Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.
Assessing the probability or likelihood of various types of event/incident with their predicted impacts or consequences, should they occur, is a common way to assess and measure IT risks."Risk is a combination of the likelihood of an occurrence of a hazardous event or exposure(s) and the severity of injury or ill health that can be caused by the event or exposure(s)" (OHSAS 18001:2007) Alternative methods of measuring IT risk typically involve assessing other contributory factors such as the threats, vulnerabilities, exposures, and asset values.
Definitions
ISO IT risk: the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization. It is measured in terms of a combination of the probability of occurrence of an event and its consequence.ISO/IEC, "Information technology – Security techniques-Information security risk management" ISO/IEC FIDIS 27005:2008
Committee on National Security Systems The Committee on National Security Systems of United States of America defined risk in different documents: From CNSS Instruction No. 4009 dated 26 April 2010CNSS Instruction No. 4009 dated 26 April 2010 the basic and more technical focused definition: Risk – Possibility that a particular threat will adversely impact an IS by exploiting a particular vulnerability. National Security Telecommunications and Information Systems Security Instruction (NSTISSI) No. 1000,National Information Assurance Certification and Accreditation Process (NIACAP) by National Security Telecommunications and Information Systems Security Committee introduces a probability aspect, quite similar to NIST SP 800-30 one: Risk – A combination of the likelihood that a threat will occur, the likelihood that a threat occurrence will result in an adverse impact, and the severity of the resulting impact
National Information Assurance Training and Education Center defines risk in the IT field as: The loss potential that exists as the result of threat-vulnerability pairs. Reducing either the threat or the vulnerability reduces the risk. The uncertainty of loss expressed in terms of probability of such loss. The probability that a hostile entity will successfully exploit a particular telecommunications or COMSEC system for intelligence purposes; its factors are threat and vulnerability. A combination of the likelihood that a threat shall occur, the likelihood that a threat occurrence shall result in an adverse impact, and the severity of the resulting adverse impact. the probability that a particular threat will exploit a particular vulnerability of the system.
NIST Many NIST publications define risk in IT context in different publications: FISMApedia devoted to FISMA termFISMApedia Risk term provide a list. Between them: According to NIST SP 800-30:NIST SP 800-30 Risk Management Guide for Information Technology Systems Risk is a function of the likelihood of a given threat-source’s exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. From NIST FIPS 200FIPS Publication 200 Minimum Security Requirements for Federal Information and Information Systems Risk – The level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system given the potential impact of a threat and the likelihood of that threat occurring.
NIST SP 800-30 defines: IT-related risk The net mission impact considering: the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and the resulting impact if this should occur. IT-related risks arise from legal liability or mission loss due to: Unauthorized (malicious or accidental) disclosure, modification, or destruction of information Unintentional errors and omissions IT disruptions due to natural or man-made disasters Failure to exercise due care and diligence in the implementation and operation of the IT system.
Risk management insight IT risk is the probable frequency and probable magnitude of future loss.FAIR: Factor Analysis for Information Risks
ISACA ISACA published the Risk IT Framework in order to provide an end-to-end, comprehensive view of all risks related to the use of IT. There,ISACA THE RISK IT FRAMEWORK (registration required) IT risk is defined as: The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise According to Risk IT, IT risk has a broader meaning: it encompasses not just only the negative impact of operations and service delivery which can bring destruction or reduction of the value of the organization, but also the benefit\value enabling risk associated to missing opportunities to use technology to enable or enhance business or the IT project management for aspects like overspending or late delivery with adverse business impact
Measuring IT risk You can't effectively and consistently manage what you can't measure, and you can't measure what you haven't defined.Technical Standard Risk Taxonomy Document Number: C081 Published by The Open Group, January 2009.
Measuring IT risk (or cyber risk) can occur at many levels. At a business level, the risks are managed categorically. Front line IT departments and NOC's tend to measure more discrete, individual risks. Managing the nexus between them is a key role for modern CISO's.
When measuring risk of any kind, selecting the correct equation for a given threat, asset, and available data is an important step. Doing so is subject unto itself, but there are common components of risk equations that are helpful to understand.
There are four fundamental forces involved in risk management, which also apply to cybersecurity. They are assets, impact, threats, and likelihood. You have internal knowledge of and a fair amount of control over assets, which are tangible and intangible things that have value. You also have some control over impact, which refers to loss of, or damage to, an asset. However, threats that represent adversaries and their methods of attack are external to your control. Likelihood is the wild card in the bunch. Likelihoods determine if and when a threat will materialize, succeed, and do damage. While never fully under your control, likelihoods can be shaped and influenced to manage the risk.
Mathematically, the forces can be represented in a formula such as: where p() is the likelihood that a Threat will materialize/succeed against an Asset, and d() is the likelihood of various levels of damage that may occur.
The field of IT risk management has spawned a number of terms and techniques which are unique to the industry. Some industry terms have yet to be reconciled. For example, the term vulnerability is often used interchangeably with likelihood of occurrence, which can be problematic. Often encountered IT risk management terms and techniques include:
Information security event An identified occurrence of a system, service or network state indicating a possible breach of information security policy or failure of safeguards, or a previously unknown situation that may be security relevant. Occurrence of a particular set of circumstances The event can be certain or uncertain. The event can be a single occurrence or a series of occurrences. :(ISO/IEC Guide 73) Information security incident is indicated by a single or a series of unwanted information security events that have a significant probability of compromising business operations and threatening information security An event [G.11] that has been assessed as having an actual or potentially adverse effect on the security or performance of a system. Impact The result of an unwanted incident [G.17].(ISO/IEC PDTR 13335-1) Consequence Outcome of an event [G.11] There can be more than one consequence from one event. Consequences can range from positive to negative. Consequences can be expressed qualitatively or quantitatively (ISO/IEC Guide 73)
The risk R is the product of the likelihood L of a security incident occurring times the impact I that will be incurred to the organization due to the incident, that is: R = L × I
The likelihood of a security incident occurrence is a function of the likelihood that a threat appears and the likelihood that the threat can successfully exploit the relevant system vulnerabilities.
The consequence of the occurrence of a security incident are a function of likely impact that the incident will have on the organization as a result of the harm the organization assets will sustain. Harm is related to the value of the assets to the organization; the same asset can have different values to different organizations.
So R can be function of four factors: A = Value of the assets T = the likelihood of the threat V = the nature of vulnerability i.e. the likelihood that can be exploited (proportional to the potential benefit for the attacker and inversely proportional to the cost of exploitation) I = the likely impact, the extent of the harm
If numerical values (money for impact and probabilities for the other factors), the risk can be expressed in monetary terms and compared to the cost of countermeasures and the residual risk after applying the security control. It is not always practical to express this values, so in the first step of risk evaluation, risk are graded dimensionless in three or five steps scales.
OWASP proposes a practical risk measurement guideline based on: Estimation of Likelihood as a mean between different factors in a 0 to 9 scale: Threat agent factors Skill level: How technically skilled is this group of threat agents? No technical skills (1), some technical skills (3), advanced computer user (4), network and programming skills (6), security penetration skills (9) Motive: How motivated is this group of threat agents to find and exploit this vulnerability? Low or no reward (1), possible reward (4), high reward (9) Opportunity: What resources and opportunity are required for this group of threat agents to find and exploit this vulnerability? full access or expensive resources required (0), special access or resources required (4), some access or resources required (7), no access or resources required (9) Size: How large is this group of threat agents? Developers (2), system administrators (2), intranet users (4), partners (5), authenticated users (6), anonymous Internet users (9) Vulnerability Factors: the next set of factors are related to the vulnerability involved. The goal here is to estimate the likelihood of the particular vulnerability involved being discovered and exploited. Assume the threat agent selected above. Ease of discovery: How easy is it for this group of threat agents to discover this vulnerability? Practically impossible (1), difficult (3), easy (7), automated tools available (9) Ease of exploit: How easy is it for this group of threat agents to actually exploit this vulnerability? Theoretical (1), difficult (3), easy (5), automated tools available (9) Awareness: How well known is this vulnerability to this group of threat agents? Unknown (1), hidden (4), obvious (6), public knowledge (9)