Methods for Identifying Risks to Information Security and Privacy

and Security Survey (CCSS) in 2011, risks that cause loss of information safety and security can be divided into 14 groups as follows:

(1) Compromise for intellectual property: Typical of this risk is copyright infringement, illegal copying of copyright.

(2) Software attacks: Such as using viruses, worms, macro programs, denial of service attacks, etc.

(3) Differences in the quality of service provided by service providers such as ISPs, the power of WAN systems, problems encountered in services from network service providers.

(4) Spying or Intrusion: Unauthorized access and data collection services that are unauthorized or without the user's consent.

(5) Natural hazards such as fire, flood, earthquake, lightning, tsunami.

(6) Human errors such as errors in computer use, problems that occur when employees perform operations, and lack of understanding of users.

(7) Blackmailing with information such as blackmail, threatening to illegally publish information, and terrorizing users with information.

(8) Missing or incomplete information such as interrupted access, information loss during storage, or loss of access to the information system due to disk failure without proper backup, or ineffective recovery plan.

(9) Incomplete, inadequate or incorrect control systems that cause vulnerabilities in computer networks, or that disable the prevention system, etc.

(10) Sabotage: Intentional sabotage to damage the information system such as human attacks, control systems that stop the system from operating.

(11) Theft: Theft of physical equipment, information storage devices, network equipment, etc.

(12) Hardware failure or malfunction.

(13) Software failures such as errors, program code problems, vulnerabilities, etc.

(14) Outdated technological equipment that is not updated in a timely manner also makes information systems unsafe to operate.

2.2.3. Methods for identifying risks that cause loss of information security and safety

The general method for identifying and determining risks to information security and safety in an information system is to follow a general 6-step process presented in Figure 2.2:

perform

Classification of components in the information system

Inventory and classify resources

Planning and organizing

Figure 2.2. Process of identifying risks that cause loss of information security and safety

(Source Mark Rhodes - Ousley [16])

Maybe you are interested!

(1) Step 1: Plan and organize the implementation process.

(2) Step 2: Classify the components of the information system.

(3) Step 3: List and classify resources.

(4) Step 4: Classify resources by priority.

(5) Step 5: Identify risks and threats according to the level of danger.

(6) Step 6: Specify the threats that attack the vulnerabilities.

Step 1. Plan and organize the implementation process

The first step in the process of identifying and determining risks to information security and safety is to follow the principles of project management, starting by organizing a group or team, usually the team members will include representatives of all group units whose assets are vulnerable or vulnerable to risks during the operation of the information system. Identifying and determining risks for information is carried out continuously from the time the information system begins to be operated until it is removed from the operation of the organization or enterprise and is carried out everywhere where there are possible risks in the organization or enterprise. This process must be planned, carried out periodically, with detailed assessments and specific reports sent to the leadership and management of the organization or enterprise.

This process is carried out step by step: defining tasks, organizing and assigning tasks, and arranging specific schedules. Only then can it be said that it is ready to actually start identifying and identifying risks to information security and safety.

Step 2. Classify the components in the information system

Typically, the components in an information system are divided into five categories: People, procedures, data, software, and hardware.

- People in the information system include employees, associates involved in operating and exploiting the system and customers. In organizations

Organizations typically have two groups of employees: those with authority and responsibility and those without privileges within the system; Associates, partners and customers may include contractors and consultants, members of other organizations with which the organization has a trusted relationship and the organization's customers.

- Procedures in the information system include issued procedures and sensitive procedures that have not been specifically identified in writing (in business, these are procedures that can make it possible for an agent to threaten the organization's operations, such as causing an attack against the organization or making the risk to the organization happen faster).

- Data in the information system includes all data being stored and used in the system, data participating in processing procedures and data being transmitted on the transmission channel. Each representation or state of data can have different risks of causing insecurity and loss of security.

- Software in the information system includes application software, operating software, specialized software, security software, etc. Accurately identifying software types contributes to improving the ability to identify risks to the infrastructure of the information system of an organization or enterprise - one of the potential components that can cause loss of safety and security of information in the information system.

- Hardware devices include computer hardware devices, network hardware devices, protection devices (including information security control system devices) and other external network devices of the organization or enterprise.

Step 3. Classify resources in the system

Resources related to information safety and security in information systems are all five components of the information system (hardware,

However, identifying the human resources, procedures, and data that need to be secured and risk-mitigated is more difficult than identifying hardware and software resources.

Personnel involved in the operation of the information system are usually numbered, coded or indexed by number, title, department, and work position. Personnel involved in ensuring the safety and security of the system need to have a firm grasp of the position and function of each personnel to ensure that they can receive timely notifications of incidents at all positions in the organization to maintain a stable working system.

Procedures need to be described specifically and clearly, with the purpose, scope, relationship to hardware, software, storage locations, and copies if any. Network factors and the scope of impact of the procedures need to be specified to ensure that users in the system can understand these procedures.

The data that needs to be stored and processed in the system also needs to be classified, according to the owner, creator, manager, size of the data structure, the types of data structures used (sequential, relational...), the type of storage and processing is online or offline; where the storage location is, who can use them, the backup mechanisms that affect them, how to backup and restore periodically? must all be managed clearly and in detail.

In addition, it is also necessary to classify data and information according to the security level of the information in the system, such as confidentiality, availability, risk exposure, control plan, access issues, responsible individuals or units...

For hardware, software, and network systems: What hardware components, software components, and network components need to be monitored? This depends on the organization's risk management needs and efforts, as well as the policies and needs of the security community.

information and information technology of the organization. Typically the following issues need to be considered:

- Account name: There may be problems such as duplicate names, multiple names for the same object, names not set according to standards... Therefore, it is necessary to unify the naming standards for objects participating in the components participating in the system such as users, hardware device names, servers, shared folders,...

- IP address: Many organizations and businesses use DHCP protocols in TCP/IP protocol or have not registered static IP addresses for international access, which can cause risks to the information systems of organizations and businesses.

- MAC address (the unique address of all hardware devices) is also a target that can be spoofed or attacked by unauthorized people when the information system is operating.

- For other components such as hardware (such as servers, desktops, network devices, or testing devices such as cameras, scanners, etc.), software (including special application software such as security software - firewalls, virtual private network management systems, transaction management systems, etc.), it is necessary to build a list of factors that can cause vulnerabilities and weaknesses in the system; as well as factors such as serial numbers or versions, product manufacturer names, geographic locations, etc. It is necessary to determine different priority levels, and issues are arranged in order of priority.

In addition, it is necessary to have a control regime for these entities, identify the organization and unit controlling each component, distinguish groups or units controlling each specific component and have specific policies for each subject.

Step 4. Determine priority based on the role and importance of resources

There is a need to assess the sensitivity and priority of the level of importance in the safety and security of information such as confidential information, internal information,

public information and devices related to the information movement process such as information storage devices, information transmission devices and information processing rules and procedures.

The classification and assessment methods must be chosen so that they cover all levels and do not overlap or exclude each other. The steps typically followed are: information assessment, prioritization, threat identification based on groups, vulnerability identification, and assessment documentation.

- Information evaluation:

To assess the information, an assessment sheet consisting of questions and points for answers can be used. The questions typically relate to the following:

+ Which information or service generates the most revenue for the organization?

+ What information generates the highest profitability?

+ What information is too costly to replace?

+ What information is most or least expensive to protect?

+ What information can easily cause legal problems for organizations and businesses or cause information leaks?

- Information measurement:

The calculation, estimation, or measurement of the information to be evaluated may be based on consideration of the following values of the information:

+ Value received from the cost of creating the information?

+ What value is gained from maintaining the information long term?

+ What is the value of providing the information that needs to be evaluated to users?

+ What is the value derived from the cost of protecting the information to be assessed?

+ What is the value of possessing the information to be evaluated?

+ The value of intellectual property information needs to be assessed?

+ Value assessment from competitors?

- Determine the level of influence of information:

Once the list of information to be evaluated is complete, a table should be developed to analyze the influencing factors (e.g. revenue, profit, brand image, etc.) based on their weights. Usually the priority (or weight) of the influencing factors is determined to sum to 100, meaning:

𝑤 = 𝑤 1 + 𝑤 2 +. . +𝑤 𝑛 = 1 ,

In which 𝑤 1 , 𝑤 2 , . . , 𝑤 𝑛 are the weights of the influencing factors respectively.

Step 5. Identify or recognize threats

After identifying and classifying the groups of information that need to be evaluated in the organization, it is necessary to analyze and check the risks and threats that may occur to that information of the organization. Threats that cause loss of safety and security of information in organizations and businesses are usually determined based on a number of characteristics.

Threat vector is a term used to describe where a threat originates and the path that must be taken to achieve the attack objective (risk becomes reality). For example: An email message sent from outside the organization to an employee inside the organization, the email has an attachment containing a Trojan horse, which when opened by the recipient will activate the Trojan horse. Here, the source of the threat is the file and the path to the target is the email.

Step 6. Specify the vulnerability of the resources

Based on the information groups that need to be assessed for the system and the threats that the system is likely to encounter, a list of vulnerabilities should be drawn up.

Comment