Front cover - IBM Redbooks

90 Lotus Security Handbook
security is being reviewed may not be able to provide all the information listed,
particularly about the security policy. (Indeed, there might not be a security policy
in place.) This is not a big problem at this stage since the rest of the methodology
calls for the creation of all these items.
2. Perform a risk analysis
The formula used in risk analysis is as follows:
Risk = Impact + Threats + Likelihood
Impact is what will happen to the business if an attack is successful, partially or
completely. Threats are the people and things that can cause harm to the
business. Likelihood is the degree of probability with which this can occur. The
combination of the three determines how much risk the business faces on a
day-to-day basis.
There are five steps in the process of doing a risk analysis:
1. Identify the assets of the business
2. Identify the threats to the business
3. Estimate the probability of occurrence
4. Analyze the applicable controls and determine their associated costs
5. Implement the appropriate countermeasures
Some security reviews include the threat analysis as an integral part of the risk
analysis. In the present methodology, threat analysis is a separate activity,
because threats are usually under-evaluated and not entirely and fully
understood.
3. Perform a threat analysis
There are two distinct steps in the process of doing a threat analysis:
1. Identify the exposures (or vulnerabilities)
2. Identify the controls (or countermeasures)
The first step involves asking a few simple, but effective, questions: What are the
vulnerabilities? Where are these vulnerabilities located? What is the likelihood of
these being exploited? And, what are the impacts to the IT infrastructure and to
the business?
The second step involves asking these questions: What are appropriate controls
for the exposures identified? How much do these controls cost? And are these
controls appropriate (in terms of effort and cost)?