A Prototypical Risk Analysis
A Prototypical Risk Analysis
var _sf_startpt=(new Date()).getTime()
var base_url = ‘http://www.articlesbase.com/’;var base_images_url = ‘http://images.articlesbase.com/’;var loading_icon = ‘http://images.articlesbase.com/point-loader.gif’;var loading_wide = ‘http://images.articlesbase.com/loadingAnimation.gif’;var loading_large = ‘http://images.articlesbase.com/ajax-loader-2.gif’;var loading_arrows = ‘http://images.articlesbase.com/loading_arrows.gif’;var loading_dots = ‘http://images.articlesbase.com/dots-horizontal.gif’;var captcha_url = ‘/trigger/captcha/’;
var str_qa_type_your_question = escape(“Ask our experts your Software related questions here…”); var int_question_title_max_length = 200;
GS_googleAddAdSenseService(“ca-pub-5157679868954075″);
GS_googleEnableAllServices();
GA_googleAddAttr(“Category”, “Computers”);
GA_googleAddSlot(“ca-pub-5157679868954075″, “Article_Bottom”);
GA_googleAddSlot(“ca-pub-5157679868954075″, “Article_Left2″);
GA_googleFetchAds();
function fbLogin(backlink){
if (backlink == null || backlink == ”){
backlink = ”;
} else {
backlink = ‘&backlink=’+encodeURIComponent(backlink);
}
FB.init({appId: ‘d4f0261b49c9a6e9ef675169020100ae’, status: true, cookie: true, xfbml: true});
FB.login(function(response){
if (response.session){
if (response.perms){
// user is logged in and granted some permissions. perms is a comma separated list of granted permissions
window.location = ‘/auth/connect?status=success’+backlink;
} else {
window.location = ‘/auth/connect?status=permissions_error’+backlink; // user is logged in, but did not grant any permissions
}
} else {
window.location = ‘/auth/connect?status=not_logged’+backlink; // user is not logged in in facebook
}
}, {perms:’email,publish_stream,offline_access’});
}
function fbInit(){
FB.init({appId: ‘d4f0261b49c9a6e9ef675169020100ae’, status: true, cookie: true, xfbml: true});
}
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-318473-1']);
_gaq.push(['_setCustomVar', 2, 'Category', 'Computers', 3],
['_setCustomVar', 3, 'SubCategory', 'Software', 3],
['_setCustomVar', 4, 'PenNameId', 27745, 3],
['_setCustomVar', 5, 'PublishDate', '2011-02', 3],
['_trackPageview']);
(function() {
var ga = document.createElement(‘script’); ga.type = ‘text/javascript’; ga.async = true;
ga.src = (‘https:’ == document.location.protocol ? ‘https://ssl’ : ‘http://www’) + ‘.google-analytics.com/ga.js’;
var s = document.getElementsByTagName(‘script’)[0]; s.parentNode.insertBefore(ga, s);
})();
var WRInitTime=(new Date()).getTime();
Free Online Articles Directory
Why Submit Articles?
Top Authors
Top Articles
FAQ
ABAnswers
function show_login_box() {
// move banner patch
if($(‘.static_pg_right_col’).length > 0 && $.browser.msie ) {
var ie_version = parseInt($.browser.version);
if(ie_version
Login
if($.cookie(“screen_name”)) {
$(‘#logged_in_true li span’).html($.cookie(“screen_name”).replace(/+/g,’ ‘));
$(‘#logged_in_true’).css(‘display’, ‘block’);
$(‘#top-authors-tab’).css(‘display’, ‘none’);
} else {
$(‘#logged_in_false’).css(‘display’, ‘block’);
}
Email
Password
Remember me?
Lost Password?
Home Page > Computers > Software > A Prototypical Risk Analysis
A Prototypical Risk Analysis
Posted: Feb 19, 2011 |Comments: 0
|
var addthis_config = { “data_track_clickback”:true, ui_language: “en” }
google_ad_channel = AB_cat_channel + AB_unit_channel;
google_language = “en”;
A majority of risk analysis process descriptions emphasize that risk identification, ranking, and mitigation is a continuous process and not simply a single step to be completed at one stage of the development lifecycle. Risk analysis results and risk categories thus drive both into requirements (early in the lifecycle) and into testing (where risk results can be used to define and plan particular tests).
Risk analysis, being a specialized subject, is not always best performed solely by the design team without assistance from risk professionals outside the team. Rigorous risk analysis relies heavily on an understanding of business impact, which may require an understanding of laws and regulations as much as the business model supported by the software. Also, human nature dictates that developers and designers will have built up certain assumptions regarding their system and the risks that it faces. Risk and security specialists can at a minimum assist in challenging those assumptions against generally accepted best practices and are in a better position to “assume nothing.”
A prototypical risk analysis approach involves several major activities that often include a number of basic sub steps.
Learn as much as possible about the target of analysis.
– Read and understand the specifications, architecture documents, and other design materials.- Discuss and brainstorm about the target with a group.
– Determine system boundary and data sensitivity/criticality.
– Play with the software (if it exists in executable form).
– Study the code and other software artifacts (including the use of code analysis tools).
– Identify threats and agree on relevant sources of attack (e.g., will insiders be considered?).
Discuss security issues surrounding the software.
– Argue about how the product works and determine areas of disagreement or ambiguity.
– Identify possible vulnerabilities, sometimes making use of tools or lists of common vulnerabilities.
– Map out exploits and begin to discuss possible fixes.
– Gain understanding of current and planned security controls.
Determine probability of compromise.
– Map out attack scenarios for exploits of vulnerabilities.
– Balance controls against threat capacity to determine likelihood.
Perform impact analysis.
– Determine impacts on assets and business goals.
– Consider impacts on the security posture.
Rank risks
Develop a mitigation strategy.
– Recommend countermeasures to mitigate risks.
Report findings
– Carefully describe the major and minor risks, with attention to impacts.
– Provide basic information regarding where to spend limited mitigation resources.
A number of diverse approaches to risk analysis for security have been devised and practiced over the years. Though many of these approaches were expressly invented for use in the network security space, they still offer valuable risk analysis lessons.
-
About the Author:
Spec India is a Custom Software Application Development and Software Solutions Company based in Ahmedabad, India. Our Services includes iPhone Application Development, Android Application Development, ORACLE, .Net, and Mobile Computing.
Article Source