CMU5XX-INFOSEC

Information Security for Industry

Session 5: Asset Management & Risk Assessment

James Williams

jwilliams@staff.newman.ac.uk

Learning Objectives

  • Understand the critical role of Information Asset Inventories.
  • Implement a Data Classification scheme (Public, Internal, Confidential).
  • Differentiate between Qualitative and Quantitative risk assessment.
  • Calculate Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE).
  • Determine appropriate risk treatment strategies (Mitigate, Transfer, Accept, Avoid).

Seminar Structure (3 Hours)

Part 1: Asset Management (1.5 hrs)
  • You Cannot Protect What You Don't Know You Have
  • Data Classification & Handling
  • Task 1: Data Classification Mapping
Part 2: Risk Assessment (1.5 hrs)
  • Qualitative vs Quantitative Risk
  • Calculating ALE and Risk Treatment
  • Task 2: Quantitative Risk Calculation

Part 1: Asset Management

Duration: 1.5 Hours

The Asset Inventory

Rule #1 of Security: You cannot protect what you don't know exists.

  • Shadow IT: Servers, cloud services, or applications spun up by departments (like Marketing) without IT's knowledge. These are never patched and are highly vulnerable.
  • A mature organization maintains a dynamic Configuration Management Database (CMDB) that tracks every laptop, server, software license, and data repository.
  • If an asset is not in the inventory, it is a critical risk.

Information as an Asset

Hardware is cheap; the data stored on it is priceless.

  • We don't apply maximum security to everything. Encrypting the cafeteria menu is a waste of CPU cycles.
  • Data Classification: Categorizing data based on its sensitivity and the impact to the business if it were disclosed or destroyed.
  • Different classifications dictate different handling procedures (e.g., Confidential data cannot be sent via unencrypted email; Public data can).

Standard Classification Levels

Most commercial organizations use a 3 or 4-tier system:

  • Public: Marketing materials, press releases. No impact if disclosed (it's meant to be).
  • Internal (Proprietary): Company org charts, internal memos. Minor impact if disclosed to competitors.
  • Confidential: Customer PII, source code, financial projections. Severe regulatory and financial impact if disclosed.
  • Restricted (Top Secret): M&A data, cryptographic root keys. Catastrophic impact. Extremely limited access.

Introduction to Task 1

Properly classifying data is the prerequisite for designing access controls and encryption standards.

We will act as data owners, classifying various corporate assets to determine their required security posture.

Task 1: Data Classification Mapping

Timing: 45 minutes

You are the Data Protection Officer for a University.

  1. Classify the following assets into one of four tiers (Public, Internal, Confidential, Restricted):
    • The University's published prospectus for next year.
    • A database containing student grades and home addresses.
    • The IT department's network topology diagram.
    • A professor's un-patented research on a new medical device.
  2. For the "Student Database", define the Data Handling Procedure: How should it be stored? Can it be emailed? How should it be backed up?

15 Minute Break

Please return promptly for Part 2.

Part 2: Risk Assessment

Duration: 1.5 Hours

Defining Risk

Risk = Threat x Vulnerability x Impact

  • Asset: The database.
  • Threat: A hacker (or an earthquake). Something you cannot control.
  • Vulnerability: Missing software patches (or a building not up to code). A weakness you *can* control.
  • Impact: The cost if the threat exploits the vulnerability.
  • If you have no vulnerabilities, the risk is zero. If the asset has no value (zero impact), the risk is zero.

Qualitative vs Quantitative

Qualitative Risk Assessment

Uses subjective scoring (High, Medium, Low) based on expert intuition. Faster to perform, but difficult to justify budgets with.

Quantitative Risk Assessment

Assigns actual monetary values to assets and probabilities to threats. Requires massive amounts of historical data, but allows for precise financial decision-making.

The Math of Risk

Quantitative assessment relies on three core formulas:

  • Asset Value (AV): The total value of the asset (e.g., £100,000).
  • Exposure Factor (EF): The percentage of the asset lost in a single incident (e.g., a fire destroys 50% = 0.5).
  • Single Loss Expectancy (SLE): AV x EF. The cost of one incident (£50,000).
  • Annualized Rate of Occurrence (ARO): How often the incident happens per year (e.g., once every 10 years = 0.1).
  • Annualized Loss Expectancy (ALE): SLE x ARO. The expected yearly cost of the risk (£5,000).

Introduction to Task 2

Once you calculate the ALE, you can decide how to treat the risk. If a control costs more than the ALE, it is a bad investment.

We will perform a quantitative risk calculation to justify a security purchase.

Task 2: Quantitative Risk Calculation

Timing: 50 minutes

Your company operates an e-commerce site. The server generates £10,000 in revenue per hour. Historical data shows you suffer a DDoS attack once every 2 years, taking the server offline for exactly 4 hours.

  1. Calculate the Single Loss Expectancy (SLE) of a DDoS attack.
  2. Calculate the Annualized Rate of Occurrence (ARO) and the Annualized Loss Expectancy (ALE).
  3. Cloudflare offers a DDoS mitigation service for £15,000 per year. Financially, should you buy it? Explain your reasoning based on your ALE calculation.

Summary & Next Steps

  • You cannot secure an enterprise without a rigorous, constantly updated inventory of assets and data flows.
  • Risk assessment translates technical threats into the universal language of business: Money.
Next Week: Organizational & Human Security (Insider Threats)