Gary Stoneburner, Alice Goguen, and Alexis Feringa - Risk Management Guide For Information Tecnology Systems.pdf - Project_Management - kmichalo1

Special Publication 800-30

Risk Management Guide for

Information Technology Systems

Recommendations of the National Institute of

Standards and Technology

Gary Stoneburner, Alice Goguen, and Alexis Feringa

NIST Special Publication 800-30

Risk Management Guide for

Information Technology Systems

Recommendations of the

National Institute of Standards and Technology

Gary Stoneburner, Alice Goguen, and Alexis

Feringa

C O M P U T E R S E C U R I T Y

U.S. DEPARTMENT OF COMMERCE

Donald L. Evans, Secretary

TECHNOLOGY ADMINISTRATION

Phillip J. Bond, Under Secretary for Technology

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

Arden L. Bement, Jr., Director

SP 800-30

Page ii

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology

promotes the U.S. economy and public welfare by providing technical leadership for the nationÓs

measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-

concept implementations, and technical analyses to advance the development and productive use of

information technology. ITLÓs responsibilities include the development of technical, physical,

administrative, and management standards and guidelines for the cost-effective security and privacy of

sensitive unclassified information in federal computer systems. The Special Publication 800-series reports

on ITLÓs research, guidance, and outreach efforts in computer security, and its collaborative activities

with industry, government, and academic organizations.

National Institute of Standards and Technology Special Publication 800-30

Natl. Inst. Stand. Technol. Spec. Publ. 800-30, XX pages (October 2001)

CODEN: NSPUE2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an

experimental procedure or concept adequately. Such identification is not intended to imply recommendation or

endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities,

materials, or equipment are necessarily the best available for the purpose.

U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON: 2001

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Ï Phone: (202) 512-1800 Ï Fax: (202) 512-2250

Mail: Stop SSOP, Washington, DC 20402-0001

SP 800-30

Page iii

Acknowledgements

The authors, Gary Stoneburner, from NIST and Alice Goguen and Alexis Feringa from Booz

Allen Hamilton wish to express their thanks to their colleagues at both organizations who

reviewed drafts of this document. In particular, Timothy Grance, Marianne Swanson, and Joan

Hash from NIST and Debra L. Banning, Jeffrey Confer, Randall K. Ewell, and Waseem

Mamlouk from Booz Allen provided valuable insights that contributed substantially to the

technical content of this document. Moreover, we gratefully acknowledge and appreciate the

many comments from the public and private sectors whose thoughtful and constructive

comments improved the quality and utility of this publication.

SP 800-30

Page iv

TABLE OF CONTENTS

1. INTRODUCTION..............................................................................................................................................1

1.1 A UTHORITY .................................................................................................................................................1

1.2 P URPOSE ......................................................................................................................................................1

1.3 O BJECTIVE ..................................................................................................................................................2

1.4 T ARGET A UDIENCE .....................................................................................................................................2

1.5 R ELATED R EFERENCES ................................................................................................................................3

1.6 G UIDE S TRUCTURE ......................................................................................................................................3

2. RISK MANAGEMENT OVERVIEW .............................................................................................................4

2.1 I MPORTANCE OF R ISK M ANAGEMENT .........................................................................................................4

2.2 I NTEGRATION OF R ISK M ANAGEMENT INTO SDLC .....................................................................................4

2.3 K EY R OLES .................................................................................................................................................6

3. RISK ASSESSMENT ........................................................................................................................................8

3.1 S TEP 1: S YSTEM C HARACTERIZATION ......................................................................................................10

3.1.1 System-Related Information................................................................................................................10

3.1.2 Information-Gathering Techniques .....................................................................................................11

3.2 S TEP 2: T HREAT I DENTIFICATION .............................................................................................................12

3.2.1 Threat-Source Identification................................................................................................................12

3.2.2 Motivation and Threat Actions ............................................................................................................13

3.3 S TEP 3: V ULNERABILITY I DENTIFICATION ................................................................................................15

3.3.1 Vulnerability Sources...........................................................................................................................16

3.3.2 System Security Testing .......................................................................................................................17

3.3.3 Development of Security Requirements Checklist................................................................................18

3.4 S TEP 4: C ONTROL A NALYSIS ....................................................................................................................19

3.4.1 Control Methods ..................................................................................................................................20

3.4.2 Control Categories ..............................................................................................................................20

3.4.3 Control Analysis Technique.................................................................................................................20

3.5 S TEP 5: L IKELIHOOD D ETERMINATION .....................................................................................................21

3.6 S TEP 6: I MPACT A NALYSIS .......................................................................................................................21

3.7 S TEP 7: R ISK D ETERMINATION .................................................................................................................24

3.7.1 Risk-Level Matrix.................................................................................................................................24

3.7.2 Description of Risk Level .....................................................................................................................25

3.8 S TEP 8: C ONTROL R ECOMMENDATIONS ...................................................................................................26

3.9 S TEP 9: R ESULTS D OCUMENTATION .........................................................................................................26

4. RISK MITIGATION .......................................................................................................................................27

4.1 R ISK M ITIGATION O PTIONS .......................................................................................................................27

4.2 R ISK M ITIGATION S TRATEGY ....................................................................................................................28

4.3 A PPROACH FOR C ONTROL I MPLEMENTATION ............................................................................................29

4.4 C ONTROL C ATEGORIES .............................................................................................................................32

4.4.1 Technical Security Controls.................................................................................................................32

4.4.2 Management Security Controls............................................................................................................35

4.4.3 Operational Security Controls.............................................................................................................36

4.5 C OST -B ENEFIT A NALYSIS .........................................................................................................................37

4.6 R ESIDUAL R ISK .........................................................................................................................................39

5. EVALUATION AND ASSESSMENT............................................................................................................41

5.1

G OOD S ECURITY P RACTICE .......................................................................................................................41

Appendix AÏSample Interview Questions ............................................................................................................. A-1

Appendix BÏSample Risk Assessment Report Outline ...........................................................................................B-1

SP 800-30

Page iv

5.2

K EYS FOR S UCCESS ...................................................................................................................................41

Gary Stoneburner, Alice Goguen, and Alexis Feringa - Risk Management Guide For Information Tecnology Systems.pdf

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: