返回
rational risk management - m e kabay web site：合理的风险管理- m e kabay网站

rational risk management - m e kabay web site：合理的风险管理- m e kabay网站

ID：18020298

大小：1.60 MB

页数：57页

时间：2018-09-12

rational risk management - m e kabay web site：合理的风险管理- m e kabay网站_第1页
rational risk management - m e kabay web site：合理的风险管理- m e kabay网站_第2页
rational risk management - m e kabay web site：合理的风险管理- m e kabay网站_第3页
rational risk management - m e kabay web site：合理的风险管理- m e kabay网站_第4页
rational risk management - m e kabay web site：合理的风险管理- m e kabay网站_第5页
资源描述：

《rational risk management - m e kabay web site：合理的风险管理- m e kabay网站》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、RationalRiskManagement:BalancingCostsandBenefitsofSecurityMeasuresCybersecurityConference26July2006–13:00-16:00M.E.Kabay,PhD,CISSP-ISSMPAssoc.Prof.InformationAssurance DivisionofBusiness&Management,NorwichUniversityProgramDirector,MSIA SchoolofGraduateStudies,NorwichUniversitymailto:mkabay@no

2、rwich.eduV:802.479.7937TopicsPart1:RiskAssessment*DefinitionsObjectivesofRiskAssessmentLimitsofQuestionnairesAModelofRiskRiskMitigationPart2:RiskAssessmentTechniquesQuestionnairesFocusGroupsInterviewsAnalyticalTools____________________________________________ *BasedinpartonRobertJacobson’sch

3、apterin CSH4(Bosworth&Kabay’sComputerSecurity Handbook,4thedition–Wiley,2002)DefinitionsRisk:possibilityofsufferingharmorlossRiskManagementRiskassessmentRiskmitigationSecuritymanagementSecurityauditingFeedbackensurescorrectiveactionsbackintoprocess–continuousprocessimprovementSecurityisaproce

4、ss,notastate.ObjectivesofRiskAssessmentHelptoselectsubsetofsecuritymeasuresgivenlimitationsonresourcesEverysystemwillhaveuniquesecurityrequirementsRiskassessmentmustprovideappropriateinformationaboutPossiblelosses(costsofdamageandofrecovery)Estimatedprobabilityofspecificeventsorclassesofevent

5、sAModelofRiskFundamentalRiskModelTwoInconsequentialRiskClassesTwoSignificantRiskClassesReal-WorldRisks&theALEFundamentalRiskModel“Jacobson’sWindow”LowHighConsequencesHighOccurrencesLowTwoInconsequentialRiskClassesLowHighConsequencesHighOccurrencesDon’t careDoesn’t happenLowTwoSignificantRiskC

6、lassesLowHighConsequencesHighOccurrencesMajorfire, longpoweroutage, flooding, cashfraud, ….Powertransient, minorswbug, keystrokeerror, ….LowReal-WorldRisks&theALETocomparerisks,weusetheannualizedlossexpectancy(ALE):E(x)=piciWhereE(x)=ALEofstrategyxpi=probabilityofoccurrenceici=costofoccurren

7、cei=adduptheproductsiExampleofALECalculationKeystrokeerrors(Jacobson’sexamplewithslightmodifications)100errorsper operatorperhour100operators2,000hoursper operatorperyear=20,000,000errorsperyearDetectionrate99.9%atnocostThusp=0.001failurera

当前文档最多预览五页，下载文档查看全文

此文档下载收益归作者所有

当前文档最多预览五页，下载文档查看全文
温馨提示：
1. 部分包含数学公式或PPT动画的文件，查看预览时可能会显示错乱或异常，文件下载后无此问题，请放心下载。
2. 本文档由用户上传，版权归属用户，天天文库负责整理代发布。如果您对本文档版权有争议请及时联系客服。
3. 下载前请仔细阅读文档内容，确认文档内容符合您的需求后进行下载，若出现内容与标题不符可向本站投诉处理。
4. 下载文档时可能由于网络波动等原因无法下载或下载错误，付费完成后未能成功下载的用户请联系客服处理。