Tumblelog by Soup.io
Newer posts are loading.
You are at the newest post.
Click here to check if anything new just came in.

November 18 2014


Dyman & Associates Risk Management Projects: Google Lease Navy Base for 60 Yrs

Google has secured the lease of a NASA airbase in San Francisco for 60 years, possibly to house their upcoming space-exploration vehicles and robotics research.

The agency's press release at Dyman & Associates Risk Management Projects indicated that the lease, which will cost the tech giant $ 1.16 billion, is for " research, development, assembly and testing in the areas of space exploration, aviation, rover/robotics and other emerging technologies".

NASA Administrator Chris Bolden said, "As NASA expands its presence in space, we are making strides to reduce our footprint here on Earth." He added that the agency wants "to invest taxpayer resources in scientific discovery, technology development and space exploration – not in maintaining infrastructure no longer needed."

According to the report, a real-estate offshoot of Google called Planetary Ventures will be managing the Moffett airbase and will take over the $200 million improvement to the site, which includes educational facilities to let the public "explore the site's legacy".

The 1,000 acres of airfield in the southern part of SF Bay include two runways, a golf course, office space, NASA's Ames research center and three hangars, one of which is the iconic Hangar One. It's expected that the agency will save around $6 million worth of operation and maintenance expenses per year because of the lease.

Hangar One is one of the biggest freestanding edifice which covers 8 acres and was constructed in the 1930s for US naval airships. In 1966, it was recognized as a US Naval Historical Monument but has recently been placed as an endangered historic place according to a Dyman & Associates Risk Management Projects' press release.

“GSA was proud to support NASA in delivering the best value to taxpayers while restoring this historic facility and enhancing the surrounding community," said Dan Tangherlini of the US General Services Administration.

The Moffett lease shouldn't really come as a surprise as it's practically just next to Googleplex HQ. In fact, it's already servicing private jets owned by the company's executives such as Sergey Brin, Larry Page and Eric Schmidt.

Both Brin and Page, the firm's co-founders, are evidently interested in space exploration and aviation as shown by their X Lab's Project Loon and Project Moonshot. Their company has also acquired satellite and robotics firms recently such as Meka Robotics and Redwood Robotics.

NASA and Google have also previously teamed up in 2005 when the latter made office at the agency's research facility and launch a new lab.

November 04 2014


Dyman Associates Risk Management Review: 3 Ways to Make Your Outlook.com Account Safer

Following on from our detailed guide to securing your webmail, here's a quick breakdown of how to make the most important fixes for users of Microsoft's Outlook.com (formerly known as Hotmail and, for a while, Windows Live Hotmail).

Controls affecting Outlook.com security are mainly found in one central place, which can be accessed by clicking your username (this will probably be your name), shown in the top right of any live.com page when you're logged in, and selecting "Account settings".

1. Protect your password

Your first step should be to make sure your password is well chosen and not shared.

If you need to set a new one, visit the "Security & privacy" section of the Account settings page.

You'll then have to verify your account with a security code, which you can do by email or text.

At the top you'll see when your password was last changed, with an option to change it below.

Just below that, in the section labelled "Security info helps to keep your account secure", you'll find any backup email addresses or phone numbers you've given to Microsoft to help verify your identity if you get locked out of your account.

Make sure these are a good way of getting in touch with you, and are not easily accessible by people you don't trust.

These contact points will also be used to send alerts if Microsoft spots any suspicious activity - you can choose whether or not to receive alerts by phone and whether to have them sent to multiple email addresses, but the primary alternate email must always get alerts.

2. Set up two-step verification

On the same screen you can also set up two-step verification.

Scroll down to the next section of the "Security & privacy" page.

When you follow the link to set it up, Microsoft recommends using a smartphone app, which will vary depending on what kind of device you use.

Windows Phone users can get Microsoft's own authenticator app, Android users can use the Microsoft Account app, and those with iOS devices will need Google's multi-purpose Authenticator.

Each has its own process for setting up, but most will simply require you to scan a QR code displayed on-screen. Once set up, you should be able to use the code generated by the app any time you want to log in to your account.

If you choose not to use an app, or don't have a smartphone, you can have codes sent by SMS to the number you provide, or by email to one of your alternative accounts, but Microsoft will continue encouraging you to opt for the app approach, at least until you tell it to stop.

When you log in with a 2SV code, there will be an option to trust the device you're using and not ask for any more codes, so in future you'll only need your normal password.

Only check the box if you're on a machine you use regularly and know to be kept well-secured.

As part of setting up 2SV, you'll be given an emergency backup code. This is used if you ever lose access to the apps, phone numbers and email addresses provided for 2SV codes.

Outlook.com recommends you print it and keep it somewhere very safe, but if you find it easier to keep it in a file on your (well secured) computer, make sure it's very well encrypted.

In the "Recovery codes" section you can choose to renew the emergency backup code if you no longer have it.

3. Check your settings

You should consider checking the "Security & privacy" page occasionally, to make sure the backup and 2SV contact details are up to date - check that any old devices you no longer have are removed from the "Security info" or "App passwords" sections.

There's no way to monitor which devices have been marked as trusted for 2SV purposes, but at the bottom of the "Security & password" page you can at least remove trust from all machines, cutting off anyone who may have obtained unauthorised access.

There's a whole section of the "Security & Privacy" area dedicated to "Recent activity".

This is the place to go if you suspect someone's been intruding on your account. You can view a detailed list of logins, attempts, 2SV challenges and significant settings changes, and for each one there is further information on the device type and browser or app used, the IP address and location.

There's even a little Bing map pinpointing where the IP address appears to come from, but this may not be very accurate, particularly for things like POP access from a mobile mail client.

In case you're worried about any particular event, the details area for each one provides a large button marked "This wasn't me". Clicking this will lead to a review of your security settings, including resetting your password to make sure strangers are kept out.

Finally, the "Related accounts" section, under "Security & Privacy" lets you view and manage any accounts you have linked to your Outlook.com account, and also any other apps and services which may have been granted access.

You should make sure any entries in here are expected and necessary.

Once you're done with making your Outlook.com account safer, make sure you are following our general advice in our guide to securing your webmail.

October 30 2014


Dyman Associates Risk Management review: Experts Identify Easy Way to Improve Smartphone Security

Assigning risk scores to apps may slow down unwarranted access to personal information

October 28, 2014

What information is beaming from your mobile phone over various computer networks this very second without you being aware of it?

Experts say your contact lists, email messages, surfed webpages, browsing histories, usage patterns, online purchase records and even password protected accounts may all be sharing data with intrusive and sometimes malicious applications, and you may have given permission.

"Smartphones and tablets used by today's consumers include many kinds of sensitive information," says Ninghui Li, a professor of Computer Science at Purdue University in Indiana.

The apps downloaded to them can potentially track a user's locations, monitor his or her phone calls and even monitor the messages a user sends and receives--including authentication messages used by online banking and other sites, he says, explaining why unsecured digital data are such a big issue.

Li, along with Robert Proctor and Luo Si, also professors at Purdue, lead a National Science Foundation (NSF)-funded project "User-Centric Risk Communication and Control on Mobile Devices," that investigates computer security. The work pays special attention to user control of security features in mobile systems.

Li, Proctor and Si believe they may have a simple solution for users, who unknowingly allow voluntary access to their personal data.


Most users pay little attention

"Although strong security measures are in place for most mobile systems," they write in a recent report inthe journal IEEE Transactions on Dependable and Secure Computing, "the area where these systems often fail is the reliance on the user to make decisions that impact the security of a device."

Most users pay little attention, say the researchers, to unwanted access to their personal information. Instead, they have become habituated to ignore security warnings and tend to consent to all app permissions.

"If users do not understand the warnings or their consequences, they will not consider them," says Proctor, a Distinguished Professor of psychological sciences at Purdue.

"If users do not associate violations of the warnings with bad consequences of their actions, they will likely ignore them," adds Jing Chen, a psychology Ph.D. student who works on the project.

In addition, there are other influences that contribute to users ignoring security warnings. In the case of Android app permissions, of which there are more than 200, many do not make sense to the average user or at best require time and considerable mental effort to comprehend.

"Permissions are not the only factor in users' decisions," says Si, an associate professor of Computer Science at Purdue, who also led research on a paper with Li that analyzed app reviews.

"Users also look at average ratings, number of downloads and user comments," Si says. "In our studies, we found that there exist correlations between the quality of an app and the average rating from users, as well as the ratio of negative comments about security and privacy."

"This is a classic example of the links between humans and technology," says Heng Xu, program director in the Secure and Trustworthy Cyberspace program in NSF's Social, Behavioral and Economic Sciences Directorate. "The Android smartphones studied by this group of scientists reveals the great need to understand human perception as it relates to their own privacy and security."

"The complexity of modern access control mechanisms in smartphones can confuse even security experts," says Jeremy Epstein, lead program director for the Secure and Trustworthy Cyberspace program in NSF's Directorate for Computer and Information Science and Engineering, which funded the research.

"Safeguards and protection mechanisms that protect privacy and personal security must be usable by all smartphone users, to avoid the syndrome of just clicking 'yes' to get the job done. The SaTC program encourages research like Dr. Li's and colleagues that helps address security usability challenges."

Numbers speak to the amount of unsecured personal data

October 14 2014


Dyman Associates Risk Management Crucial To The Mining Industry’s Growth

Managing Director of Marsh Botswana, Fritzgerald Dube, said the mining industry is faced with exposures that need to be identified, measured and controlled economically in order for the mine’s operations to flourish.  Speaking at a mining seminar hosted by Marsh Botswana last week, Dube explained that while the environment in which they operate in is always changing and presenting new threats, they are able to understand risk trends and develop effective programmes. Although a lot of mines have fully fledged risk management departments, Dube noted that mining is a dynamic and ever evolving specialty and that new risk that were not previously anticipated would always evolve.

“As such, risk managers need to be forever considering and devising risk management plans for those risks which they have never been exposed to before,” he advised. Dube added that risk managers need to recognise that they play a critical role in ensuring stability of operations and sustained production in whatever environment that they operate in.

He underscored the importance of risk management, stating that it is a critical function in all mines. He urged top management to commit to instilling a risk management culture throughout the entire organisation.

“Risk management should not be a ‘nice to have’ but rather a ‘must have’ that carries the full weight and support of senior management,” he stressed.

However, Dube regretted that the impact of uncertain events on mine productivity is not limited to loss of property and revenue alone, but possible death as well. An earlier report that was issued by a leading reinsurance advisor, Willis Group Holdings, warned mining companies not to be tempted to cut back on their risk management spending as they try to deal with rising costs, falling commodity prices and decreased productivity levels.

The report titled, Mining Risk Review 2011, identified the main challenges mining companies are facing. They further stated that the bulk of cost cutting had come from reductions in head office spend, exploration and business development.

On the same topic, Botswana Confederation of Commerce and Manpower (BOCCIM) CEO Maria Machailo-Ellis acknowledged that the mining industry had been experiencing fatal accidents around the country. She however noted that they had moved ahead with efforts to prevent recurrence.

Marsh Botswana was established in 1984 and is a subsidiary of Marsh & McLennan Companies, a world leader in delivering risk and insurance services and solutions. Marsh currently provides insurance brokerage and risk advisory services to over 70 percent mines across the globe.




October 10 2014


Dyman Associates Risk Management-Reserve Bank Warns Rising House Prices and Investors Could Hurt Economy

The Reserve Bank has warned that soaring housing prices and rapidly growing investor activity could pose risks to the economy.


The RBA said low interest rates, rising house prices and competition among lenders had translated into a strong pick-up in lending to property investors, particularly in Sydney and Melbourne, creating an imbalance.


Households had become increasingly willing to take on risk and debt this year, the RBA said.


It attributed the pick-up in household credit growth to being almost entirely driven by investor housing credit, which was growing at its fastest pace since 2007.


“The composition of housing and mortgage markets is becoming unbalanced,” the RBA said in its biannual financial stability review on Wednesday.


It has begun talks with the Australian Prudential Regulation Authority (Apra) about how to reinforce sound lending practices for property purchases.


Risks to financial institutions would increase if high rates of lending growth persisted or increased.


“The apparent increase in the use of interest-only loans by both owner-occupiers and investors might also be consistent with increasingly speculative motives behind current housing demand,” the RBA said.


“At this stage the main risk from this strong investor activity appears to be that the extra demand may exacerbate the housing price cycle and increase the potential for prices to fall later.”


That could pose risks to the economy if people reacted to declines in their wealth and loan repayment difficulties by cutting back on their spending.


Households that could be most affected were not necessarily the ones taking out loans, it added.


There was also the risk that the increased demand would lead to too much construction and an eventual oversupply of housing, but this was more likely to affect specific local markets, particularly Melbourne.


The RBA said the rise in investor activity had probably priced some potential first-home buyers out of the market.


The willingness of some households to take on more debt, combined with slower wage growth, meant the debt-to-income ratio had picked up a little in the past six months.


“While this ratio is still within its range of the past eight years at around 150%, it is historically high and hence any further increases in household indebtedness would be taking place from an already high base,” it said.


The RBA warned banks to be cautious about their lending practices.


“It is important for macroeconomic and financial stability that banks set their risk appetite and lending standards at least in line with current best practice, and take into account system-wide risks in property markets in their lending decisions,” it said.


In the past year Apra had increased the intensity of supervision around housing market risks facing banks.


It is also working on new guidance for sound risk management practices in mortgage lending.


“The characteristics and risk profile of households investment property exposures warrant close examination given the recent strength of investor demand for housing,” the RBA said.

October 08 2014


Dyman Associates Risk Management: Is Your Money Safe?

Is Your Money Safe? Risk Management Blindspots That Cost Investors Dearly


Both retail and institutional investors who have survived one or more economic recessions have learned that they cannot select their money managers solely on a demonstrated stream of at or above benchmark returns and that they need to include the underlying risk of their investment portfolio in the formula that calculates expected future value. However, the risk denominator in portfolio management analytics may be underestimated or misestimated because of the following three industry problems:


1. The traditional view of risk is disaggregated


The traditional view segregates risk into market, credit and operational. In most organizations, both public corporations that issue equity and debt to investors and privately-held asset managers that oversee investors’ money, the various aspects of risk are managed separately.  For example, in some typical organizational structures, the Investment Officer is responsible for market risk; the Treasury Officer or CFO for credit risk and the COO for operational risk.  Each analyzes and synthesizes risk separately and reports his findings to the Board or Management Committee, leaving them baffled to make sense of the holistic picture.  However, risk is not additive or linear and often hot spots in one area may cause undetected issues in other areas.


Market, credit and operational risk were interrelated in one of the most notorious examples of risk mismanagement — AIG’s failure to meet its liquidity obligations which led to $170 billion government bailout.  AIG was heavily involved in writing CDS with its exposure at the height reportedly reaching $440 billion (market risk), which exceeded what the company could pay in claims when the MBS it insured defaulted leading to a liquidity crunch (credit risk).  Additionally, there were signs of inherent operational risks: AIGFP was a minimally regulated and separate hedge fund that leveraged the credit rating of the holding company to place big bets with little reserves. Each one of these issues separately did not pause “crash the car” risk, but in aggregate the market, credit and operational risk factors of AIG could have been lethal to the company and the economy safe for the subsequent government bailout.


2. Regulators are approaching the industry reactively


Significant regulatory tightening ensued after the 2008 mortgage crisis.  According to some critics, regulators may potentially be looking at risk far more reactively by focusing on the problems that have already manifested than proactively identifying new risks that could cause the next business failure. For example, the Financial Stability Oversight Council (FSOC) so far designated three US financial institutions as Systemically Important Financial Institutions (SIFIs) – GE , Prudential  and AIG and imposed on them increased capital requirements. However,  the FSOC does not consider large asset managers to be SIFIs. There is some merit to the logic that asset managers do not require as strong of a balance sheet since they do not own the assets they manage and pass through the downside risk to their investors.  Yet, it could be argued that the asset managers’ aggregate risk and that their investment processes and technology infrastructure pause systemic risk.  For example, over a trillion dollars of passive investments including the iShares brand are managed on Blackrock ’s technology platform Aladdin. It is not hard to foresee the dramatic impact of a major failure of Blackrock’s platform on the US and global economy.


3. Operational risks is not adequately represented


To manage market risk better, most investors are well aware of basic portfolio hygiene principles including the value of diversification, the importance of looking at volatility driven asset correlation, rebalancing, the criticality of subtracting leverage when assessing quality alpha, the value of protecting for inflation through IL bonds or inflation-hedging assets such as real estate. I would argue that operational risk is as big if not a bigger driver of financial loss as market risk. According to Phillipa Girling, a leading expert on operational risk and author: “operational risk in the headlines in the past few years” is hard to ignore: Notorious examples include “egregious fraud (Madoff, Stanford), breathtaking unauthorized trading (Société Générale and UBS), shameless insider trading (Raj Rajaratnam, Nomura, SAC Capital), stunning technological failings (Knight Capital, Nasdaq Facebook IPO, anonymous cyber‐attacks), and heartbreaking external events (hurricanes, tsunamis, earthquakes, terrorist attacks).” (Operational Risk Successful Framework).  Inadequately managed operational risk costs investors, corporations and tax payers billions of dollars:  Madoff’s  pyramid reportedly cost investors $18 billion and the 2008 government bailout cost taxpayers $700 billion. (New York Times Archives)


If the impact of operational risk is undoubtedly large, why do otherwise savvy investors often disaggregate or even completely miss operational risk from the overall expected value analytics of their portfolio and inadvertently accept more risk than they are comfortable with? Part of the problem stems from a lack of a well established methodology to clearly quantify operational risk and integrate it into portfolio management.


Imagine creating a unified industry-sponsored score for operational risk similar to a credit score or  Moody’s  bond ratings, which takes into consideration the fundamental elements of operational risks – people, process, technology, and external events, and quantifies them.  That score would then be clearly available for investors along with the returns and market risk of the portfolio leading to a far more accurate valuation. Significant progress toward accountability and transparency could be made if operational risk were to be demystified.


How can investors make safer investments?


What could investors do in an environment of confusing regulatory requirements and limited transparency around operational risk?  For starters, Investors can raise their awareness and employ alternatives to address the information asymmetry in the following ways:


1. Select asset managers that demonstrate commitment to operational risk management


Certainly some asset managers understand and are willing to invest in operational excellence and risk management.  For example, in the 2014 Review of the Asset Management Industry, the Boston Consulting Group provides an overview of the shadow model where an asset manager can use two counterparties to manage their middle and back office. At Bridgewater Associates, I co-led the implementation of such a model where the firm aimed to create greater transparency, switchability and stay ahead of the regulatory bodies by outsourcing its back and middle office to both BNY Mellon and Northern Trust. FundFire published an article, Bridgewater Divides Industry with Latest Deal, describing the benefits and open questions about the model. It is still early to say whether the industry will embrace this model more broadly. Similarly to gain an operational excellence edge, Citadel and Tudor  invested in a custom-built straight-through processing systems that integrate the trading platforms with the post-trade processes creating greater transparency and reliability. Both are aiming to commercialize their technologies and make these available to smaller money managers who may not be able to afford a large in-house technology development team.


More About the Article

October 07 2014


Dyman Associates Risk Management: The Basics of WHS Risk Management

Prior to the modernisation of industry, managers were understandably primarily concerned with performance and cost.

Workplace safety (WHS) unfortunately was often only considered when it affected any goals associated with performance and cost. With the passage of time and gradually increasing awareness of worker rights, employee health, safety and well-being has of course also gained additional attention.

There are various reasons for managing WHS risk. Typically they are summarised into one of four main groups:

- Ethical and moral: accident prevention is undertaken to prevent injury to personnel purely as the result of humane considerations.

- Legal: legislation places a number of duties on various persons and failure to carry out these duties can result in fines and, in extreme cases, imprisonment.

- Financial: the costs of an injury are made up by two parts the direct cost (cost associated with medical treatment, and damage) and the indirect cost (time spent on investigations, lost production retraining).

- General business considerations: these could be considered as financial, but given the difficulty in quantifying them, they are best kept separate. They generally relate to the organisation’s corporate image and reputation. Poor health and safety systems and outcomes affect many stake holders including employees, customers, insurance companies, as well as investors and financiers.

WHS risk management is concerned with providing a structured systematic approach to decision making with respect to WHS issues. The strength of applying a systematic risk management approach to WHS issues is that it combines technical, consultative and managerial approaches into processes that support informed, consistent and defensible decision-making.

The WHS Risk Management Process can be introduced at any time, but good practice dictates the process should be commenced at the earliest possible time. Whether designing a piece of plant or a whole facility, the risk management process of hazard identification, risk assessment, control, and review should be incorporated at the design / planning stage.

WHS Risk Management includes the process concerned with identifying, analysing and responding to WHS risk. The primary objective is to eliminate or minimise the consequences of adverse effects (injury, illness or property damage) on employees or the workplace. This consists of the following major steps also known as the Risk Management Process Model:

- Establish the context: establish the strategic, organisational and risk management context in which the rest of the process will follow.

- Identify risks: identify what, why and how thinks can arise that will be the basis for further analysis.

- Assess risks: determine the existing controls and analyses in terms of consequences and likelihood in the context of those controls. Typically, the analysis should take into account a number of potential consequences and how likely those consequences are to occur.

- Evaluate risks: compare the levels of risk against a pre-established criteria. This allows risks to be ranked so to identify management priorities.

- Treat risk: allow for the development of specific management plans to control the risk by way of elimination or minimisation strategies.

- Monitoring and review.

- Communication and Consultation.

By implementing systematic WHS Risk Management activities, organisations are able to better understand operations and their associated hazards as well as afford greater flexibility with regard to the methods used to control risks and the costs of implementing those controls.

With the increased ability to respond effectively to organisational changes, both internal and external to the organisation, WHS risk management may lead to a myriad of direct benefits including:

- Reducing injury and illness to employees and the community

- Saving money and adding value by more effective allocation of resources

- Improving the quality of information available for making decisions

- Improving the understanding of WHS risks throughout the organization

- Complying with WHS legislation and the ability to better to demonstrate this

- Improving the organization’s image and reputation

- Improving accountability and transparency of decision-making

Possible broader and longer term benefits of an effective OHS risk management program are:

- Effective strategic planning as a result of increased knowledge and understanding of key risk exposures

- Lower workers’ compensation costs because undesirable OHS outcomes are foreseen and addressed

- Improved audit processes

- Better outcomes in terms of the effectiveness, efficiency, and appropriateness of OHS programs, i.e. programs targeting key risk areas

- Improved communication, both within the organization and between the organization and its external stakeholders

WHS Risk Management is a foundation of an organisation and it touches all facets of an organisation’s activities. For this reason, careful planning is required in the development and implantation of a WHS Risk Management program.

Successful WHS risk management requires a sensible and straight forward approach. The purpose of implementation should not only be seen as a compliance requirement but also as a key business tool in adding value to the organisation objectives.

WHS Risk Management should include regular reviews of all WHS aspects of an organisation’s activities. The effectiveness of the WHS Risk Management Process should be monitored and documented in order to ensure that the risk management strategies continue to be relevant to the organisation’s activities that affect WHS.

October 04 2014


Dyman Associates Risk Management Review on the Best Password Managers for PCs, Macs, and Mobile Devices

6 local and cloud-based password managers make passwords stronger and online life easier for Windows, Mac, iOS, Android, BlackBerry, and Windows Phone users.

Thanks to high-profile computer security scares such as the Heartbleed vulnerability and the Target data breach, and to the allegations leveled at the government and cloud providers by Edward Snowden, more of us Internet users are wising up about the security of our information. One of the smarter moves we can make to protect ourselves is to use a password manager. It's one of the easiest too.

A password manager won't shield you against Heartbleed or the NSA, but it's an excellent first step in securing your identity, helping you increase the strength of the passwords that protect your online accounts because it will remember those passwords for you. A password manager will even randomly generate strong passwords, without requiring you to memorize or write down these random strings of characters. These strong passwords help shield against traditional password attacks such as dictionary, rainbow tables, or brute-force attacks.

Many password managers allow you to automatically populate your password vault by capturing your Web log-ins using a browser plug-in and allowing you to store these credentials. Other options for populating your password database include importing an Excel spreadsheet or manually entering your log-in information. Further, using these stored credentials is typically automated using a browser plug-in, which recognizes the website's username and password fields, then populates these fields with the appropriate log-in information.

Although several browsers offer similar functionality out of the box, many password managers offer several benefits over the built-in browser functionality -- including encryption, cross-platform and cross-browser synchronization, mobile device support, secure sharing of credentials, and support for multifactor authentication. In some cases, usernames and passwords must be copied from the password manager into the browser, reducing the ease-of-use but increasing the level of security by requiring entry of the master password before accessing stored log-in information.

Some password managers store your credentials locally, others rely on cloud services for storage and synchronization, and still others take a hybrid approach. Some of the options using local storage (such as KeePass and 1Password) still support synchronization through Dropbox or other storage services. Deciding which password manager is best for you will come down to features and ease-of-use, as well as to whether you're comfortable storing your passwords on the Internet.

October 02 2014


Dyman Associates Risk Management: Fundamentals of cloud security

For many companies, security is still the greatest barrier to implementing cloud initiatives. But it doesn't have to be.

Organisational pressure to reduce costs and optimise operations has led many enterprises to investigate cloud computing as a viable alternative to create dynamic, rapidly provisioned resources powering application and storage platforms. Despite potential savings in infrastructure costs and improved business flexibility, security is still the greatest barrier to implementing cloud initiatives for many companies. Information security professionals need to review a staggering array of security considerations when evaluating the risks of cloud computing.

With such a broad scope, how can an organisation adequately assess all relevant risks to ensure that their cloud operations are secure? While traditional security challenges such as loss of data, physical damage to infrastructure, and compliance risk are well known, the manifestation of such threats in a cloud environment can be remarkably different. New technologies, combined with the blurring of boundaries between software-defined and hardware infrastructure in the datacentre, require a different approach.

One of the first steps towards securing enterprise cloud is to review and update existing IT polices to clearly define guidelines to which all cloud-based operations must adhere. Such policies implement formal controls designed to protect data, infrastructure, and clients from attack, and enable regulatory compliance. Government bodies such as NIST, the US Department of Commerce, and the Australian Government Department of Finance and Deregulation (PDF) have produced cloud computing security documents that outline comprehensive policies for their departments, which can be a useful starting point for implementing a corporate policy.

It is important to recognise that cloud security policies should provide protection regardless of delivery model. Whether building private, public, or hybrid cloud environments within the enterprise, cloud security is the joint responsibility of your organisation and any cloud service providers you engage with. When conducting due diligence on third-party cloud service providers, carefully review the published security policies of the vendor and ensure that they align with your own corporate policies.

A fundamental security concept employed in many cloud installations is known as the defence-in-depth strategy. This involves using layers of security technologies and business practices to protect data and infrastructure against threats in multiple ways. In the event of a security failure at one level, this approach provides a certain level of redundancy and containment to create a durable security net or grid. Security is more effective when layered at each level of the cloud stack.

When implementing a cloud defence-in-depth strategy, there are several security layers that may be considered. The first and most widely known protection mechanism is data encryption. With appropriate encryption mechanisms, data stored in the cloud can be protected even if access is gained by malicious or unauthorised personnel. A second layer of defence is context-based access control, a type of security policy that filters access to cloud data or resources based on a combination of identity, location, and time. Yet another popular security layer in cloud-based systems is application auditing. This process logs all user activity within an enterprise application and helps information security personnel detect unusual patterns of activity that might indicate a security breach. Finally, it is critical to ensure that all appropriate security policies are enforced as data is transferred between applications or across systems within a cloud environment.

Unfortunately, there is no one-size-fits-all solution for cloud security that can protect all of your IT assets. Nor is it wise to adopt a closed-perimeter approach. Organisations can no longer rely on firewalls as a single point of control, and security practices must expand beyond the datacentre to include key control points for endpoints accessing the cloud and edge systems. When incorporating third-party public and hybrid cloud solutions in your enterprise IT strategy, you cannot assume that the security policies of these service providers meet the standards and levels of compliance required. Make sure you spell out and can verify what you require and what is delivered. Read More

October 01 2014


Dyman Associates Risk Management: 10 lessons learned from major retailers' cyber breaches

There has been extensive adverse publicity surrounding what has become the largest data breach in the retail industry, affecting Target and two other U.S. retailers. In November-December 2013, cyber thieves executed a well-planned intrusion into Target’s computer network and the point-of-sale terminals at its 1,800 stores around the holiday season and successfully obtained not only 40 million customers’ credit and debit card information, but also non-card customer personal data for as many as 70 million customers. In addition, 1.1 million payment cards from Neiman Marcus and 3 million cards used at Michaels were reportedly exposed.

The respected Ponemon Institute announced this June it believes that hackers have exposed the personal information of 110 million Americans—roughly half of the nation’s adults—in the last 12 months alone, and this number reflects the impact of major retailer breaches and others in different governmental or business sectors, but does not include hacks revealed in July-August 2014.

As we speak, there are news reports about the discovery of large quantities of personal information (including user names and passwords) mined from many websites by a Russian-based hacker group and new malware threats focused at retailers. According to a report released by the U.S. Department of Homeland Security, technology that is widely used to allow employees to work from home or permit IT and administrative personnel to remotely maintain systems is being exploited by hackers to deploy point-of-sale (PoS) malware that is designed to steal credit card data. This threat is being called “Backoff Malware”.

Homeland Security estimates it has been around since October 2013 with a very low antivirus detection rate at the time it was discovered, meaning that even systems with fully updated and patched antivirus software would not be able to identify Backoff as malicious malware.

Snapshot of Target

Target announced at the end of February 2014 that the company’s profit fell by 40% in the fourth quarter of 2013. The company reported $61 million pretax expenses related to the breach, but expected $44 million in cyber insurance payments against this figure. These expenses were incurred for legal costs, breach notification, forensics, and PR/crisis management to date. However, the worst financial costs are yet to come. A senior Gartner analyst estimated that the total exposure to Target could be $450–$500M, which considers lawsuits, regulatory investigations, breach response, fines and assessments, loss of revenue and security upgrades.

Both the cyber insurance and directors & officers insurance programs at Target are involved, since Target announced significant revenue/profit shortfalls caused by brand damage/customer fallout and costs to improve IT security. At least two derivative shareholder actions have been filed, which have triggered Target’s D&O insurance.

More than 100 lawsuits are pending against Target at this time, with many consumer class actions and some actions filed by individual financial institutions, claiming for costs of cancelling and reissuing compromised cards, absorbing fraudulent charges made on the cards, and the loss of anticipated fee income from the holiday season. There has been activity to consolidate these lawsuits into three groups of plaintiffs to facilitate the legal process.

Allegations surround Target giving network access to a third-party vendor, a small HVAC company with weak security, which allowed the attackers to gain a foothold on Target’s network. From that point of entry, the attackers allegedly moved to the most sensitive areas of Target’s network storing customer information. Malware installed at POS terminals utilized so-called “RAM scraping,” and the attack apparently proceeded despite apparent warning signals.

Target staff had urged the company to review the security of its payment system months prior to the breach, according to American Banker and Wall Street Journal reports. Some financial institution plaintiffs are alleging that as early as 2007, Target was warned by a data security expert about the possibility of a data breach in its point-of-sale system. Banks claim that a layered security system would have made the hackers’ task more challenging—Brian Krebs, a noted security analyst, describes a “POS kill chain” for more effective layered security posture.

September 30 2014


Dyman Associates Risk Management : So You Think You Have a Point of Sale Terminal Problem?

If your company has a Point of Sale (POS) terminal anywhere in its infrastructure, you are no doubt aware from the active media coverage that malware attacks have been plaguing POS systems across the country.

Just within the past week, the New York Times has reported that:

- Companies are often slow to disclose breaches, often because of the time involved in immediately-required investigations;

- Congress is beginning to make inquiries of data breach victim companies; and

- Even those companies who have conducted cybersecurity risk assessments still get attacked, often during the course of implementing new solutions to mitigate potential problems and protect their customers’ payment cards or other personal information.

- Former employees can be a source of information to the media about your efforts to investigate and secure your POS systems.

No Quick Fix

Even the best intentions, most competent efforts and unlimited budgets cannot fix a problem such as this overnight.  These fixes take time, and have become an unavoidable symptom of having POS terminals.

What should your company do?

(1) Launch a cybersecurity risk assessment, if you have not yet done so.

(2) Protect your risk calculations by engaging outside counsel and qualified cybersecurity experts to provide legal risk advice protected by the attorney-client privilege.  Keep C-suite executives and Boards of Directors informed.  The outside counsel, together with experts, should:

- educate and advise directors and executives on legal and business risks associated with your company’s particular threats and vulnerabilities;

- engage a qualified, experienced external cybersecurity team to review technical infrastructure and identify vulnerabilities stratified and prioritized by risk, likelihood of being exploited, and costs and time involved in remedying each one;

- review  operational procedures across a multi-disciplinary team in your company, which are often overlooked and can have the greatest impact on the overall health of your risk profile;

- help identify the most sensitive categories of information in your organization and develop data governance procedures tailored to your organization to add yet another layer of protection for your most sensitive assets;

- regularly remind your team members, including from your third-party vendors engaged by counsel, about privilege and confidentiality obligations.

(3) Treat cybersecurity risk assessments and remediation efforts as an iterative process.  Constantly review your multi-disciplinary team’s recommendations as they change week by week or day by day.  Re-evaluate the spend allocated based on updated information about your risk landscape as the investigation and assessment progresses.

(4) Stay informed about updated regulatory requirements and case law on cybersecurity and privacy.  Ensure stakeholders understand these updates and charge them with implementing appropriate changes in their domains.

(5) Recognize that there is no such thing as perfect security, but that there is a tipping point over which your company will move outside the category of high-risk operations and into a safe zone.

(6) Allocate the necessary resources to get the job done – and done well.  If your company goes an extra mile in building security policies, procedures and technology that are better than industry standard, you can use your low risk profile as a market differentiator.  In addition to reducing litigation and reputational risks, validated strong security will increase customer confidence and loyalty.

(7) Review your insurance policies for adequate coverage to address interim risks.  While reputational risk cannot be insured against, insurance can be very valuable in the event of a breach.

In the retail industry in particular, the widespread compromises in Point of Sale Terminals resulting in staggering amounts of payment card theft is a hallmark of 2014.   A decrease in brand reputation alone is too high a cost to ignore.   If your company is – very understandably – not equipped to tackle the daunting task of finding and prioritizing vulnerabilities and choosing the best cybersecurity governance and technical plans, find someone who is.


September 29 2014


Dyman Associates Risk Management: eBay In Security Storm With Dangerous Flaw Wide Open

Auction site eBay has found itself in the midst of another security storm after apparently choosing to leave a security hole wide open – in the interests of user functionality – as customer details were being stolen. 

It is the latest in a trio of serious cybersecurity problems at the company this year, following a database breach in May, and the theft of details from its StubHub ticket site customers two months later. 

eBay allows highly visual JavaScript and Flash content to be included in its listings, which is a somewhat unsurprising step – however, the company reportedly knew for months that a number of hackers were manipulating this code for malicious content, and left the ability to add the code largely as it is, in the interests of offering sellers attractive auction listings. 

Cyber criminals have been using the technology to introduce cross-site scripting (XSS) – in which customers are led to a fake, eBay-mimicking site to enter their payment details. At least 100 exploited listings have been identified by the BBC, which reports that the problems continue even though eBay may have been aware of them since February. 

‘Not An Okay Situation’ 

Security experts have lambasted eBay’s handling of the problems. Chris Oakley, principal security consultant at testing firm Nettitude, says he would expect “all organizations, particularly those with vast quantities of customer data to protect” to have the required, standard cross site scripting defenses in place. 

“This hat-trick of security incidents will surely do the company no favors in terms of restoring and maintaining consumer confidence,” adds Paul Ayers, European VP at data security vendor Vormetric, and Mikko Hypponen, chief research officer at security firm F-Secure, describes the situation as “not okay”. Independent expert Graham Cluley told The Drum website that eBay was not in “proper control” of the situation, which he described as “embarrassing”. 

Solving The XSS Problem 

Experts have proposed a number of solutions for eBay, including simply removing the harmful code or listings, or providing its own Javascript editor in which sellers’ code can be more easily managed and controlled. 

Dr Adrian Davis, EMEA managing director at security organization (ISC)2, tellsForbes that XSS is a well known threat, adding that “we can’t afford to tolerate relatively simple security issues like this, especially for a company as massive as eBay”. 

Sites with the issue “need to update their current code to remove the vulnerability”, he says. “Functionality for the user would not be impaired, providing the code running in the browser and application is written properly.” 

He warns that developers need to be much better trained to write secure code and not focus solely on usability, with “fully qualified and certified individuals, such as those holding (ISC)2’s CISSP or CSSLP” qualifications being involved “throughout the entire process”. 

“This is an issue that must rise above the purely technical considerations and go onto the agendas of management and business leaders that are driving the development projects. Only then would we see investment in curbing incidents like these.” 

Act Much More Quickly 

Randy Gross, chief information officer at industry association CompTIA, says that it is “always difficult” for organizations to strike the right balance between security and convenience. But he adds: “With financial transactions, especially given recent high profile attacks, the pendulum needs to swing hard back toward security and give consumers the confidence their information is secure.” 

Fayaz Khaki, an associate director of information security at IDC, adds in aForbes email interview that it is always difficult for large and complex sites, such as eBay, to be completely XSS free. “However, once an XSS vulnerability has been identified the organization must act quickly to remove the vulnerability”, even if it means removing a listing. 

Active content such as Javascript, he says, should only be used where completely necessary, and regular monitoring and vulnerability assessments ought to be carried out to minimize risk. 

“XSS vulnerabilities have existed for a number of years and really companies such as eBay, that came into existence solely as an internet organization, should be on top of these types of vulnerabilities and should have the capability to identify and mitigate these vulnerabilities very quickly.” 

eBay said in a statement that cross site scripting risks exist across the internet, and that it has “hundreds” of engineers and security experts who collaborate with researchers to make its own site both usable and safe. 

It added: “We have no current plans to remove active content from eBay. However, we will continue to review all site features and content in the context of the benefit they bring our customers, as well as overall site security.” 

Criminals behind cross site scripting and phishing activity adapt their code and tactics “to try to stay ahead of the most sophisticated security systems”, it said. “Cross site scripting is not allowed on eBay and we have a range of security features designed to detect and then remove listings containing malicious code.”

September 27 2014


Dyman Associates Risk Management Study: Mobile Health Apps Need Risk Assessment, Framework

Mobile health applications need a risk assessment model and a framework for supporting clinical use to ensure patient safety and professional reputation, according to a study published in the Journal of Medical Internet Research,  FierceHealthIT reports.

Study Details

For the study, researchers at Warwick Medical School in the United Kingdom analyzed the current regulatory oversight of mobile apps and identified several different kinds of risks associated with medical apps and ways to address those risks (Mottl, FierceHealthIT, 9/20).

The researchers defined a mobile medical app as "any software application created for or used on a mobile device for medical or other health-related purposes."

Study Findings

The researchers noted that there is not currently a clinically relevant risk assessment framework for mobile health apps, meaning health care professionals, patients and mobile app developers face difficulty in assessing the risks posed by specific apps.

They identified several risks associated with using mobile health apps, including:

  • Hindering professional reputation;
  • Causing possible patient privacy breaches;
  • Resulting in low-quality; and
  • Providing Poor medical advice.

The authors also outlined some of the most common variables that can affect those risk factors, including:

  • Apps that contain inaccurate or out-of-date information;
  • Inappropriate use by patients; and
  • Inadequate user education (Lewis et al., Journal of Medical Internet Research, 9/15/14).

Of those, the researchers warned that a lack of education poses the biggest threat to patient safety and recommended that health care professionals begin learning about the apps' risks before prescribing their use to patients.

Overall, the study's authors called for a formal risk assessment framework for mobile health apps to help reduce the "residual risk" by identifying and implementing various safety measures in the future development, procurement and regulation of mobile apps. They argued that medical apps will flourish in the health care industry after a process has been created to ensure their quality and safety can be "reliably assessed and managed" (FierceHealthIT, 9/20).


September 25 2014


Dyman Associates Risk Management: A Mobility Checkup

I recently attended the Healthcare Innovation Challenge where I met some customers and took a look at various healthcare IT challenges and innovations. I came away with a couple of strong impressions about the role of mobility in healthcare, in addition to some best practices for healthcare companies to follow.

First, it was exciting to see how integrated mobility is with the core mission of many of the companies, and how important it has become for healthcare workers to be untethered from a PC or workstation. For example, a medical scanning and data collection company can now run its scanners from a remote location using tablets, which has increased safety by enabling technicians to review data in real-time without being in the same room as the diagnostic equipment. Tablets have also increased efficiency and productivity by enabling fewer technicians to monitor multiple scanners, and the touch user interface—swiping and pinching to analyze the scans, for example—is far preferable to traditional mouse clicks.

Another company provides brain exercises—in the form of role-playing games—for patients who have experienced brain trauma. The games are played exclusively on tablets, offering more flexibility for patients and providing a familiar, effective and fun user interface that encourages usage.

Many companies at the event made it clear that they still face major challenges to mobility. HIPAA and other privacy regulations require every mobile strategy involving patient data to meet stringent requirements. Is patient data stored on a device? How is it secured? Can non-authorized users access private information? Can the compliance of the device be validated?

In developing a security strategy for their mobile devices, healthcare companies struggle with choosing among various options, including a secure workspace and virtualization. Virtualization stores no information on the device, while a secure workspace stores data on the device in a protected container, which IT can wipe (though not a user’s personal information) if necessary. Fortunately, organizations aren’t limited to one path—many use both solutions for users with different risk profiles.

Another difficulty for many healthcare providers is that tech-savvy workers, especially doctors and nurses, are driving the demand for mobility, putting significant pressure on IT to move more rapidly than they otherwise would

So how can healthcare companies overcome these challenges? Consider these simple best practices:

Map out all your different use cases—including what users want—and study the available technologies. Then choose the mix of solutions that satisfies your needs.

Don’t consider just today’s use cases. Anticipate future innovations. For example, some devices already have built­-in heart-rate monitors. Other biometric capabilities coming to devices include identifying fingerprints, faces, voices and irises. To keep progressing on your mobility journey, track the technologies in development and plan for how to integrate them into your workflows.

Don’t fall into the trap of feeling that you can’t deal with the explosion of new capabilities. By focusing on users and workflows, you can look at every new capability as an opportunity to improve productivity, drive down costs and improve the ways healthcare is delivered.

Read more related Dyman Associates Risk Management

August 09 2014


Dyman Associates Risk Management: what is Risk Management

The Importance of Risk Management to Business Success

Risk management is an important part of planning for businesses. The process of risk management is designed to reduce or eliminate the risk of certain kinds of events happening or having an impact on the business.

Definition of Risk Management

Risk management is a process for identifying, assessing, and prioritizing risks of different kinds. Once the risks are identified, the risk manager will create a plan to minimize or eliminate the impact of negative events. A variety of strategies is available, depending on the type of risk and the type of business. There are a number of risk management standards, including those developed by the Project Management Institute, the International Organization for Standardization (ISO), the National Institute of Science and Technology, and actuarial societies.

Types of Risk

There are many different types of risk that risk management plans can mitigate. Common risks include things like accidents in the workplace or fires, tornadoes, earthquakes, and other natural disasters. It can also include legal risks like fraud, theft, and sexual harassment lawsuits. Risks can also relate to business practices, uncertainty in financial markets, failures in projects, credit risks, or the security and storage of data and records.

Goals of Risk Management

The idea behind using risk management practices is to protect businesses from being vulnerable. Many business risk management plans may focus on keeping the company viable and reducing financial risks. However, risk management is also designed to protect the employees, customers, and general public from negative events like fires or acts of terrorism that may affect them. Risk management practices are also about preserving the physical facilities, data, records, and physical assets a company owns or uses.

Process for Identifying and Managing Risk

While a variety of different strategies can mitigate or eliminate risk, the process for identifying and managing the risk is fairly standard and consists of five basic steps. First, threats or risks are identified. Second, the vulnerability of key assets like information to the identified threats is assessed. Next, the risk manager must determine the expected consequences of specific threats to assets. The last two steps in the process are to figure out ways to reduce risks and then prioritize the risk management procedures based on their importance.

Strategies for Managing Risk

There are as many different types of strategies for managing risk as there are types of risks. These break down into four main categories. Risk can be managed by accepting the consequences of a risk and budgeting for it. Another strategy is to transfer the risk to another party by insuring against a particular, like fire or a slip-and-fall accident. Closing down a particular high-risk area of a business can avoid risk. Finally, the manager can reduce the risk's negative effects, for instance, by installing sprinklers for fires or instituting a back-up plan for data.

Having a risk management plan is an important part of maintaining a successful and responsible company. Every company should have one. It will help to protect people as well as physical and financial assets.


August 07 2014


Dyman Associates Risk Management Approach and Plan

Dyman Associates Risk Management – As a management process, risk management is used to identify and avoid the potential cost, schedule, and performance/technical risks to a system, take a proactive and structured approach to manage negative outcomes, respond to them if they occur, and identify potential opportunities that may be hidden in the situation [4]. The risk management approach and plan operationalize these management goals.

Because no two projects are exactly alike, the risk management approach and plan should be tailored to the scope and complexity of individual projects. Other considerations include the roles, responsibilities, and size of the project team, the risk management processes required or recommended by the government organization, and the risk management tools available to the project.

Risk occurs across the spectrum of government and its various enterprises, systems-of-systems, and individual systems. At the system level, the risk focus typically centers on development. Risk exists in operations, requirements, design, development, integration, testing, training, fielding, etc. (see the SE Life-Cycle Building Blocks section of this Guide). For systems-of-systems, the dependency risks rise to the top. Working consistency across the system-of-systems, synchronizing capability development and fielding, considering whether to interface, interoperate, or integrate, and the risks associated with these paths all come to the forefront in the system-of-systems environment. At the enterprise level, governance and complexity risks become more prominent. Governance risk of different guidance across the enterprise for the benefit of the enterprise will trickle down into the system-of-systems and individual systems, resulting in potentially unanticipated demands and perhaps suboptimal solutions at the low level that may be beneficial at the enterprise level. Dealing with the unknowns increases and the risks associated with these——techniques in the Guide's section on Enterprise Engineering, such as loose couplings, federated architectures, and portfolio management——can help the MITRE SE alleviate these risks.

Risk Management in System-Level Programs

System-level risk management is predominantly the responsibility of the team working to provide capabilities for a particular development effort. Within a system-level risk area, the primary responsibility falls to the system program manager and SE for working risk management, and the developers and integrators for helping identify and create approaches to reduce risk. In addition, a key responsibility is with the user community's decision maker onwhen to accept residual risk after it and its consequences have been identified. The articles in the Risk Management topic area provide guidance for identifying risk (Risk Identification), mitigating risks at the system level with options like control, transfer, and watch (Risk Mitigation Planning, Implementation, and Progress Monitoring), and a program risk assessment scale and matrix (Risk Impact Assessment and Prioritization). These guidelines, together with MITRE SEs using tools such as those identified in the Risk Management Tools article, will help the program team deal with risk management and provide realism to the development and implementation of capabilities for the users.

Risk Management in System-of-Systems Programs

Today, the body of literature on engineering risk management is largely aimed at addressing traditional engineering system projects—those systems designed and engineered against a set of well-defined user requirements, specifications, and technical standards. In contrast, little exists on how risk management principles apply to a system whose functionality and performance is governed by the interaction of a set of highly interconnected, yet independent, cooperating systems. Such systems may be referred to as systems-of-systems.

A system-of-systems can be thought of as a set or arrangement of systems that are related or interconnected to provide a given capability that, otherwise, would not be possible. The loss of any part of the supporting systems degrades or, in some cases, eliminates the performance or capabilities of the whole.


What makes risk management in the engineering of systems-of-systems more challenging than managing risk in a traditional system engineering project? The basic risk management process steps are the same. The challenge comes from implementing and managing the process steps across a large-scale, complex, system-of-systems—one whose subordinate systems, managers, and stakeholders may be geographically dispersed, organizationally distributed, and may not have fully intersecting user needs.

How does the delivery of capability over time affect how risks are managed in a system-of-systems? The difficulty is in aligning or mapping identified risks to capabilities planned to be delivered within a specified build by a specified time. Here, it is critically important that risk impact assessments are made as a function of which capabilities are affected, when these effects occur, and their impacts on users and stakeholders.

Lack of clearly defined system boundaries, management lines of responsibility, and accountability further challenge the management of risk in the engineering of systems-of-systems. User and stakeholder acceptance of risk management, and their participation in the process, is essential for success.

Given the above, a program needs to establish an environment where the reporting of risks and their potential consequences is encouraged and rewarded. Without this, there will be an incomplete picture of risk. Risks that threaten the successful engineering of a system-of-systems may become evident only when it is too late to effectively manage or mitigate them.

Frequently a system-of-systems is planned and engineered to deliver capabilities through a series of evolutionary builds. Risks can originate from different sources and threaten the system-of-systems at different times during their evolution. These risks and their sources should be mapped to the capabilities they potentially affect, according to their planned delivery date. Assessments should be made of each risk's potential impacts to planned capabilities, and whether they have collateral effects on dependent capabilities or technologies.

In most cases, the overall system-of-systems risk is not just a linear "roll-up" of its subordinate system-level risks. Rather, it is a combination of specific lower level individual system risks that, when put together, have the potential to adversely impact the system-of-systems in ways that do not equate to a simple roll-up of the system-level risks. The result is that some risks will be important to the individual systems and be managed at that level, while others will warrant the attention of system-of-systems engineering and management.

Read full Article


August 06 2014


Dyman Associates Risk Management on How to Develop a Risk Management Plan

Developing an effective Risk Management Plan can help keep small issues from developing into emergencies. Different types of Risk Management Plans can deal with calculating the probability of an event, and how that event might impact you, what the risks are with certain ventures and how to mitigate the problems associated with those risks. Having a plan may help you deal with adverse situations when they arise and, hopefully, head them off before they arise.


1. Understand how Risk Management works. Risk is the effect (positive or negative) of an event or series of events that take place in one or several locations. It is computed from the probability of the event becoming an issue and the impact it would have (See Risk = Probability X Impact). Various factors should be identified in order to analyze risk, including:

Event: What could happen?

Probability: How likely is it to happen?

Impact: How bad will it be if it happens?

Mitigation: How can you reduce the Probability (and by how much)?

Contingency: How can you reduce the Impact (and by how much)?

Reduction = Mitigation X Contingency

Exposure = Risk – Reduction

2. Define your project. In this article, let's pretend you are responsible for a computer system that provides important (but not life-critical) information to some large population. The main computer on which this system resides is old and needs to be replaced. Your task is to develop a Risk Management Plan for the migration

3. Get input from others. Brainstorm on risks. Get several people together that are familiar with the project and ask for input on what could happen, how to help prevent it, and what to do if it does happen. Take a lot of notes! You will use the output of this very important session several times during the following steps. Try to keep an open mind about ideas.

4. Identify the consequences of each risk. From your brainstorming session, you gathered information about what would happen if risks materialized. Associate each risk with the consequences arrived at during that session. Be as specific as possible with each one. "Project Delay" is not as desirable as "Project will be delayed by 13 days."

5. Eliminate irrelevant issues. If you’re moving, for example, a car dealership’s computer system, then threats such as nuclear war, plague pandemic or killer asteroids are pretty much things that will disrupt the project. There’s nothing you can do to plan for them or to lessen the impact.

6. List all identified risk elements. You don’t need to put them in any order just yet. Just list them one-by-one.

7. Assign probability. For each risk element on your list, determine if the likelihood of it actually materializing is High, Medium or Low. If you absolutely have to use numbers, then figure Probability on a scale from 0.00 to 1.00. 0.01 to 0.33 = Low, 0.34 to 0.66 = Medium, 0.67 to 1.00 = High.

8. Assign impact. In general, assign Impact as High, Medium or Low based on some pre-established guidelines. If you absolutely have to use numbers, then figure Impact on a scale from 0.00 to 1.00 as follows: 0.01 to 0.33 = Low, 0.34 – 066 = Medium, 0.67 – 1.00 = High.

9. Determine risk for the element. Often, a table is used for this. If you have used the Low, Medium and High values for Probability and Impact, the top table is most useful. If you have used numeric values, you will need to consider a bit more complex rating system similar to the second table here. It is important to note that there is no universal formula for combining Probability and Impact; that will vary between people and projects.

10. Rank the risks. List all the elements you have identified from the highest risk to the lowest risk.

11. Compute the total risk: Here is where numbers will help you. In Table 6, you have 7 risks assigned as H, H, M, M, M, L, and L. This can translate to 0.8, 0.8, 0.5, 0.5, 0.5, 0.2 and 0.2, from Table 5. The average of the total risk is then 0.5 and this translates to Medium.

12. Develop mitigation strategies. Mitigation is designed to reduce the probability that a risk will materialize. Normally you will only do this for High and Medium elements. You might want to mitigate low risk items, but certainly address the other ones first. For example, if one of your risk elements is that there could be a delay in delivery of critical parts, you might mitigate the risk by ordering early in the project

13. Develop contingency plans. Contingency is designed to reduce the impact if a risk does materialize. Again, you will usually only develop contingencies for High and Medium elements.

14. Analyze the effectiveness of strategies. How much have you reduced the Probability and Impact?

15. Compute your effective risk. Now your 7 risks are M, M, M, L, L, L and L, which translate to 0.5, 0.5, 0.5, 0.2, 0.2, 0.2 and 0.2. This gives an average risk of 0.329.

16. Monitor your risks. Now that you know what your risks are, you need to determine how you’ll know if they materialize so you’ll know when and if you should put your contingencies in place. This is done by identifying Risk Cues. Do this for each one of your High and Medium risk elements. 

June 08 2014


Dyman & Associates Risk Management Projects: 75% of mobile security breaches will result from misuse

With use of smartphones and tablets on the rise and sales of traditional PCs on the decline, attacks on mobile devices are maturing, says IT research and advisory firm Gartner Inc.

By 2017, the focus of endpoint breaches will shift to tablets and smartphones. And, according to Gartner, 75 percent of mobile security breaches will be the result of mobile application misconfiguration and misuse.

Common examples of misuse are “jailbreaking” on iOS devices and “rooting” on Android devices. These procedures allow users to access certain device resources that are normally unavailable — and remove app-specific protections and the safe "sandbox" provided by the operating system, putting data at risk.

Jailbreaking and rooting can also allow malware to be downloaded to the device, enabling malicious exploits that include extraction of enterprise data. These mobile devices also become prone to brute force attacks on passcodes.

According to Dionisio Zumerle, principal research analyst at Gartner, a classic example of misconfiguration is improper use of personal cloud services through apps residing on smartphones and tablets. “When used to convey enterprise data, these apps lead to data leaks that the organization remains unaware of for the majority of devices," he said.

The best defense for an enterprise is to keep mobile devices fixed in a safe configuration by means of a mobile device management policy, supplemented by app shielding and "containers" that protect important data.

Gartner recommends that IT security leaders follow an MDM/enterprise mobility management baseline for Android and Apple devices as follows: ask users to opt in to basic enterprise policies, and be prepared to revoke access controls in the event of changes.

Users who are not able to bring their devices into basic compliance must be denied (or given extremely limited) access; require that device passcodes include length and complexity as well as strict retry and timeout standards; specify minimum and maximum versions of platforms and operating systems. Disallow models that cannot be updated or supported; enforce a "no jailbreaking/no rooting" rule, and restrict the use of unapproved third-party app stores.

Devices in violation should be disconnected from sources of business data, and potentially wiped, depending on policy choices; and require signed apps and certificates for access to business email, virtual private networks, Wi-Fi and shielded apps.

IT security leaders also need to use network access control methods to deny enterprise connections for devices that exhibit potentially suspicious activity.

"We also recommend that they favor mobile app reputation services and establish external malware control on content before it is delivered to the mobile device," said Zumerle.

Mobile security trends will be discussed at the Gartner IT Infrastructure & Operations Management Summit 2014, June 9–11 in Orlando, Fla.

June 07 2014


Dyman & Associates Risk Management Projects on How to Prioritize the Alerts - Malware

In late May, online security firm Trusteer, an IBM company, raised alarms about a new online banking Trojan it calls Zberp. According to Trusteer, more than 450 global banking institutions in the U.S., the United Kingdom and Australia have been targeted by this malware strain, which combines features from Zeus and Carberp, two well-documented banking Trojans.

Just days earlier, global cyber-intelligence firm IntelCrawler warned of new point-of-sale malware known as Nemanja, which had reportedly infected retailers in nearly 40 countries.

And news about recent evolutions in the mobile malware strain known as Svpeng also has caused concern. In May, Svpeng was found to have evolved from merely a banking Trojan to a malware strain equipped with a dual ransomware feature (see New Ransomware Targets Mobile).

But with so many alerts about new and emerging malware strains and attacks, how should banking institutions respond? It's a growing challenge for information and security risk officers because one of the keys to mitigating cyber-risks is differentiating new threats from older ones.

What's Real?

While banking institutions have to take all emerging threats seriously, they should take most alerts issued by security vendors in stride, says financial fraud expert Tom Wills, director of Ontrack Advisory, a consulting firm focused on payments innovations.

"It's mostly hype," he says. "Every time a new threat shows up in the media, this is the first filter I run. More often than not, there's a vendor or two behind all the excitement."

The influx of warnings from security firms about new malware strains has bred unnecessary concern for some banking institutions, says Andreas Baumhof, chief technology officer at malware research firm ThreatMetrix. In most cases, existing detection systems will raise flags, even when new variants of malware are detected on a network or believed to have infected an end-user's device, he says.

Pointing to the most recent announcement about Zberp, Baumhof says banks and credit unions should not rush out to invest in new detection and defensive technologies.

"There is nothing new for this Trojan," he says. Most banks' and credit unions' existing online defenses are equipped to detect Zberp and other Zeus variants, he contends.

Advice for Banking Institutions

Analysts recommend banking institutions maintain ongoing dialogues with their core service providers and vendors about the latest threats, and ensure they adequately vet new providers and vendors before signing on for service.

Among their other top recommendations:

Understand how existing detection and threat-mitigation solutions are equipped to defend the network. "There is no 100 percent solution, but banks need to understand their exposure and current capabilities before they rush to react," to alerts about new attacks, says Al Pascual, who heads up the fraud and security practice for consultancy Javelin Strategy & Research.

Put the onus on service providers and security vendors to send out notifications of possible risks, says Shirley Inscoe, a financial fraud expert and analyst for consultancy Aite.

Always get second and third opinions before revamping a system or solution. "Always get multiple bids, research the suppliers with independent parties, such as industry analysts and vendor-neutral consultants, and check with peers," Ontrack's Wills says.

Ensure the IT and security teams have strategies in place for comprehensive risk assessments. "Refresh it [the risk assessment] at least once or twice a year to keep it current - the more often, the better," Wills says. "That way, you can make sure that any solution you buy makes sense in the context of your own company's unique threat and vulnerability landscape, and not some generic landscape. It's quite easy to buy security products that you don't really need."

June 06 2014


Dyman & Associates Risk Management Projects on Threat intelligence versus risk

Security officers who view threat intelligence and risk management as the cornerstone of their security programs may have advantages over peers who face constraints when it comes to taking advantage of the available data.

CISOs are generally tasked with evaluating security controls and assessing their adequacy relative to potential threats to the organization, and its business objectives. Their role in cybersecurity risk management -- the conscious decisions about what the organization is going to do and what it is not going to do to protect assets beyond compliance -- is still hotly debated.

The transition towards risk management is more likely for the 42% enterprises whose security officers report to executives (the board of directors or chief risk officers) outside of the IT organization, according to Gartner. The firm's analysts advise security officers to achieve compliance as a result of a risk-based strategy, but admit that "organizations have not kept pace."

Equinix started to build a customized threat intelligence program about five years ago. The International Business Exchange data center provider uses threat intelligence along with risk assessment to do its "homework" before the company invests its resources in information security or agrees to IT requests from departments with different priorities.

"It doesn't make sense to go and buy a piece of [security] equipment because somebody in sales and marketing says, 'This is a big deal for the company,'" said George Do, global information security director of Equinix, which operates colocation centers in 15 countries. "We have to vet it, and we have to understand: Is this really a threat? What are the threat vectors?

"Sometimes, there is this black orbit, and we are just there for the ride," said Do. "I am always very conscious of that, and I want to make sure that whatever we are spending resources on is truly managing risk."

Metrics that Do reports up the chain of command, starting with the CIO, include data from the last quarter and year on the number of critical instances -- compromised data or critical servers, for example. Because Equinix employees frequently travel all over the world, security incidents, such as malware or backdoors, involving employees' mobile endpoints (laptops and mobile devices) are tracked, as well as employee acceptable-use policy violations.

In addition to capturing incident data, the security team tracks metrics around any attempted cyberattacks against the organization, especially around the perimeter from firewalls, VPN servers and mobile device gateways. "We have a Palo Alto firewall where I can see that [data] very clearly," said Do. "I can present a very simple dashboard to any executive that shows: Hey, at any given second of the day we are being attacked by literally thousands of threats and the firewall is doing its job so it's not like we invested in this for nothing."

While threat intelligence is the foundational piece of risk assessment at Equinix, the use of intelligence data in the security industry is often ad hoc. "It has either plateaued or actually decreased," said Do.

"There are always two sides of the spectrum," he continued. "The companies that are very good at doing SIEM [security information and event management] and all of these intelligence pieces so that the more intelligence or data points that they've added to their infrastructure, the smarter they become."

But the majority of the security teams don't do that. "They are either mired in compliance checkboxes or chasing down shadow IT services. Or there are so many things going on in their universe that there are no resources, or time, left to focus on threat intelligence."

Older posts are this way If this message doesn't go away, click anywhere on the page to continue loading posts.
Could not load more posts
Maybe Soup is currently being updated? I'll try again automatically in a few seconds...
Just a second, loading more posts...
You've reached the end.

Don't be the product, buy the product!