Some of you maybe made some risk analysis in the past, and maybe some others use to do risk analysis in a regular basis. Some people use Octave, CRAMM, NIST or other risk analysis methodologies, but… Have you ever though if you have a GAP in the way you use to do your analysis? Have you ever thought that you may have a lack of visibility in the way it makes your analysis? This presentation if focuses on the last question.

1. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
Ramiro Cid | @ramirocid
Thinking on risk analysis

2. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
2
Index
1. Introduction Page 3
2. Perceived and relevant universe Page 4
3. Reasons of the lack of visibility Page 5
4. What is the correct order so ? Page 6
5. So what steps do I have to follow in my risk analysis? Page 7

3. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
Introduction
Some of you maybe made some risk analysis in the past, and maybe some others use to
do risk analysis in a regular basis.
Some people use Octave, CRAMM, NIST or other risk analysis methodologies, but…
Have you ever though if you have a GAP in the way you use to do your analysis?
Have you ever thought that you may have a lack of visibility in the way it makes your
analysis?
This presentation if focuses on the last question.

4. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
Perceived and relevant universe
An observer (for example a person who is doing a risk analysis) have a BIG lack of
visibility of the reality which is doing the analysis. In general ways we have something like
this:
The ONLY data present in the Risk Analysis is that the
Observer consider them “RELEVANT” (green area in the graph)

5. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
Reasons of the lack of visibility
The lack of visibility of the observer who is doing the analysis have multiple reasons, we
can mention some usual causes:
a. Lack of knowledge of the environment under analysis
b. Lack of time to do a complete risk analysis in the correct way.
c. Lack of knowledge about best practices on IT Security.
d. Too focused on some aspects/domains of the environment but forgetting others.

6. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
What is the correct order so ?
First revise the vulnerabilities and later analyze related threats? or it would be better to
create different scenarios and then to analyze the possible threats and our vulnerabilities
in relation of them?
For not limit our analysis, the best option is to do both analysis.
As we could see in previous slides, the analysis of the observer is very limited so we
need to try to open as much as possible our risk analysis to get a better result.
VERY important: Not to limit our analysis !

7. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
So what steps do I have to follow in my risk analysis?
1. Do the list of assets to analyze in our scope
2. Complete the list of threats in relation of each asset
3. Complete the list of vulnerabilities per each threat
4. Calculate the risk
5. Complete the list of controls to mitigate the risk
6. Estimate the residual risk or “risk-after-controls” (risk after to apply the controls)
7. Create different scenarios which could impact in our assets
8. Revise the vulnerabilities we have in relation of them
9. Estimate the possible impact
The complete analysis: In both ways !

8. ramirocid.com ramiro@ramirocid.com Twitter: @ramirocid
Questions ?
Many thanks !
Ramiro Cid
CISM, CGEIT, ISO 27001 LA, ISO 22301 LA, ITIL
ramiro@ramirocid.com
@ramirocid
http://www.linkedin.com/in/ramirocid
http://ramirocid.com http://es.slideshare.net/ramirocid
http://www.youtube.com/user/cidramiro