Page Navigation:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75
Printable Version: RFC2196.PDF
RFC 2196 Site Security Handbook September 1997
1.6 Risk Assessment
1.6.1 General Discussion
One of the most important reasons for creating a computer security
policy is to ensure that efforts spent on security yield cost
effective benefits. Although this may seem obvious, it is possible
to be mislead about where the effort is needed. As an example, there
is a great deal of publicity about intruders on computers systems;
yet most surveys of computer security show that, for most
organizations, the actual loss from "insiders" is much greater.
Risk analysis involves determining what you need to protect, what you
need to protect it from, and how to protect it. It is the process of
examining all of your risks, then ranking those risks by level of
severity. This process involves making cost-effective decisions on
what you want to protect. As mentioned above, you should probably
not spend more to protect something than it is actually worth.
A full treatment of risk analysis is outside the scope of this
document. [Fites 1989] and [Pfleeger 1989] provide introductions to
this topic. However, there are two elements of a risk analysis that
will be briefly covered in the next two sections:
(1) Identifying the assets
(2) Identifying the threats
For each asset, the basic goals of security are availability,
confidentiality, and integrity. Each threat should be examined with
an eye to how the threat could affect these areas.
1.6.2 Identifying the Assets
One step in a risk analysis is to identify all the things that need
to be protected. Some things are obvious, like valuable proprietary
information, intellectual property, and all the various pieces of
hardware; but, some are overlooked, such as the people who actually
use the systems. The essential point is to list all things that could
be affected by a security problem.
One list of categories is suggested by Pfleeger [Pfleeger 1989]; this
list is adapted from that source:
(1) Hardware: CPUs, boards, keyboards, terminals,
workstations, personal computers, printers, disk
drives, communication lines, terminal servers, routers.
Fraser, Ed. Informational [Page 5]