What is Poor Elicitation?
Vague/Weak Requirements
Why do few Developers Know how to Develop Secure Software?
- Not in most school curriculums
- Programming books/courses dont teach it
- Most developers dont think like an attacker
- Developers dont learn from others
Why is Most Software Insecure?
- Few developers know how to develop secure software
- Customers cant easily evaluate software security
- Managers dont always resource/train adequately
What is the Risk Management Process?
- Communication & Consultation
- Establish Context
- Risk Assessment
- Risk Treatment
What are the Steps in Risk Assessment?
- Identification
- Analysis
- Evaluation
What is Communication and Consultation in Risk Management?
- Ensure risks are understood, considered and communicated
- Aimed at IT Staff, Management, Users, Regulators
What is Establishing Context in the Risk Management Process?
Setting the playing field and understanding the current situation
What is Risk Assessment in the Risk Management Process?
- Recognizing and rating risks to determine priorities
What are the Steps of Risk Assessment?
- Identify potential risks
- Analyze likelihood and impact
- Prioritise risks based on severity
What is a Risk Identification in the Risk Management Process?
Working out the risks to your business
What should be Considered when Identifying Risks?
- Past events and risks
- Possible future changes to your business environment
- Social and community issues that can impact the business
- Market research
What is Risk Analysis in the Risk Management Process?
Assessing likelihood + impact of the risk
What Should be Considered in a Risk Analysis?
- Existing Controls
- Vulnerabilities
- Exposures
What is Likelihood?
- Chance of a hazardous event to occur
What is a Consequence?
Outcome of the hazardous event
Formula for Risk?
Risk = Likelihood * Impact
What is Risk Evaluation in the Risk Management Process?
Comparing and prioritizing risks and deciding which risks need treatment, monitoring, or acceptance?
What is Risk Treatment in the Risk Management Process?
Selecting actions to manage risk
What are the Potential Actions Against Risk?
- Avoid/Eliminate
- Control/Mitigate
- Detect/Recover
- Transfer/Share
- Accept/Retain
