2019-038-Deveeshree_Nayak-risk_analysis, and OWASP WIA

OWASP WIA - https://www.youtube.com/watch?v=umnt0qbOPsE

https://www.owasp.org/index.php/Women_In_AppSec

OWASP Women in AppSec

Twitter: 2013_Nayak (reach and ask to be added)

https://www.tagnw.org/events/

Risk in Infosec

 

Risk - a situation which involves extreme danger and extensive amount of unrecovered loss

    What about risks that are positive in nature?  PMP calls them ‘opportunities’

Risk Analysis - systemic examination of the components and characteristics of risk

 

Analysis Steps - 

        Understanding and Assessment

            Understand there is a risk

            What if a company does not have security standards?

       

           

        Identification

            Identify and categorize risk - 

                Informational risk

                Network risk

                Hardware risk

                Software risk

                Environment risk?

 

https://en.wikipedia.org/wiki/Routine_activity_theory

 

            Scope of risk analysis?

            Threat modeling to find risks?

                https://www.leviathansecurity.com/blog/the-calculus-of-threat-modeling 

            SWOT (strength/weakness/opportunities/threats) analysis will discover risks?

            Risk analysis methodologies?

                https://www.project-risk-manager.com/blog/qualitative-risk-techniques/

                https://securityscorecard.com/blog/it-security-risk-assessment-methodology

https://en.wikipedia.org/wiki/Probabilistic_risk_assessment

 

https://en.wikipedia.org/wiki/Capability_Maturity_Model_Integration 

 

        Estimation

            Chance that risk will occur (once a decade, once a week)

            Design controls to remediate

 

        Implementation

            Risk assessment is a combined approach

            Combined approach for a risk analysis

                You mentioned a lot of people, what’s the scope?

                How do you do the risk assessment? Framework?

           

        Evaluation

            Evaluation approach

                Like an agile approach

            Provides an informed conclusion

            Report must be clear (no jargon)

        Decision Making

           

 

Examples to Reduce Risk

Training and education

    what kind of testing? Annual Security training?

 

Publishing policies

Agreement with organization

    BAA with 3rd parties

Timely testing -