Real Life Information Security Bringing cost-benefit analysis into risk management OWASP Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under.
Download
Report
Transcript Real Life Information Security Bringing cost-benefit analysis into risk management OWASP Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under.
Real Life
Information Security
Bringing cost-benefit analysis into risk
management
OWASP
Copyright © The OWASP Foundation
Permission is granted to copy, distribute and/or modify this document
under the terms of the OWASP License.
The OWASP Foundation
http://www.owasp.org
Hewitt Associates
Human Resources Outsourcing
~25’000 employees worldwide
Highly sensitive clients’ data
OWASP
2
HRO Market
Not purely financial
Mostly B2B
Highly competitive
Stay competitive
Stay flexible
OWASP
3
Shepherds or policemen?
Very high pressure from business
No „one size fits all” approach
Lessons learnt
Talk to business
Have real arguments
Talk business
Where do all these numbers come from?
OWASP
4
From the past
Source: DatalossDB.org
OWASP
5
From market analytics
~$100 USD per record
No actual abuse required
„Losing control” is the bad word
How much to spend and where to stop?
Source: Ponemon Institute, „2008 Annual Study: Cost of Data Breach”
OWASP
6
From others’ fines
Source: FSA, 22 July 2009
OWASP
7
From Risk Analysis
Risk = Potential Loss * Threat
Probability
Potential Loss ~ Asset Cost, Brand
Value...
OWASP
8
When Risk Analysis makes sense?
Control Cost << Asset Cost
Source: Flickr
(edouаrd)
OWASP
9
What makes Control cost?
Roll-out cost
Obvious
Change cost
Not so obvious
Management
cost
Not so obvious
End-user usage
cost
Largely ignored
Especially if outside
Source: Flickr (dаveme)
OWASP
10
Potential loss → Control → Real loss
OWASP
11
Case studies
OWASP
12
Qualified Certificate in ZUS*
ZUS costs
Roll-out = ?
Administration = ?
Taxpayer costs (245’000 QC’s)
100-140 million PLN – one-time
~40 million PLN – annual QC renewal
Future costs
Attribute certificates (ZUS & taxpayers) = ?
„e-PUAP trusted profiles” (ZUS) = ?
* ZUS = Polish public pensions provider
Source: Money.pl, ZUS
OWASP
13
Invoicing
What’s the cost of invoicing?
People, paper, printing, postal, processing
Average €1,4 per paper invoice
Ultimate solution
Give up VAT
When e-invoicing makes sense?
» Electronic invoice TCO << Paper invoice TCO
» Theory: €0,4 versus €1,4
» Key word: TCO
Sources: EU MEMO/00/85
OWASP
14
E-Invoicing in Europe
Denmark
Poland
OCES & others allowed
Only QES & EDI
allowed
OCES: Quite simple origin
& integrity authentication
OCES: Proportional to einvoicing risks
Around 66% of all
invoices are e-invoices
EDI: supermarkets only
QES: Not designed for
automatic signature
QES: More legal that real
security
Around 5% of
companies use einvoicing
Sources: EEI 2007, ITST, OECD; GUS 2008
OWASP
15
Risk Management in e-banking
Auth
method
Num
ber
SMS
15
Token
11
Individual
Millions of
clients
↑Usable, ↓Big
cost
↓Big cost
Corporate
High nonrepudiation needs
↓Repudiation
↓Repudiation
TAN
7
↓Low security, ↓Repudiation
↑ Low cost
Smartc
ard
2
↓Not usable,
↓Big cost
↑ Nonrepudiation
Source: Bankier.pl report, October 2009 (selected data only)
OWASP
16
Laffer’s curve in security
Source: Wikipedia
OWASP
17
Mayfield’s Paradox
Source: ISACA, „Mathematical Proofs of Mayfield's Paradox”, 2001
OWASP
18
How to?
OWASP
19
Pitfall of „One-size fits all” approach
80
70
60
50
A
B
C
40
30
20
10
0
Risk
Cost
OWASP
20
Source: Willem Duiff, GE (SASMA
2009)
OWASP
21
Control questions
Before deploying a new solution
Do my controls help, instead of breaking
process?
How do my controls help business do its work?
Before asking for new funding
What we earned on last project?
OWASP
22
Is security a cost?
Security is an investment to prevent losses
Spend $100k to prevent losing $1m = 10x benefit
NOT: „Security again spent $100k”
YES: „Security helped save $1M for just $100k”
OWASP
23
How FDE saves money
Office break-in
Four laptops stolen
All with full-disk encryption
Cost of incident – zero
Hardware – insurance
Data confidentality – able to prove to client
Data availability – backups & network drives
Where’s ROI of FDE?
No $$$ in fines
No $$ in breach notification
No $? in brand damage
OWASP
24
Building a consistent security policy #1
Should people
should take their
laptops home?
Isn’t that increasing risk
of theft?
Laptop theft
Lose laptop ($)
Lose data ($$$)
Source: Flickr (аresnick)
OWASP
25
Building a consistent security policy #2
Laptop at home
Work from home
Disaster recovery,
business continuity
Examples: UK snow
(2009), London flood
(2009), Hemel Hempstead
explosion (2005)
Need to prevent the
other risks
Source: Wikipedia
OWASP
26
Building a consistent security policy #3
End-user message
„Always take your laptop home”
FDE is standard, non-optional proces
OWASP
27
Things we learned when talking to bussiness
Avoid „weasel talk” and buzzwords
„Some attacks exist that might pose a significant risk...”
Use as much facts and numbers as possible
Do use industry reports
Be careful with vendor reports
„How spam filtering helps preventing global warming”
Filter them through your company’s reality check
Learn from historic incidents in your organisation
Perform periodic review of your controls
Make sure at the old threat is still there
Make sure no new threats appeared
OWASP
28
Questions?
Questions, comments
[email protected]
http://www.linkedin.com/in/pawelkrawczyk
OWASP
29