Risk Evaluation with Stakeholder Participation - nuclear COSO – Committee Of Sponsoring Organizations – info systems COBIT – Control Objectives for IT SOMAP – Security Officers Management & Analysis Project – Open Information Security RM Handbook OCTAVE - Operationally Critical Threat, Asset, and Vulnerability Evaluation Commercial - many

29. Treasury Board of Canada Integrated Risk Management Framework – 2001 “ Risk-Smart” Workforce and Environment 4 Elements: Develop Risk Profile Establish organizational function Practice and integrate Ensure continuous learning http://www.tbs-sct.gc.ca/pubs_pol/dcgpubs/riskmanagement/rmf-cgr01-1_e.asp

30. Security and Risk Management Security is a subset of Risk Management RM -> Security Solutions -> Compliance Security/Business balance Act on appropriate risks Consider the “costs”

31. At DHS Information Risk Management at DHS Based on elements of NIST, COBIT and OCTAVE SLM – Security Lifecycle Management Information Policy, Awareness and Compliance Business Continuity Planning

32. Resources Information Risk Management at DHS CMU SEI – www.sei.cmu.edu/risk COBIT – www.isaca.org /cobit COSO – www.coso.org CRESP – www.cresp.org NIST/FISMA – csrc.nist.gov SOMAP – www.somap.org OCTAVE – www.cert.org /octave Prof. John Adams – john- adams.co.uk

33. Discussion?