# Presentation: 099260

## Analytical Risk Management

***A Systems Approach to Security Decision Making***

- Process Overview

- Updated 3/5/2003

## What is Risk Management?

- The process of selecting and
- implementing securitycountermeasures to achieve an
- acceptable level of risk
- at an acceptable cost.

## Risk Avoidance vs. Risk Management

- Risk Avoidance
- Assumes an aggressive, opponent in all scenarios
- Counters ALL possible vulnerabilities
- Responds based on worst-case scenarios

## Risk Avoidance vs. Risk Management

- Risk Management
- Integrates the process of assessing the threat, the vulnerabilities, and the value of the asset to the owner
- Weighs the risk of compromise/loss against the cost of security practices

## Identify Assets and Loss Impacts

- Determine critical assets requiring protection
- Identify undesirable events and expected impacts
- Value/prioritize assets based on consequence of loss

- ASSESS ASSETS

## What is an Asset?

- An asset is anything of value
-  (people, information, equipment,facilities, activities/operations, etc.)

## Crafting Undesirable Event Statements

- Some Examples:

- Undesirable Event Results In A Loss (describe)

- Vehicle bombing
- Package bomb
- Letter bomb
- Employee espionage
- Accidental disclosure
- Coll. of tempest emanations
- Anti-US demonstration
- Surreptitious entry
- Massive flooding

- Massive loss of life
- Limited loss of life
- Possible death or injury
- Extensive loss of classified info.
- Minor loss of classified info.
- Loss of classified info.
- Immobilization of VIP convoy
- Loss of classified documents
- Destruction of valuable tools

## Identify and Characterize the Threat

- Identify and Characterize the Threat

- Identify threat categories and adversaries
- Assess intent and motivation of each adversary
- Assess capability of each adversary
- Estimate threat relative to each critical asset
- Determine frequency of past incidents

- ASSESS THREATS

## Threats and Adversaries

- What is a _threat_?
- Any indication, circumstance, or event that can cause the loss of, damage to, or the denial of an asset
- Who is an _adversary_?
- Any entity that conducts, or has the capability and intention to conduct, activities detrimental to interests or assets

**Notes:**
Threats can be man-made (like espionage) or natural (like hurricanes)
Intention, capability and history are the evidence on which we base our assertions about the quality and quantity of threat.  Natural disasters do not possess intent or motivation.
In or lexicon, threats are a type of event; adversaries are the players who take action to create the event
For the purposes of our class, the definitions used will be specific to the US government

## Types of Threats

- Foreign Intelligence Services
- Facility penetration
- Non-access attack
- Recruiting staff
- Terrorist Threats
- Kidnapping
- Bombing
- Sabotage
- Natural Threats
- Fire
- Flood
- Wind (storm, hurricane)
- Earthquake

- Criminal Threats
- Fraud, theft, robbery
- Arson
- Vandalism
- Computer hacking
- Insider Threats
- Espionage
- Misuse of equipment
- Malicious acts by disgruntled staff
- Military Threats
- War
- Insurrection
- Military Action

## Identify and Analyze Vulnerabilities

- Identify vulnerabilities of specific assets related to undesirable events
- Identify existing countermeasures and their level of effectiveness in reducing vulnerabilities
- Estimate degree of vulnerability to each asset and threat

- ASSESS VULNERABILITIES

## Vulnerabilities

- For example, can result from:
- building characteristics
- equipment properties
- personal behavior
- locations of people, equipment and buildings
- operational and personnel practices

- Vulnerabilities - Any weakness that can be exploited by an adversary to gain access to an asset.

## ASSESS RISKS

- Estimate degree of impact relative to each critical asset
- Estimate likelihood of attack by a potential adversary or threat
- Estimate likelihood that a specific vulnerability will be exploited
- Determine relative degree of risk
- Prioritize risks based on integrated assessment

- Identify Risks

## Risk Formula

- Risk = Impact x (Threat x Vulnerability)

- Asset

- Threat

- Vulnerability

- Impact of UnwantedEvent

- Likelihood of Unwanted Event

- Risk

## Identify Countermeasures, Costs & Benefits

- Identify Countermeasures, Costs & Benefits

- Identify potential countermeasures to reduce V and / or T and / or I.
- Identify countermeasures benefits in terms of risk reduction
- Identify countermeasure costs
- Conduct countermeasure cost-benefit and tradeoff analyses
- Prioritize options and prepare a recommendation for decision maker

- DETERMINE COUNTERMEASURE OPTIONS

## Countermeasure Costs and Benefits

**Countermeasures**
- An action taken or a physical entity used to reduce or eliminate one or more V and / or T and / or I.
**Cost-Benefit Analysis**
- The part of the process in which costs / benefits of countermeasures are compared and the most appropriate alternative selected
*Cost*:  Tangible, operational, and other costs of countermeasures
*Benefit*:  Amount of risk reduction based on the overall effectiveness of countermeasures

**Notes:**
Definitions:  Self-explanatory

## What We Want You to Remember

- A structured yet flexible approach to understanding your security posture
- A process for developing effective security countermeasures and options that consider cost & benefit
- A snapshot in time that provides an audit trail

**ARM is:**

**Notes:**
In Summary:
The arm process is helpful in analyzing security issues and effectiveness of security countermeasures.  It provides clear and lasting ways to document security needs and sell security countermeasure needs to decision-makers.
Through a more precise understanding of security problems, ARM can help security professionals provide countermeasures that more precisely match their actual security needs.
The process is iterative.  Analyses get more precise and accurate the more the individual steps are reviewed and updated.  When this iterative process is followed before the analysis is published it helps the analysis get ore accurate.  When followed after the analysis is completed it can help establish a “living risk assessment” or an assessment that can be pulled out and used at any time.

## Discussion of Risk Management Process

**?**

- Questions?

- Comments?