Pertinent Clauses of BS7799-3

Posted on by

https://bsol-bsigroup-com.libproxy.york.ac.uk/PdfViewer/Viewer?pid=000000000030354572

Lesson 1:

Clause 6.4.3 Criteria concerning likelihood

Likelihood criteria describe how an organisation intends to categorise the frequency of potential information security events, e.g. the number of potential information security events in a particular time period. Time based (frequency) descriptions are often easier to assess and less subjective than probability-based descriptions. These criteria depend on the type of events under consideration. To be effective, the likelihood criteria should span and segregate the expected range of frequencies so that differences can be identified. The range of likelihood criteria should be capable of being applied to events that are almost inevitable as well as those that are expected to occur infrequently. Similarly, likelihood criteria depends on whether the anticipated rate of occurrence of events is widely variable or relatively predictable within a narrow range.

The criteria should be developed taking into account how likely anticipated information security events might be, which in turn depends on facts such as:

a) the degree of motivation of a deliberate attack (eg the viability[cost/benefit] of such an attack);

b) the required skill of an attacker;

c) the tools and resource is available to an attacker;

d) influence such a serious crime, terrorist organisations or foreign intelligence;

e) the probability of occurrence of accidental or natural events, e.g. force majeure events;

f) the degree of exposure of relevant information or the asset related to information to an attacker;

g) the type of opportunity that the organisation gives to an attacker;

h) technology failure; and

i) human error

Estimation of likelihood is intrinsically uncertain, not only because it considers things that have not yet happened and are therefore not fully known, but also because probability is a statistical measure that only describes tendencies and is thus not directly representative of individual events. Nevertheless, the relative likelihood of different individual events can often be inferred with reasonable confidence, if sources of assessment on certainty are allowed for. The three basic sources of assessment on certainty are personal uncertainties originating in the judgement of the assessor , which derives from variability in the mental heuristics of decision-making; methodological uncertainty, which derives from the use of tools that inevitably model events simplistically, and systemic uncertainty about the anticipated event itself, which derives from insufficient knowledge.

To increase the reliability of estimating likelihood, organisations should consider using:

1) team assessments rather than individual assessments;

2) external sources, such as information security breaches reports;

3) scales with at least 5 categories; and

4) unambiguous scales, such as “once a year”, rather than “infrequent”.

However, organisations should note that uncertainty in likelihood often increases as the expected frequency of the event declines. This happens when the value chosen for the likelihood represents an average rate of occurrence. A once a year event can occur several times in one year and then not for several years thereafter. Thus, an average rate does not necessarily act as a reliable indicator of an events likelihood. However, the purpose of risk assessment is to determine the necessary controls (see BS EN ISO/IEC 27001:2017, 6.1.3 b). Despite uncertainty in the likelihood of rare events, organisations should ask whether they could accept the consequence if such rare events were to occur occur. If the answer is “no” then the risk assessment has fulfilled its purpose and the risk requires treatment.

When assessing likelihood, it is important to distinguish between the likelihood of an initial security event and the likelihood of subsequent occurrences of similar events. For example, given that the attack frequency using computers can be very high (thousands of attacks per second), then, whilst an organisation’s estimate of one attack on its website might be once in a decade, its estimate of 1,000,000 attacks could be the same. In other words, care should be taken when attempting to assess the likelihood of a complex scenario.

Whilst it might be possible for a control to counter the likelihood of an initial event (see 8.4), if that control fails, then a control is required that is capable of withstanding subsequent attacks. It is therefore often more prudent to look at the potential attack frequency rather than the likelihood of attack, as it might be the attack frequency that an information security control is designed to counter, rather than the likelihood of the initial attack.

TL/DR:

  • frequency descriptions are easier to assess and less subjective
  • range should cover inevitable and unlikely events
  • scales should have at least 5 categories with specific frequencies
  • look at potential attack frequency rather than likelihood

Lesson 2:

6.4.4 Criteria concerning level of risk

The level of risk is represented by the product of the likelihood and the expected consequences of an event. Knew line when considering multiple instances of an event, a reasonable approximation for aggregate exposure over time can often be derived by multiplying the consequence level of a single event by its expected number of occurrences in some chosen.. This is generally referred to as an aggregate loss expectancy. If the period chosen is one year it is often called an annualised loss expectancy. Commonly expressed in monetary terms, but need not be so for example, a hospital might use a patient recovery ratio.

if likelihood inconsequence are represented by the indices of an exponential scale (i.e. the logarithms of the values on the scale), these should be summed. The equation is then:

log(risk) = log(likelihood) + log(consequence)

Presentation obscures actual exposure to loss from immediate view by expressing the result risk as a logarithm, it is important to ensure that all stakeholders understand how to interpret such a result.

In table one an example of a high frequency event would be a computer assisted event password attack or a distributed denial of service attack from a botnet. Indeed, attack frequencies can be much higher. An example of a low frequency event would be volcanic eruptions. Even if an event is predicted to happen only once per century that does not mean it would not occur during the lifetime of an ISMS. Table two shows an example of lager rhythmic consequent scale.

Alternatively, qualitative category labels can be used. Once again it is essential that risk owners and risk assessors share a common understanding of the chosen categories Eg “zero to 10% of staff unable to process orders” as opposed to “a small number of staff unable to process orders”.

However, if qualitative category labels, such as never/seldom/sometimes/often/always, are used, no formal mathematical relationships between the categories can exist. In such cases, the design of a qualitative risk matrix should be guided by the organisation risk acceptance criteria (see 6.4.5). For example, an organisation might be more concerned about extreme consequences despite their unlikely occurrence, or primarily concerned about high frequency events with lesser consequences. This means that the design of qualitative risk matrix should be driven by the risk acceptance criteria of the organisation, rather than being assumed to conform to some arbitrary uniform layout. Over a qualitative risk matrix that is fully symmetrical about it’s low/low to high/high diagonal might naively seem desirable and a simple to create, it is unlikely to represent accurately any organisation real information security risk acceptance criteria.

The utility of qualitative category scales and the quality and reliability risk assessments that derive from them depends entirely on the consistency with which the category labels are interpreted by all stakeholders.

Given both the significant uncertainties inherent in information risk assessment and its primary function of prioritising risks rather than establishing their levels in absolute terms, qualitative assessment can at best be as reliable as quantitative assessment, but the opportunity for random error arising from personal uncertainty is much greater than for quantitative assessment. Consequently, it can be useful both to train and test assessors and to monitor and validate assessment more rigorously where category- based qualitative assessment is used.

The benefit of using a logarithmic scale is twofold. Firstly, it can conveniently encompass a much wider range of values than a linear scale. For example, the monetary consequences range £10 to £1,000,000 can be represented by six integer increments on a logarithmic scale as opposed to the 100,000 increments of £10 on a linear scale would require. Secondly, most increments of interest in risk assessment tend to be multiplicative rather than additive, EG a cost factor of 2 or 10 rather than an extra £200 or £1000. On a linear scale, multiplicative differences at higher values appear far larger than the same multiplicative difference at lower values.

Once again, the need for risk owners and assessors to understand the meaning of a logarithmic representation cannot be overstressed.

NOTE when producing a diagram showing the organisation’s risk tolerance as in Table 3, it can be presented as a heat map with each segment of the chart colour coded using a red/amber/green colour range to emphasise the organisations tolerance of each combination of impact and probability.

6.4.5 Criteria concerning the acceptance of risk

The criteria for the acceptance of risk can simply be a value above which the risk is deemed to be unacceptable. For example, in table 3, the value M can be chosen. Thus all risks with the value of VL, L or M would be considered by the organisation to be acceptable and all risks of the value of H or VH will be considered as being unacceptable. If money/time is used as the unit of risk then the corresponding level of acceptable risk, using Table 1 and Table 2 can be the value 6, which corresponds to an annual loss expectancy of £10,000/year.

However a simple criterion such as this does not always suffice in practise.

a) It is possible that an organisation might have to accept very significant consequences in cases where the event is rare and the organisation can do nothing to prevent it or reduce the severity of the resulting consequence. In this case, the organisation should define an additional criterion that deems that specific risks with the consequences greater than some value but a likelihood that is lower than some other value are acceptable.

b) It is also possible that an organisation might not wish to tolerate events with a frequency that is greater than some value, no matter how insignificant the consequence. This type of criterion takes account of the overhead costs of dealing with the consequences, however individually minor. The organisation should define an additional criterion that deems that all risks with the likelihood that is greater than some value irrespective of the consequences are unacceptable.

c) An organisation can set a lower bound to the acceptability of risk. This protects the organisation from over- control, IE having so many information security controls that they frustrate the ability of the organisation to achieve its objectives.

In addition, an organisation should take into account the following, where appropriate, when developing its risk acceptance criteria:

1) Risk acceptance criteria can be expressed as the ratio of estimated profit (or other business benefit) to different risk acceptance criteria can apply to different classes of risk, EG risks that could result in non- compliance with regulations or laws might not be accepted, while acceptance of high risks can be allowed if this is specified as a contractual requirement;

    2) risk acceptance criteria can include requirements for future additional treatment , e.g. a risk could be accepted if there is approval and commitment to take action to reduce it to an acceptable level within a defined time period;

    3) The level of management with delegated authority to make risk acceptance decisions, with associated risk level thresholds; And

    4) Unacceptable risks of determined risk levels that are to be reported to a higher level.

    Risk acceptance criteria can differ according to how long the risk is expected to exist, EG the risk can be associated with a temporary or short- term activity.

    Risk acceptance criteria can also be expressed in terms of:

    • Business criteria
    • legal and regulatory aspects
    • operations
    • technology
    • finance
    • process is
    • supplier relationships
    • Social and humanitarian factors

    Lesson 3:

    7.2 Approaches to risk identification and analysis

    7.2.1 General

    there are two widely recognised approaches to risk identification and risk analysis;