Managing Information Security Risk: Organization, Mission, and Information System View
APPENDIX H

Traditional risk mitigation strategies with regard to threats from cyber attacks at first relied
almost exclusively on monolithic boundary protection. These strategies assumed adversaries
were outside of some established defensive perimeter, and the objective of organizations was to
repel the attack. The primary focus of static boundary protection was penetration resistance of the
information technology products and information systems employed by the organization as well
as any additional safeguards and countermeasures implemented in the environments in which the
products and systems operated. Recognition that information system boundaries were permeable
or porous led to defense-in-depth as part of the mitigation strategy, relying on detection and
response mechanisms to address the threats within the protection perimeter. In today's world
characterized by advanced persistent threats,82 a more comprehensive risk mitigation strategy is
needed-a strategy that combines traditional boundary protection with agile defense.
Agile defense assumes that a small percentage of threats from purposeful cyber attacks will be
successful by compromising organizational information systems through the supply chain83 by
defeating the initial safeguards and countermeasures (i.e., security controls) implemented by
organizations, or by exploiting previously unidentified vulnerabilities for which protections are
not in place. In this scenario, adversaries are operating inside the defensive perimeters established
by organizations and may have substantial or complete control of organizational information
systems. Agile defense employs the concept of information system resilience-that is, the ability
of systems to operate while under attack, even in a degraded or debilitated state, and to rapidly
recover operational capabilities for essential functions after a successful attack. The concept of
information system resilience can also be applied to the other classes of threats including threats
from environmental disruptions and/or human errors of omission/commission. The most effective
risk mitigation strategies employ a combination of boundary protection and agile defenses
depending on the characteristics of the threat.84 This dual protection strategy illustrates two
important information security concepts known as defense-in-depth85 and defense-in-breadth.86
Information has value and must be protected. Information systems (including people, processes, and
technologies) are the primary vehicles employed to process, store, and transmit such information-
allowing organizations to carry out their missions in a variety of environments of operation and to
ultimately be successful.
82 An advanced persistent threat is an adversary that possesses sophisticated levels of expertise and significant
resources which allow it to create opportunities to achieve its objectives by using multiple attack vectors (e.g., cyber,
physical, and deception). These objectives typically include establishing/extending footholds within the information
technology infrastructure of the targeted organizations for purposes of exfiltrating information, undermining or
impeding critical aspects of a mission, program, or organization; or positioning itself to carry out these objectives in the
future. The advanced persistent threat: (i) pursues its objectives repeatedly over an extended period of time; (ii) adapts
to defenders' efforts to resist it; and (iii) is determined to maintain the level of interaction needed to execute its
objectives.
83 Draft NIST Interagency Report 7622 provides guidance on managing supply chain risk.
84 Threat characteristics include capabilities, intentions, and targeting information.
85 Defense-in-depth is an information security strategy integrating people, technology, and operations capabilities to
establish variable barriers across multiple layers and missions of the organization.
86 Defense-in-breadth is a planned, systematic set of multidisciplinary activities that seek to identify, manage, and
reduce risk of exploitable vulnerabilities at every stage of the system, network, or subcomponent life cycle (system,
network, or product design and development; manufacturing; packaging; assembly; system integration; distribution;
operations; maintenance; and retirement).