OWASP Risk Rating Methodology Study Notes
J. Williams (). OWASP Risk Rating Methodology. OWASP [Online]. Available: https://owasp.org/www-community/OWASP_Risk_Rating_Methodology [Accessed: 02 September 2024].
OWASP is the Open Worldwide Application Security Project, and they have published standards about rating risks affecting an organisation. This post covers that document.
There are other Risk Rating Methodologies that can be followed, these are listed in the Disclaimer.
Introduction
When identifying risks to a business it is important to determine the effects to develop a framework that prioritises these risks. This will help save time, and ensure major risks can be mitigated against.
Just because a system may be vulnerable to certain risks does not always mean time and money should be invested in risk prevention in these areas. The framework will allow for professionals to determine what risks are the most important to their particular organisation.
There is no ‘universal’ rating system that an organisation can simply adopt – every organisation is different, and so it is important to customise the system for your own purposes.
The OWASP methodology mentions three ways of identifying vulnerabilities:
Approach
This OWASP approach is based on standard methodologies and customised for application security specifically, utilising the standard risk model:
risk = likelihood * impact
Following the steps below creates a worksheet where you can ‘score’ the factors on your business. This worksheet can be seen in Step 4.
Categories used are low (0-<3), medium (3-<6), and high (6-9).
Step 1: Identifying a Risk
Looking at the worst case scenario in each instance, the tester needs to research the:
- threat agent involved (the person or people responsible for the attack)
- type of attack utilised
- vulnerability exploited
- impact on the business
Step 2: Factors for Estimating Likelihood
What is the likelihood of the occurrence of a potential risk? A vulnerability in the system may be well hidden or not easily identified by an attacker and therefore the likelihood of this being exploited is low.
The likelihood involves two factors: the threat agent factor and the vulnerability factor:
- Estimating the likelihood of a successful attack by a threat agent (worst case scenario should be considered – so imagine a highly-skilled group of hackers hell-bent on sabotaging your system)
- Estimate the likelihood of a vulnerability being discovered and exploited by the already defined threat agent.
Step 3: Factors for Estimating Impact
What is the likelihood of a successful attack and its impact on your business?
There are two factors that measure the impact: technical impact factor and the business impact factor:
- The technical impact is estimating the magnitude of the effect a successful attack would have on your business, using the CIA triad plus Accountability (can the attacker be identified?).
- The business attack is more important, and this is where financial concerns lie. Should a vulnerability be detected that could be easily exploited that could impact your finances, reputation, compliance and violation, this is where preventative measures should be heavily invested.
Step 4: Determining Severity of the Risk
The scores for likelihood estimate and impact estimate will produce a severity score. These are on a scale, because it is impossible to gauge precisely the likelihood or potential impact of the risks.
There are two methods to use:
- Informal Method simply runs through the risks and categorises them in terms of low, medium or high.
- The Repeatable Method means actually scoring each factor in turn and coming up with a specific number that represents the likelihood and impact:
Determining Severity
Once we have categorised our likelihood and impact, we combine them to calculate our Overall Risk Severity. Obviously, the higher the scores, the closer to critical we get.
The ‘Impact’ on the Y axis can be business or technical, however business impact is the best data to use.
Understanding the business context of the vulnerabilities you are evaluating is so critical to making good risk decisions
https://owasp.org/www-community/OWASP_Risk_Rating_Methodology
Step 5: Deciding What to Fix
A good general rule to follow is to fix the most severe risks first, however; keep in mind that business needs must be considered above all else. Although a fix could be expensive and not give an immediate return, a hacker compromising your system could result in reputation damage that is impossible to quantify financially.
Step 6: Customising Your Risk Rating Model
As stated above, there is no ‘one-size-fits-all’ model for assessing risk to your organisation. Having your own model customised for your own business needs will demonstrate what is important to the business, and have everyone on the same page regarding security concerns.
- Adding factors – the OWASP factors may not be of concern to a particular organisation, and so it may be prudent to create more relevant factors.
- Customising options – the scale may need defining more clearly in specific cases; for example the Owasp Risk Rating website has actually reversed the Threat Agent Factor scale, because in their case a skilled penetration tester attempting an attack is less of a risk than an amateur, because the vulnerability is easy to exploit.
- Weighting factors – the OWASP rating gives a universal severity score across all factors. It may be the case that your organisation is particularly interesting to certain groups, and threat agent factors are therefore amplified. Or the technical impact for a company like Microsoft would be more damning than any other factor, as that is their speciality. Different weightings can be given to factors and impacts to customise your model further.
Other Resources
https://www.simplerisk.com/blog/owasp-risk-rating-methodology-and-simplerisk
Risk Factor Worksheet (Google Sheets)