Bảo mật hệ thống mạng part 14 pptx

CHAPTER
6
Managing Risk
79
Copyright 2001 The McGraw-Hill Companies, Inc. Click Here for Terms of Use.
S
ecurity is about managing risk. Without an understanding of the security risks to an
organization’s information assets, too many or not enough resources might be used
or used in the wrong way. Risk management also provides a basis for valuing of
information assets. By identifying risk, you learn the value of particular types of informa
-
tion and the value of the systems that contain that information.
WHAT IS RISK?
Risk is the underlying concept that forms the basis for what we call “security.” Risk
is the potential for loss that requires protection. If there is no risk, there is no need for
security. And yet risk is a concept that is barely understood by many who work in
the security industry.
Risk is much better understood in the insurance industry. A person purchases insur
-
ance because a danger or peril is felt. The person may have a car accident that requires sig
-
nificant repair work. Insurance reduces the risk that the money for the repair may not be
available. The insurance company sets the premiums for the person based on how much
the car repair is likely to cost and the likelihood that the person will be in an accident.
If we look closely at this example, we see the two components of risk. First is the
money needed for the repair. The insurance company needs to pay this amount if an acci-
dent occurs. This is the vulnerability of the insurance company. The second component is
the likelihood of the person to get into an accident. This is the threat that will cause the
vulnerability to be exploited (the payment of the cost of repair).
When risk is examined, we therefore must understand the vulnerabilities and the
threats to an organization. Together, these two components form the basis for risk.

Figure 6-1 shows the relationship between vulnerability and threat. As you can see
from the figure, if there is no threat, there is no risk. Likewise, if there is no vulnerabil
-
ity, there is no risk.
Vulnerability
A vulnerability is a potential avenue of attack. Vulnerabilities may exist in computer sys
-
tems and networks (allowing the system to be open to a technical attack) or in administra
-
tive procedures (allowing the environment to be open to a non-technical or social
engineering attack).
A vulnerability is characterized by the difficulty and the level of technical skill that is
required to exploit it. The result of the exploitation should also be taken into account. For
instance, a vulnerability that is easy to exploit (due to the existence of a script to perform
the attack) and that allows the attacker to gain complete control over a system is a
high-value vulnerability. On the other hand, a vulnerability that would require the
attacker to invest significant resources for equipment and people and would only allow
the attacker to gain access to information that was not considered particularly sensitive
would be considered a low-value vulnerability.
80
Network Security: A Beginner’s Guide
TEAMFLY

Team-Fly
®

Vulnerabilities are not just related to computer systems and networks. Physical site
security, employee issues, and the security of information in transit must all be examined.
Threat
A threat is an action or event that might violate the security of an information systems
environment. There are three components of threat:
▼
Targets The aspect of security that might be attacked.
■
Agents The people or organizations originating the threat.
▲
Events The type of action that poses the threat.
To completely understand the threats to an organization, all three components must

be examined.
Targets
The targets of threat or attack are generally the security services that were defined in
Chapter 3: confidentiality, integrity, availability, and accountability. These targets corre
-
spond to the actual reason or motivation behind the threat.
Confidentiality is targeted when the disclosure of information to unauthorized individuals
or organizations is the motivation. In this case, the attacker wishes to know something that
Chapter 6: Managing Risk
81
Figure 6-1.
The relationship between vulnerability and threat
would normally be kept from him, such as classified government information. However,
information that is normally kept private within commercial organizations, such as salary
information or medical histories, can also be a target.
Integrity is the target when the threat wishes to change information. The attacker in
this case is seeking to gain from modifying some information about him or another—for
example, making a change to a bank account balance to increase the amount of money in
the account. Others may choose to attack the transaction log and remove a transaction
that would have lowered the balance. Another example might be the modification of
some data in an important database to cast a doubt on the correctness of the data overall.
Companies that do DNA research might be targeted in such a manner.
Availability is targeted through the performance of a denial-of-service attack. Such
attacks can target the availability of information, applications, systems, or infrastructure.
Threats to availability can be short-term or long-term as well.
Accountability is rarely targeted as an end unto itself. When accountability is targeted
by a threat, the purpose of such an attack is to prevent an organization from reconstruct
-
ing past events. Accountability may be targeted as a prelude to an attack against another
target such as to prevent the identification of a database modification or to cast doubt on

the security mechanisms actually in place within an organization.
A threat may have multiple targets. For example, accountability may be the initial tar-
get to prevent a record of the attacker’s actions from being recorded, followed by an
attack against the confidentiality of critical organizational data.
Agents
The agents of threat are the people who may wish to do harm to an organization. To be a
credible part of a threat, an agent must have three characteristics:
▼ Access The ability an agent has to get to the target.
■
Knowledge The level and type of information an agent has about the target.
▲
Motivation The reasons an agent might have for posing a threat to the target.
Access
An agent must have access to the system, network, facility, or information that
is desired. This access may be direct (for example, the agent has an account on the system)
or indirect (for example, the agent may be able to gain access to the facility through some
other means). The access that an agent has directly affects the agent’s ability to perform
the action necessary to exploit a vulnerability and therefore be a threat.
A component of access is opportunity. Opportunity may exist in any facility or net
-
work just because an employee leaves a door propped open.
Knowledge
An agent must have some knowledge of the target. The knowledge that is
useful for an agent includes
▼
User IDs
■
Passwords
82
Network Security: A Beginner’s Guide

■
Locations of files
■
Physical access procedures
■
Names of employees
■
Access phone numbers
■
Network addresses
▲
Security procedures
The more familiar an agent is with the target, the more likely it is that the agent will
have knowledge of existing vulnerabilities. Agents that have detailed knowledge of
existing vulnerabilities will likely also be able to acquire the knowledge necessary to
exploit those vulnerabilities.
Motivation
An agent requires motivation to act against the target. Motivation is usually
the key characteristic to consider regarding an agent as it may also identify the primary
target. Motivations to consider include
▼ Challenge A desire to see if something is possible and be able to brag about it.
■ Greed A desire for gain. This may be a desire for money, goods, services, or
information.
▲ Malicious Intent A desire to do harm to an organization or individual.
Agents to Consider
A threat occurs when an agent with access and knowledge gains the
motivation to take action. Based on the existence of all three factors, the following agents
must be considered:
▼
Employees have the necessary access and knowledge to systems because of their

jobs. The question with regard to employees is whether they have the
motivation to do harm to the organization. This is not to say that all employees
should be suspected of every event but employees should not be discounted
when conducting a risk analysis.
■
Ex-employees have the necessary knowledge to systems due to the jobs that
they held. Depending on how well the organization removes access once an
employee leaves, the ex-employee may still have access to systems. Motivation
may exist depending upon the circumstances of the separation, for example, if
the ex-employee bears a grudge against the organization.
■
Hackers are always assumed to have a motivation to do harm to an
organization. The hacker may or may not have detailed knowledge of an
organization’s systems and networks. Access may be acquired if the
appropriate vulnerabilities exist within the organization.
■
Commercial rivals should be assumed to have the motivation to learn
confidential information about an organization. Commercial rivals may have a
Chapter 6: Managing Risk
83
84
Network Security: A Beginner’s Guide
motivation to do harm to another organization depending on the circumstances
of the rivalry. Such rival organizations should be assumed to have some
knowledge about an organization since they are in the same industry.
Knowledge and access to specific systems may not be available but may be
acquired if the appropriate vulnerabilities exist.
■
Terrorists are always assumed to have a motivation to do harm to an
organization. Terrorists will generally target availability. Therefore, access to

high-profile systems or sites can be assumed (the systems are likely on the
Internet and the sites are likely open to some physical access). Specific
motivation for targeting a particular organization is the important aspect of
identifying terrorists as a probable threat to an organization.
■
Criminals are always assumed to have a motivation to do harm to an
organization. More specifically, criminals tend to target items (both physical
and virtual) of value. Access to items of value, such as portable computers, is a
key aspect of identifying criminals as a probable threat to an organization.
■ The general public must always be considered as a possible source of threat.
However, unless an organization has caused some general offense to
civilization, motivation must be considered lacking. Likewise, access to and
knowledge about the specifics of an organization is considered minimal.
■ Companies that supply services to an organization may have detailed knowledge
and access to the organization’s systems. Business partners may have network
connections. Consultants may have people on site performing development or
administration functions. Motivation is generally lacking for one organization to
attack another but given the extensive access and knowledge that may be held by
the suppliers of services, they must be considered a possible source of threat.
■
Customers of an organization may have access to the organization’s systems
and some knowledge of how the organization works. Motivation is generally
lacking for one organization to attack another but given the potential access
that customers may have, they must be considered a possible source of threat.
■
Visitors have access to an organization by virtue of the fact that they are visiting
the organization. This access may allow a visitor to gain information or
admission to a system. Visitors must therefore be considered a possible source
of threat.
▲

Disasters such as earthquakes, tornadoes, or floods do not require motivation or
knowledge. Access is generally assumed. Disasters must always be considered
possible sources of threat.
Chapter 6: Managing Risk
85
When considering these agents, you must make a rational decision as to whether each
agent will have the necessary access to target an organization. Consider potential ave
-
nues of attack in light of the vulnerabilities previously identified.
Events
Events are the ways in which an agent of threat may cause the harm to an organization.
For example, a hacker may cause harm by maliciously altering an organization’s Web
site. Another way of looking at the events is to consider what harm could possibly be
done if the agent gained access. Events that should be considered include
▼
Misuse of authorized access to information, systems, or sites
■
Malicious alteration of information
■
Accidental alteration of information
■
Unauthorized access to information, systems, or sites
■
Malicious destruction of information, systems, or sites
■ Accidental destruction of information, systems, or sites
■ Malicious physical interference with systems or operations
■ Accidental physical interference with systems or operations
■ Natural physical events that may interfere with systems or operations
■ Introduction of malicious software (intentional or not) to systems
■ Disruption of internal or external communications

■ Passive eavesdropping of internal or external communications
▲ Theft of hardware
Threat + Vulnerability = Risk
Risk is the combination of threat and vulnerability. Threats without vulnerabilities pose
no risk. Likewise, vulnerabilities without threats pose no risk. The measurement of risk is
an attempt to identify the likelihood that a detrimental event will occur. Risk can be quali
-
tatively defined in three levels:
▼
Low The vulnerability poses a level of risk to the organization, however, it is
unlikely to occur. Action to remove the vulnerability should be taken if possible
but the cost of this action should be weighed against the small reduction in risk.
■
Medium The vulnerability poses a significant level of risk to the confidentiality,
integrity, availability, and/or accountability of the organization’s information,
86
Network Security: A Beginner’s Guide
systems, or physical sites. There is a real possibility that this may occur. Action to
remove the vulnerability is advisable.
▲
High The vulnerability poses a real danger to the confidentiality, integrity,
availability, and/or accountability of the organization’s information, systems, or
physical sites. Action should be taken immediately to remove this vulnerability.
When available, the ramification of a successful exploitation of a vulnerability by a
threat must be taken into account. If the cost estimates are available, they should be
applied to the risk level to better determine the feasibility of taking corrective action.
IDENTIFYING THE RISK TO AN ORGANIZATION
The identification of risk is straightforward. All you need to do is to identify the vulnera
-
bilities and the threat and you are done. How do these identified risks relate to the actual

risk to an organization? The short answer is: not very well. The identification of risks to an
organization must be tailored to the organization. Figure 6-2 shows the components of an
organizational risk assessment. As you can see from the figure, I’ve added another com-
ponent to the risk calculation—existing countermeasures.
Figure 6-2.
Components of an organizational risk assessment