Security - Telenor

70
financial, social, environmental, humanitarian
and/or organisational information;
• A clearly stated boundary between what is
included and what is not included in the risk
analysis.
The quality of the analysis is heavily influenced
by this first step. If a critical part of the TOE is
forgotten or deliberately omitted the analysis
may be invalidated. Missing or inadequately described
parts of the TOE usually produce confusion
and arguments instead of a good understanding
of the TOE. Arguments are also common
when people do not accept the limits of the
analysis.
This step is important, because it synchronises
people’s understanding of the TOE and lays
down the ground rules for the threat identification
phase.
Unfortunately, the layperson is seldom prepared
to spend time on this step because “everyone
knows what the TOE is”. Maybe, but it is a rare
occasion when everyone knows what the TOE
actually is, understands what it really does, correctly
describes the critical success factors, precisely
describes the customer, etc.
Threat Analysis
The second step is the threat analysis, which
Telenor splits into two half steps.
The first half step involves identifying the threats
to the TOE. A threat is a present or future vulnerability,
activity, accomplishment or event that
could have a negative future impact on the TOE.
It is essential to use a structured approach in the
threat identification phase. Significant threats are
usually overlooked when the threat identification
phase is unstructured, thus lowering the credibility
of the analysis. An unstructured approach
also leads to repeatedly returning to the threat
identification process, thus increasing costs.
Telenor recommends Hazard and Operability
studies (Hazop) [4] as a basis for threat identification.
Hazop is a technique for structuring a
brainstorming process, and is well suited when
analysing complex objects. A skilfully executed
Hazop will supply an exhaustive list of threats,
what causes the threats to materialise and to a
certain extent the consequences of the threats.
However, Hazop is not recommended if the analyst
does not have previous experience with this
technique.
For the layperson, Telenor recommends using
specially designed threat identification tech-
niques [5] even though this is a less structured
approach to threat identification.
The next half step is an analysis of what causes a
threat to occur. A separate brainstorming session
may be necessary unless the causes were established
during the threat identification phase. In
this session one tries to answer the question
“what can cause this threat to materialise”.
The depth of the causal analysis is determined
by the length of the causal chain. The direct
cause of the threat is sometimes enough, but it
may be necessary to establish a chain of causes
before the causality is sufficiently examined.
Frequency and
Consequence Analysis
The third and fourth step consists of analysing
the frequencies and consequences related to each
threat. The model shows these steps side by side,
because it is a matter of personal preference and
practicality whether one is completed before the
other begins, or if they are analysed in parallel.
The frequency analysis examines each threat to
determine how often the threat is likely to occur.
The frequency analysis should be quantitative,
but lack of time and hard data usually prevents
this. The preferable alternative is to quantify a
range of frequencies – for instance high, medium,
low – and allocate each threat to one of the
labelled ranges. If this is impossible, a qualitative
description of the likelihood of each threat
is called for.
The consequence analysis focuses on the damage
a threat can set off, preferably expressed in
economic terms. An indirect consequence occurs
when the triggered threat sets off a chain of
events before the consequence shows up, whereas
a direct consequence is set off by the triggering
threat. Sometimes it is necessary to look for
both direct and indirect consequences before the
total loss is determined. In any case, it is essential
to determine the consequences because no
loss prevention measure should cost more than
the loss it prevents.
The consequence analysis should also outline
the mechanisms or barriers that are supposed to
prevent the damage. This knowledge is useful
when selecting measures to minimise the consequences
when a threat is set off.
Exposure Description
The previous steps analysed threats, frequencies
and consequences. The next step is to present the
threats in terms of risk exposure. The risk exposure
is a description of the impact a materialised
risk will have. There are three main points to
consider:
Telektronikk 3.2000