Download Information Systems Technician Training Series

particular attack or event to occur?” Remember, the
successful attack or adverse event results from a
particular threat exploiting a particular vulnerability. It
is very specific reasoning. The greater the value of the
AIS asset and the more likely the successfid attack or
adverse event, the greater the risk. Figure 4-3 shows
this risk analysis concept. Risks are usually expressed
in terms of dollars per year, the annual loss expectancy.
TECHNICAL CONTROLS.— Technical controls are embedded in hardware, software, and
telecommunications equipment. They are diagnostic
circuitry, component redundancies, and memory
protect features. They are controls built into the
operating system. They include log-on IDs and
passwords to enable only authorized users access to the
computer system. They are accounting routines,
encryption coding, and audit trails.
Countermeasures
ADMINISTRATIVE CONTROLS.— Administrative controls concern people and procedures.
They include who is authorized to do what, methods to
keep track of who enters a sensitive area, who receives
a delivery, and who requests a sensitive report. The
operating procedures you follow will sometimes
include security requirements. You are responsible for
adhering to the procedures to ensure AIS requirements
are met.
Once the threats and vulnerabilities are known and
the likelihood and risk of a successful attack or an
adverse event are determined, a plan is developed to set
up countermeasures (controls) to lessen or eliminate the
vulnerabilities. If you have a countermeasure, you have
a protected vulnerability. If you have an unprotected
vulnerability, you do not have a countermeasure. Some
countermeasures help us prevent adverse events,
whereas others detect adverse events. We have
measures to minimize the effects of successful attacks
or adverse events. We also have measures, called
contingency plans, to recover from a successful attack
or an adverse event. Figure 4-4 gives an example of
each type of security measure strategy as it relates to
fire loss. Figure 4-5 shows threats, vulnerabilities, and
countermeasures to our assets.
MANAGERIAL CONTROLS.— Managerial
controls tie everything together. They concern
planning and evaluation. They include audits to review
the effectiveness and efficiency of the countermeasures.
They check to make sure that the measures are actually
in place, being followed, and working. Problems found
require replanning and reevaluation to see that
corrections are made.
Another way to categorize countermeasures is by
type: physical, technical, administrative, and
managerial (figure 4-6).
RISK MANAGEMENT
Risk management involves assessing the risks,
determining loss potential estimates, and selecting
countermeasures appropriate to prevent, detect,
minimize, and recover from successful attacks and
adverse events. Management selects the
countermeasures, making sure that the cost of the
measure is less than the cost of the risk. The trick is to
select the countermeasure that will result in the lowest
total cost while taking all reasonable measures to
protect our AIS assets.
PHYSICAL CONTROLS.— We usually think of
physical control first. They include the locked
computer room door, physical layout, fire
extinguishers, access barriers, air conditioners,
moisture detectors, and alarms.
Keep in mind that the presence of a vulnerability
does not in itself cause harm. A vulnerability is merely
a condition or set of conditions that may allow the
computer system or AIS activity to be harmed by an
attack or event. Also, keep in mind that an attack made
does not necessarily mean it will succeed. The degree
of success depends on the vulnerability of the system or
activity and the effectiveness of existing
countermeasures. Countermeasures may be any action,
device, procedure, technique, or other measure that
reduces the vulnerability of an AIS activity or computer
system to the realization of a threat.
Figure 4-3.—AIS security risk analysis.
4-4