Benjamin Nathan Information Technologies and Services Security and Identity Management Copyright Benjamin Nathan, 2008. This work is the intellectual property of the author. Permission is granted for this material to be shared for non‐commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author. Using Nontraditional Security Risk Assessments to Measure Risk, Request Budgets, and Illustrate Trends Slide Notes 1. Title 2. Agenda 3. About WCMC a. I work at Weill Cornell Medical College, which is the medical college of Cornell University, but while the main University campus is in Ithaca, we’re located in New York City. While we work very closely with the main university, we are a separate campus, and we have our own HR, Finance, and other administrative departments. 4. Network Partners a. We have a lot of peer institutions connected to our network. We are one of two teaching colleges for New York Presbyterian hospital and we share a campus with them, so their network and our network are essentially the same. 5. ITS a. I work in the information technologies and services department, where we run 3 data centers, support about 7000 workstations, manage over 500 servers, 60 terabytes of data, 25,000 email users, etc. We run some large enterprise applications like EPIC, which is our electronic medical record system, and SAP – our ERP financial system. 6. Network Diagram a. This is a network architecture diagram. Being in Security, I tend to focus on 4 major categories of traffic (click): Intranet/Extranet, Firewall, Network Core, and ITS Servers (sensitive data). b. I knew I had all this stuff to pay attention to, but I hardly knew what to do, or what to do first. I needed to know our risks – and quickly! 7. Risk Management? a. First I tried some different permutations of the classic ‘Identify vulnerabilities, identify threats, determine impacts, calculate into something called ‘Risk’ b. I ran into 4 problems c. No such thing as perfect knowledge of threats d. I couldn’t tell if I was missing something. Quite often I was 5/10/2008 Page 1 Benjamin Nathan Information Technologies and Services Security and Identity Management e. Likelihood calculations could be whatever I wanted. In my experience, no one can tell you what actual likelihood will be. This felt like guessing. f. Impact was impossible to predict – without really knowing threats or likelihoods, impact predictions are not meaningful and easy to argue against. g. The real problem, however, was that because it was so easy to successfully argue against any of my calculations, asking for money to address these risks was ineffectual. In fact, the weakness of my analysis made me feel dishonest asking for money – I had no real evidence that the problems we had were real or the solutions appropriate. h. Finally, I found this process incredibly time consuming. Because it was so time consuming, so inaccurate, and so difficult to manage, I began asking myself, is this risk management? Or is the process itself just another risk? 8. Risk Management a. I went back to the drawing board and determined that I wanted to achieve the following: b. I wanted to be able to identify and assess a comprehensive set of security threats c. I wanted to address and reduce risks presented by those threats d. I wanted to the measure the value of the security investments e. I wanted measure improvement over time f. I specifically wanted to know how the security program added value and measured performance. I thought if I could do all of this then I would have a risk management portfolio. 9. 3 Step Approach a. This is the original risk assessment model again. I eventually moved to a 3 step model that supplanted this original. The steps are: b. Step 1: Identify security threats by cataloging security solutions c. Step 2: Break risk into categories d. Step 3: Score all security solutions against all categories, the highest scoring solutions will address the most risk. e. I’m going to go over each of these, starting with the idea that you can identify threats by cataloging security solutions 10. Identify Threats by Cataloging Solutions a. Here’s the premise b. Over time, starting with academia and the open source movement, and them moving into industry, there is a large set of existing technological solutions and best practices and processes in the field of information security (click), and these technologies and practices have matured to the point where over 90% of security threats out there can be identified by surveying and cataloging them. c. Let’s look at an example. Suppose you look at the security solution malware protection. If we want to use this solution to identify threats, we ask ourselves, what threat does 5/10/2008 Page 2 Benjamin Nathan Information Technologies and Services Security and Identity Management 11.
12.
13.
14.
15.
this address? Obviously, it addresses malware. Malware may or may not be something that threatens you, but the point is you did not need to come up with malware software on your own, you added it to your catalog provided to you by the information security industry. Please note I’m not claiming ALL threats can be identified this way, but I do think it’s over 90%. d. Let’s do a few more of these. Threats, Identified a. To identify threats, we’re starting with security solutions. Let’s try the security solution ‘Intrusion Prevention’. We ask ourselves, what threat does intrusion prevention address? In this case it’s fairly simple, it addresses network intrusions. How about network access control? That solution addresses the threat of rogue computers. Client encryption addresses the threat of unencrypted clients. Data classification, which is a process instead of a technology, addresses inappropriate security mechanisms. Awareness training addresses end user errors. 3 Step Approach a. Back to our model. We’ve cataloged our security solutions. Step 2 says we break risk down into categories. Let’s do that now. Break Risks Into Categories a. When I assess risk at the medical college, I use 13 different risk factors, or categories to understand how something might adversely affect the security of the institution. They are: (click and read) b. In a minute we’re going to start assessing security solutions against each of these risk categories. When we do that, and when I do that at home, I am looking for solutions that help me do this: (click and read). I find these risk categories to be comprehensive and universal, but they may differ in your environment. Ok, so those are the categories. Let’s quickly go back to the model. 3 Step Approach a. Back to our model. We’ve cataloged our security solutions and we’ve broken risk down into categories. (click) Now it’s time to score each solution against each category. Scoring a. Here is how the scoring works. I want to take each security solution – I’ll start with Intrusion Prevention – and give it scores based on each risk category. For each risk category, I’m going to ask myself an important question that will give me the score I’m looking for. Let’s walk through one. b. It starts like this: Does, Intrusion prevention, reduce Susceptibility to External Attack? Let’s say it does. I’m going to give it a score of 1‐10, and in this case I’m going to give it a 10. (click) The scoring scale works like this: 1 means no effect, 5 is an indirect effect, and 10 is a direct, significant effect. By giving intrusion prevention a 10 in the risk category 5/10/2008 Page 3 Benjamin Nathan Information Technologies and Services Security and Identity Management of reduce Susceptibility to External Attack, we are saying that intrusion detection has a direct, significant effect on reducing our Susceptibility to External Attack. Let’s keep going from the beginning with a new risk category. c. Now we ask: Does, intrusion prevention, improve our policy enforcement? Let’s say it does, and we’ll give it a 5, for having an indirect effect on improving policy enforcement. One more time. d. Does, intrusion prevention improve or increase our network visibility? Let’s say yes again, but because it has a minor effect we’ll give it a score of 3. e. This process continues until you’ve score intrusion prevention against all 13 risk categories. Some of you may be quick to point out that this process is relatively subjective. I’ll admit that it is, but I don’t think that detracts from its accuracy – especially if use a group of people to do the scoring, which I’ll talk a little bit about towards the end. I also think that this method is less subjective than the traditional threats, impact, high, medium, low method. Of course you don’t want to use this thing here, you want to use a nice spreadsheet like this (click) 16. Scoring a. Of course this is still a subset, but you start to get an idea of how these scores come together. The totals probably seem very high. They get this way because I weight some of the risk categories. In this example I multiply the first 2 categories by 5 and the last one by 3. I do this because some risk categories are more important to me than others, and I want the scores to reflect that. In total I weight the scores in 5 of the risk categories and I don’t change the other 8. Okay, I think we’ve done the three steps in the model. Now let’s look at how to use these scores to reduce risk. 17. The Risk Scorecard a. A fully populated spreadsheet of security solutions and risk categories looks like this. It’s way too much to look at here, and it’s definitely way too much to talk about with executives during a budget request. There is a better way, however, and it looks like this: (click) b. This is an Excel radar chart. I like it because it looks like a bulls‐eye. The technology security solutions that were listed on the left of our grid now circle the edge of the chart. Each diamond on the chart represents the total risk score for each individual technology, sorted from highest to lowest. Those total risk scores were created exactly the same way we did them in the last slide, but for every technology security solution against every risk category. Let’s drill further into the risk scorecard. 18. The Risk Scorecard a. These are the scores from the first time I ran this model in October of 2006. The highest scoring item is intrusion detection, here: (click) The next highest is NBAD, followed by Layer 7 Packet Inspection, etc. So what does this mean? It means that for all the risks we’ve identified –here they are again – for all these risks, I was most threatened by NOT 5/10/2008 Page 4 Benjamin Nathan Information Technologies and Services Security and Identity Management having intrusion detection. Because I didn’t have intrusion detection, I was susceptible to internal and external attack. Because I didn’t have intrusion detection, I didn’t have network visibility, or I wasn’t meeting a regulatory requirement, or the reputation of my institution was in danger of being damaged, etc. What’s particularly useful about this analysis is that it doesn’t just give you the threat and the risk, it also give you the solution. So in this instance I knew that if I implemented an intrusion detection system, I’d significantly reduce our vulnerability to these threats, thus reducing risk. The other thing this graph shows is priority. The highest scoring items indicate the biggest threats, and sorted highest to lowest this way it’s easy for senior managers to see the entire risk continuum, each possible solution, and how much risk you’re incurring by NOT having it. Finally, it’s very easy to see where your greatest opportunities for improvement lie, which I think is a nice way to look at it. b. Using this data, I made a budget request for my top scoring items. I explained that those items address our most pressing threats, and that I was measuring against the 13 risk categories. It worked. 19. Risk Scorecard a. We were given enough money to purchase intrusion detection, and a vulnerability scanner, and to augment our network behavior and anomaly detection system. b. After implementing these technologies, I rescored everything, and placed the scores on top of each other to get this: (click) 20. The Risk Scorecard a. The red scores are the newer set, and the blue scores are the originals. Some interesting things happened in the year between the two sets of scores. The first thing to note is that some scores went down. These extremely low risk scores indicate a near‐
zero risk, and the change is a direct effect from the systems we implemented, so this change is a good thing. You can also see (click) that some scores went up. Usually this is because new risks emerge or new pressures increase the risk scores and the need for a particular security solution. Lastly (click) you can see that one of these security solutions is new. This new score is for intrusion prevention, which I probably should have scored from the beginning but I didn’t because we were so averse to using a system that did automatic blocking. In this case, we implemented the Intrusion Detection system, gained all kinds of network visibility, starting creating 10‐20 manual firewall blocks per day using the information the IDS gave us, and all that manual work turned the resistance to something like an IPS into acceptance that it was necessary, so I added it to the list of technology security solutions. I should have had it in there from the beginning, but even if I did, I don’t think it would have scored nearly as high initially, because I didn’t have enough network visibility to know exactly how much risk having an IPS would reduce. 5/10/2008 Page 5 Benjamin Nathan Information Technologies and Services Security and Identity Management b. I’ve found this graph very valuable because it shows improvement over time. You can use this to prove to your senior managers and your auditors that you are reducing institutional risk. Expanding on this, you can drill further into the improvements you’ve made. (next slide) 21. Measure Process a. Here I’ve zoomed in on the quadrant that initially showed the most risk as evidenced by the blue lines, and also the most reduced risk, as evidenced by the red lines. You can use this exploded view to demonstrate measurements of the security process. b. The Sourcefire solution cost us approximately $150,000. Arbor was something we already owned. Implementing Sourcefire and adjusting Arbor to meet some of our security needs took approximately 1250 people‐hours. (click) c. The Nexpose vulnerability scanner cost about $25,000 and 1000 people‐hours to implement. (click) d. Interestingly, we were able to get some side‐effect gains in the area of layer 7 packet inspection and firewall re‐architecture because of the capabilities that came with Sourcefire and Arbor. e. I’ve found measuring the risk management process this way to be very effective – it highlights work you’ve already completed successfully and it adds credibility to future budget requests. 22. Process Risk Scorecard a. I also track the process scores the same way, and against exactly the same risk categories, so the model stays consistent. Around the edge of this graph are all the processes I scored, including things like data classification, policy creation, awareness training, etc. You can see some of the same patterns as with the technology solutions – some risks were reduced, and others increased. One interesting change occurred between policy creation and policy compliance. The score for policy creation decreased drastically, from about 240 to about 75. (click) At the same time, the scores for Policy Compliance and Security Procedure Creation (click) shot up. What happened was that in year one, we didn’t have security policies. Not having them posed a large risk. Then we created policies and when we rescored the new risk was not the lack of policies, but instead not complying with the ones we had created. 23. Fiscal Year 2009/2010 a. I’ve recently completed a new set of scoring for our fiscal year 2009, which starts in July. Here I have the highest scoring items from each, and this year I’ve pre‐scored what I hope the risk scores will look like after I’ve received my new budget. b. My goal is to be here in fiscal year 2010. You can see I’m not addressing every risk there, but there are some major improvements I’m hoping to make in policy compliance, Procedure creation, intrusion prevention, data classification, awareness training, client encryption, and strong authentication 5/10/2008 Page 6 Benjamin Nathan Information Technologies and Services Security and Identity Management c. One thing I do know is that, for the second year in a row, I’m getting nearly all the money and resources that I’ve asked for. 24. Funding Request a. The final output of this assessment framework is a report I write up with my proposals for the year. The proposal includes sections such as: (click) goal selections, reasons for my choices, reasons for omissions (this is important for high‐scoring items that don’t get included in my goals), and how to achieve the goals. 25. Observations 26. Conclusions a. So in conclusion, the model I’m using first identifies threats by cataloging technology security solutions and best practice security processes based on the idea that the maturing field information security provides a nearly comprehensive list to work from. Then I assess those security solutions by scoring them against a series of risk categories. b. Then I address the risk by ranking each security solution and presenting it in a persuasive format. c. After implementing the appropriate solutions, I measure the process including costs, resources, and time to implement. d. Finally, over time I measure improvement to the overall risk level at the institution. e. Because the process adds value and measures performance, I’m calling it a the Risk Management Portfolio, and this is how measure risk, make persuasive budget request, and illustrate trends at Weill Cornell Medical College. 5/10/2008 Page 7