Class Project Assignment Two NIST 800-30

Class Project Assignment Two

NIST 800-30

1. What is the purpose of NIST Special Publication 800-30?
   NIST Special Publication provides a foundation for the development of an effective risk management program, containing both the definitions and the practical guidance necessary for assessing and mitigating risks identified within IT systems.

2. What is the principal goal of an organization’s risk management process?

The principal goal of an organization’s risk management process is to protect the organization and its ability to perform their mission.

3. According to NIST, what three processes compose risk management?
   Risk Management encompasses three processes: identifying risk, assessing risk and mitigation (reducing) risk to an acceptable level.

4. How does risk management relate to the System Development Life Cycle (SDLC)?
   Risk management minimizes negative impact on an organization and must be totally integrated into the SDLC.
5. NIST 800-30 defines seven Information Assurance “key roles”. Name and briefly describe each of them.
   1) Senior management, under the standard of due care and ultimate responsibility for mission accomplishment, must ensure that the necessary resources are effectively applied to develop the capabilities needed to accomplish the mission.
   2) Chief Information Officer (CIO) is responsible for the agency’s IT planning, budgeting, and performance including its information security components.

3) System and Information Owners are responsible for ensuring that proper controls are in place to address integrity, confidentiality, and availability of the IT systems and data they own. Typically the system and information owners are responsible for changes to their IT systems.

4) Business and Functional Managers responsible for business operations and IT procurement process must take an active role in the risk management process.

5) IT security program managers and computer security officers are responsible for their organizations’ security programs, including risk management. ISSOs also act as major consultants in support of senior management to ensure that this activity takes place on an ongoing basis.

6) IIT security practitioners (e.g., network, system, application, and database administrators; computer specialists. security consultants) are responsible for proper implementation of security requirements in their IT systems.

7) Security Awareness Trainers (Security/Subject Matter Professionals). The organization’s personnel are the users of the IT systems. IT security trainers or security/subject matter professionals must understand the risk management process so that they can develop appropriate training materials and incorporate risk assessment into training programs to educate the end users.

6. How does NIST 800-30 define risk?
   The probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability.

7. How does NIST 800-30 define a threat?
   The potential for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability.
   
   
8. How is a threat source defined? Name three common threat sources.
   The threat source is defined either:
   1) intent and method targeted at the intentional exploitation of a vulnerability
   2) a situation and method that may accidentally trigger a

vulnerability.

Three common threat sources are: natural, human, or environmental.

9. How does NIST 800-30 define vulnerability?
   A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system’s security policy.

10. According to NIST, whose responsibility is IT Security? (technical or management).
    Information system security officers (ISSO) is responsible for the IT Security.

11. What is a security control?
    Risk reducing measure.

12. Define: technical controls, management controls, and operational controls.
    a) Technical controls can be configured to protect against given types of threats and usually involve system architectures; engineering disciplines; and security packages with a mix of hardware, software, and firmware.
    b) Management controls are implemented to manage and reduce the risk of loss and to protect an organization’s mission. Management controls focus on the stipulation of information protection policy, guidelines, and standards, which are carried out through operational procedures to fulfill the organization’s goals and missions.
    c) Operational controls are used to correct operational deficiencies that could be exercised by potential threat-sources.

13. How should the adverse impact of a security event be described?
    The adverse impact of a security event can be described in terms of loss or degradation of any, or a combination of any, of the following three security goals: integrity, availability, and confidentiality.
    
    

14. Describe the difference between quantitative and qualitative assessment?
    Qualitative impact analysis prioritizes the risks and identifies areas for immediate improvement in addressing the vulnerabilities, whereas quantitative impact analysis provides a measurement of the impacts’ magnitude, which can be used in the cost-benefit analysis of recommended controls.
    
    

15. Name and describe six risk mitigation options.
    a) Risk Assumption. To accept the potential risk and continue operating the IT system or to implement controls to lower the risk to an acceptable level
    b) Risk Avoidance. To avoid the risk by eliminating the risk cause and/or consequence (e.g., forgo certain functions of the system or shut down the system when risks are identified)
    c) Risk Limitation. To limit the risk by implementing controls that minimize the adverse impact of a threat’s exercising a vulnerability (e.g., use of supporting, preventive, detective controls)
    d) Risk Planning. To manage risk by developing a risk mitigation plan that prioritizes, implements, and maintains controls
    e) Research and Acknowledgment. To lower the risk of loss by acknowledging the vulnerability or flaw and researching controls to correct the vulnerability
    f) Risk Transference. To transfer the risk by using other options to compensate for the loss, such as purchasing insurance.
    
    

16. What is residual risk?
    The risk remaining after the implementation of new or enhanced controls