A central point for collection of information that relates to computer security. Including, but not limited to, security advisories from the major vendors, major data breaches, “phishing” alerts, commentary regarding staffing levels. etc. etc.
Software Engineering Institute Cyber Security Paper
August 10, 2011 at 6:23 pm #138078
Title: A Taxonomy of Operational Cyber Security Risks
Authors: James J. Cebula Lisa R. Young
Date December 2010
Copyright 2010 Carnegie Mellon University.
THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder.
Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works.
External use. This document may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other external and/or commercial use. Requests for permission should be directed to the Software Engineering Institute at [email protected].
This work was created in the performance of Federal Government Contract Number FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, for government purposes pursuant to the copyright license under the clause at 252.227-7013.
This report presents a taxonomy of operational cyber security risks that attempts to identify and organize the sources of operational cyber security risk into four classes: (1) actions of people, (2) systems and technology failures, (3) failed internal processes, and (4) external events. Each class is broken down into subclasses, which are described by their elements. This report discusses the harmonization of the taxonomy with other risk and security activities, particularly those described by the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) Special Publications, and the CERT Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVE®) method.
Organizations of all sizes in both the public and private sectors are increasingly reliant on information and technology assets, supported by people and facility assets, to successfully execute business processes that, in turn, support the delivery of services. Failure of these assets has a direct, negative impact on the business processes they support. This, in turn, can cascade into an inability to deliver services, which ultimately impacts the organizational mission. Given these relationships, the management of risks to these assets is a key factor in positioning the organization for success.
Operational cyber security risks are defined as operational risks to information and technology assets that have consequences affecting the confidentiality, availability, or integrity of information or information systems. This report presents a taxonomy of operational cyber security risks that attempts to identify and organize the sources of operational cyber security risk into four classes: (1) actions of people, (2) systems and technology failures, (3) failed internal processes, and (4) external events. Each class is broken down into subclasses, which are described by their elements. Operational risks are defined as those arising due to the actions of people, systems and technology failures, failed internal processes, and external events. The CERT® Program, part of Carnegie Mellon University’s Software Engineering Institute (SEI), developed these four classes of operational risk in the CERT® Resilience Management Model [Caralli 2010b], which draws upon the definition of operational risk adopted by the banking sector in the Basel II framework [BIS 2006]. Within the cyber security space, the risk management focus is primarily on operational risks to information and technology assets. People and facility assets are also considered to the extent that they support information and technology assets.
This taxonomy can be used as a tool to assist in the identification of all applicable operational cyber security risks in an organization. Toward that end, this report also discusses the harmonization of the taxonomy with other risk identification and analysis activities such as those described by the Federal Information Security Management Act of 2002 [FISMA 2002], security guidance contained within the National Institute of Standards and Technology (NIST) Special Publications series, and the threat profile concept contained within the CERT Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVE®) method.
download47 page PDF file
You must be logged in to reply to this topic.