Governance, Regulation & Compliance

Education Level: Intermediate

6417 - Assessing Inherent and Residual Risks in an Enterprise Applications/Systems Portfolio

Co-Speaker(s)

• 

  Shankar Chebrolu, PhD, CISSP, ISSAP, CCSP, HCISPP

  Consulting Enterprise Security Architect
  Red Hat Inc.
• 

  Vinay Bansal, CCSP

  Principal Engineer
  Cisco Systems Inc

This session presents a model based on weighted criteria to identify the inherent risk of applications/systems. The model is flexible enough to adjust factors/criteria/weights based on changes in an enterprise's future environment, priorities, strategy or risk tolerance. Inherently high-risk applications/systems warrant a residual (deep dive) risk assessment by evaluating various security controls in place to mitigate risk against specific threats and vulnerabilities.

This session presents a residual risk assessment model based on STRIDE threat classification (spoofing, tampering, repudiation, information-disclosure, denial of service, elevation of privilege), which helps categorize different threats to systematically evaluate controls across applications/systems. The model looks at various control areas to determine residual risk of inherently risky applications/systems assigning appropriate qualitative (critical, high, medium, low) risk levels.

Learning Objectives:

• Learn a flexible model or framework to identify inherently risky applications/systems in an enterprise, based on various criteria and factors like data classification, systems classification, user base, criticality of dependent business process(es), resilient infrastructure and deployment location (public or hybrid cloud or on-premise).
• Learn how STRIDE threat classifications (spoofing, tampering, repudiation, information-disclosure, denial of service, elevation of privilege) help categorize different threats to systematically review controls across each application/system.
• Learn a framework that looks at various control areas to determine residual risk of inherently risky applications/systems assigning appropriate qualitative (critical, high, medium, low) risk levels.