Risk Management and Risk Ranking.

Has your organization performed a Risk Assessment? 

Many organizations fail to keep current on Risk Management. Often times risk management is only important after a costly incident occurs. With little effort it’s easy to reduce your organizations risk exposure by performing a Risk Assessment.  A risk assessment or risk analysis is a simple process of identifying the most values assets, assigning a value to them, and then identifying the probability of certain threat occurring. Once you have an inventory of assets in place and have identified the most likely threats then you simply calculate a risk ranking. The higher the risk ranking the more time, money, and effort is needed on risk mitigation steps to prevent loses from occurring.

 Here’s a simple and valuable formula that your organization can use to identify and rank risks to your organization.

Risk Ranking = (the likelihood of a vulnerability occurring) X (Value of the Asset) – (the percentage of risk mitigation controls) + (the uncertainty of knowledge of the vulnerability)

For example:

Let’s say that you have an Application Server that is used by most of your workers and you also have a separate email server that your workers use too. How do you determine which one has the most risk to the organization?

Asset	Asset Impact	Vulnerability	Vulnerability Likelihood	Certainty of assumptions	Risk Mitigation	Risk Rating Factor
Application Server	50	Hardware failure	1	.9	0	=55
Mail Server	100	Hardware failure	.5	.8	.50	=35

You can see from this chart that the greatest risk is associated with the Application Server. You can also see that unlike the mail server there is no risk mitigation associated with the application server. The conclusion is very simple; the organizations should spend effort on risk mitigation for the Application server because the risk ranking is the highest.

For more information on Risk Management consult that following resources:

The Institute of Risk Management: http://www.theirm.org/

The Risk Management Society : http://www.rims.org

The Risk Management Association: http://www.rmahq.org

Role Based Access Control (RBAC) is most popular.

Many people who are part of a larger organization may not be familiar with the term of Role Base Access Control (RBAC) or Role Based Security, but it’s the most popular form of access control. You'll know exactly what I'm talking about in a few sentences.

Why do we need access control in organization?

Access control of is a means to limit access to individual based upon their need to perform their duties and their need to access data. Properly administered Access Control helps organization by:

• Limiting risk of theft as a preventative control to limit access to information
• Discourage and deter access to areas that are out of bounds
• Mitigate damage and reduce liabilities within an organization from having unauthorized individual access information that isn’t in their areas of responsibilities.

Most people are familiar with Role Based Controls but probably didn't know it had a name. Usually access controls are administered by network administrators or by an administrator that provides you access to an application. Users are place in hierarchical groups based upon their role. Similar roles allow similar access to information. 

 

For example and entry level role may only be able to have inquiry access to information in an applications. As we move up the hierarchy in an organization a  supervisor may be able to inquire, and change information within an application but a manager may be able to add, delete, and change information. RBAC is a very practical and common means to manage access control within an organization. One problem occurs when there are not enough roles defined. You may find yourself having access to one system for inquiry purposes and having to change, delete, or add information in another system because of poorly defined roles by your administrator. Other times an organization doesn't have any roles at all and simply managed on the honor system. This can be problematic and negligent too.

So the next time you need access to a new system or if your frustrated with you current access limitations... be sure to mention RBAC to your administrator or supervisor.

For more information about Role Base Access Controls visit the National Institute of Standards and Technology site at:

http://csrc.nist.gov/groups/SNS/rbac/

SANS Organization also has a very good white paper entitled “Role-base Access Control” which outlines the most common forms of Access Control: Mandatory Access Control (MAC), Discretionary Access Control (DAC) and RBAC.

http://www.sans.org/reading_room/whitepapers/sysadmin/role-based-access-control-nist-solution_1270