Michael Thumann and me had the chance to give a talk at this year’s
ISSE conference in Brussels, Belgium. ISSE was
founded in 1999 as an initiative of the European Commission Directorate General
Information Society. The con had a focus on eGovernment, electronic business
processes and the corresponding security issues.
We talked about the ERRS, the
ERNW Rapid Rating System,
that can be used to perform a vulnerability rating for findings that result from
different kinds of sources. Audits and Pentests will find a vast amount of
vulnerabilities in the infrastructure. To deal with these vulnerabilities, you
have to use some kind of prioritization in order to use resources effectively.
We tried to adopt the strengths from metrics like CVSS and developed our own set
of parameters to calculate the metric, focussing on the relevant customer
questions concerning vulnerabilities from all kinds of sources.
Today I’m going to discuss the (presumably) most complex and difficult-to-handle
of the three parameters contributing to a risk (as of the RRA), that is the
“vulnerability [factor]”.
First it should be noted that “likelihood” and “vulnerability” must (“mentally”)
be clearly separated which means that “likelihood” denotes: likelihood of threat
showing up _without_ consideration of existing controls. Security controls
already present will affect the vulnerability factor (in particular if they are
effective ;-), but _not_ the likelihood.
First reflect on “how often will somebody stand at the door of our data center
with the will to enter?” or “how often will a piece of malware show up at our
perimeter?” or “how often will it happen that an operator commits a mistake?”
and assign an associated value to the likelihood.
Then, _in a separate_ step, think about: “will that person be able to enter my
data center?” (maybe it’s an external support engineer and, given their high
workload, your admins are willing to violate the
external_people_only_allowed_to_access_dc_when_attended policy. which – of
course – is purely fictional and will never happen in your organization ;-)) or
“how effective are our perimeter controls as for malware?” (are they? ;-)) or
“hmm… what’s the maturity of our change management processes?” and assign an
associated value to the vulnerability factor.
As stated in an earlier post: this will allow for identifying areas where to act
and thus allow for efficient overall steering of infosec resources.
Mixing likelihood and vulnerability might lead to self complacent stuff like
“oh, evidently likelihood of unauthorized access to datacenter is ‘1’ as we have
that brand new shiny access control system” …
This is the second part of the series (part 1
here) providing
some background on the way we perform risk assessments. It can be seen as a
direct continuation of the last post; today I cover the method of estimation
and the scale & calculation formula used.
Qualitative estimation which uses a scale of qualifying attributes (e.g.
Low, Medium, High) to describe the magnitude of each of the contributing
factors listed above. [ISO 27005, p. 14] states that qualitative estimation
may be used
As an initial screening activity to identify risks that require more
detailed analysis.
Where this kind of analysis is appropriate for decisions.
Where the numerical data or resources are inadequate for a quantitative
estimation.
As the latter is pretty much always the case for information security risks,
in the infosec space usually qualitative estimation can be found. A sample
qualitative scale (1–5, mapping to “very low” to “very high”) for the
vulnerability factor will be provided in the next part of this series.
At several occasions we’ve been asked to provide some background on the
Rapid Risk Assessment (RRA)
methodology we frequently use for a transparent (and documented) understanding
of risks in certain situations and to deliver structured input for subsequent
decision taking. As I had to write down (in another context) some notes on risk
assessments and – from our perspective – practical, reasonable ways of
performing them, I take the opportunity to lay out a bit the underlying ideas of
the RRA approach. Which, btw, is no rocket science at all. Honestly, I sometimes
wonder why stuff like this isn’t practiced everywhere, on a daily basis 😉
Once again, in some customer environment the question of allowing/prohibiting
split tunneling for (in this case: IPsec) VPN connections popped up today. Given
our strict stance when it comes to “fundamental architectural security
principles” the valued reader might easily imagine we’re no big fans of allowing
split tunneling (term abbreviated in the following by “ST”), as this usually
constitutes a severe violation of the “isolation principle”, further aggravated
by the fact that this (violation) takes place on a “trust boundary” (of
trusted/untrusted networks).
Still, we’re security practitioners (and not everybody has such a firm belief
in the value of “fundamental architectural security principles” as we have), so
we had to deal with the proponents’ arguments. In particular as one of them
mentioned additional costs (in case of disallowed ST forcing all 80K VPN users’
web browsing through some centralized corporate infrastructure) of US$
40,000,000.
[yes, you read that correctly: 40 million. I’ve still no idea where this – in
my perception: crazy – number comes from]. Anyhow, how to deal with this?
Internally we performed a
rapid risk assessment (RRA)
focused on two main threats, that were: