This document summarizes a presentation on security risk management. It begins with introducing the presenter and their background. It then discusses some recent security incidents in Vietnam, including attacks on a bank and airline. The presentation defines security risk management and the risk management process. It describes assessing risks using threats, vulnerabilities, and impacts. It also discusses different types of risks, controls, risk assessment methodologies, and risk treatment options. The presentation emphasizes that effective risk management requires senior management support, a suitable framework, communication, and following an ongoing process.

1. Security Risk Management, tough
path to success
Presenter: Vi Minh Toai
Date: Sep 10, 2016
Security Bootcamp 2016 - Dong Thap

2. Xin cảm ơn các nhà tài trợ

3. Who am I?
• 10+ years of working experience in IT industry.
• IT Security Manager of RMIT Vietnam University.
• Certificates: CISSP, CISM, CEH
• Email: minhtoai@gmail.com

4. Something you should know:
• Silence your phone.
• Raise questions at the end of the present.
• WC.
• Emergency exit.

5. Agenda
• Several Vietnam Security Incidents in 2016
• Security Risk Management

6. Several Vietnam Security Incidents in 2016
• May 2016: TPBank
• July 2016: Vietnam Airlines (Jul 29)
• August 2016: Vietcombank (Aug 04, Aug 16, Aug 19)

7. Security incident – Vietnam Airlines
Vietnam Airlines

8. Security incident - Vietnam Airlines (cont.)
• Possible Impact:
• Flight safety.
• Reputation lost. (TRUST)
• Over 400,000 accounts of Vietnam Airlines’ members
were leaked.
• Delays of flights: more than 100 flights: 64 from TSN, 30
from Noi Bai.
• Current customer password must be changed.
• Cost.
• Time.

9. Security Incident - Vietcombank
Vietcombank

10. Security Incident- Vietcombank (cont.)
• Possible Impact:
• VND200 million ($8,929) had been stolen.
• VCB stock went down (VND 4000 billion were gone).
• Reputation lost. (TRUST)
(Statistics extract from tuoitrenews, vietnamnet website)
Look up the RISKS -> Set up Controls -> Cover Actions -> Reduce the IMPACT

11. Security Risk Management
Risk is:
“The effect of uncertainty on the ability of an organisation to meet its
objectives.” (ISO 31000:2009)
Risk Management is:
the process of identifying and assessing the risk, reducing it to an
acceptable level, and ensuring it remains at that level.

12. Security Risk Management (cont.)
Risk = Threats x Vulnerabilities x

13. 3 components of CIA Triad

14. The relationships among the different
security concepts

15. Important of Security Risk Management
a. Better oversight of organizational assets.
b. Minimized loss.
c. Identification of threats, vulnerabilities and risk.
d. Prioritization of risk response efforts.
e. Legal and regulatory compliance.
f. Increased likelihood of project success.
g. Better incident and business continuity management.

16. Several types of information security risk
a. Physical damage
b. Human interaction
c. Equipment malfunction
d. Inside and outside attacks
e. Misuse of data
f. Loss of data
g. Application error

17. Risk Type
“Above the line”
“Below the line”

18. Risk level matrix

19. Security Risk Management (cont.) - Controls
Control types:
a.Administrative
b.Technical
c.Physical

20. Security Risk Management (cont.) - Controls
Controls Functionalities:
a.Preventive
b.Detective
c.Corrective
d.Deterrent
e.Recovery
f. Compensating

21. Risk Management Process

22. Methodologies for Risk Assessment
a.Quantitative Risk Assessment
b.Qualitative Risk Assessment
c.Semi-quantitative Risk Assessment
Reference:
a.NIST SP800-30
b.FRAP (Facilitated Risk Analysis Process)
c.OCTAVE (Operationally Critical Threat, Asset, and
Vulnerability Evaluation)
d.ISO/IEC 31010

23. Risk Treatment
a.Avoid the risk
b.Reduce the risk
c.Transfer the risk
d.Accept the risk

24. What is an effective risk management?
a.Senior management support.
b.Suitable Risk Management Framework.
c.Effective Risk Management Process.
d.Communication.

25. References
 CISSP All-in-One Exam Guide 7th Edition, Shon Harris –
Fernando Maymi
 ISACA CRISC Review Manual 2015
 ISACA CISM Review Manual 2015
 NIST SP800-30
 Google Search

26. Questions and Answers
THANK YOU!!!
HAVE A NICE WEEKEND