control mechanisms, identification and authentication mechanisms, encryption methods, intrusion detection software). Nontechnical controls are management and operational controls, such as security policies; operational procedures; and personnel, physical, and environmental security. 4.2 Control Categories The control categories for both technical and nontechnical control methods can be further classified as either preventive or detective. These two subcategories are explained as follows: Preventive controls inhibit attempts to violate security policy and include such controls as access control enforcement, encryption, and authentication. Detective controls warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums. The implementation of such controls during the risk mitigation process is the direct result of the identification of deficiencies in current or planned controls during the risk assessment process (e.g., controls are not in place or controls are not properly implemented). 4.3 Control Analysis Technique As discussed in Section 3.3, development of a security requirements checklist or use of an available checklist will be helpful in analyzing controls in an efficient and systematic manner. The security requirements checklist can be used to validate security noncompliance as well as compliance. Therefore, it is essential to update such checklists to reflect changes in ITSD’s control environment (e.g., changes in security policies, methods, and requirements) to ensure the checklist’s validity. Output from Step 4 - List of current or planned controls used for the information system to mitigate the likelihood of a vulnerability being exercised and reduce the impact of such an adverse event. STEP 5: LIKELIHOOD DETERMINATION To derive an overall likelihood rating that indicates the probability that a potential vulnerability may be exercised within the construct of the associated threat environment; the following governing factors must be considered: Threat-source motivation and capability Nature of the vulnerability Existence and effectiveness of current controls The likelihood that a potential vulnerability could be exercised by a given threat-source can be described as high, medium, or low. Table 4 below describes these three likelihood levels. Table 4 - Likelihood Definitions Likelihood Level Likelihood Definition High The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective. Medium The threat-source is motivated and capable, but controls are in that may impede successful exercise of the vulnerability.
control mechanisms, identification and authentication mechanisms, encryption methods, intrusion detection software). Nontechnical controls are management and operational controls, such as security policies; operational procedures; and personnel, physical, and environmental security. 4.2 Control Categories The control categories for both technical and nontechnical control methods can be further classified as either preventive or detective. These two subcategories are explained as follows: Preventive controls inhibit attempts to violate security policy and include such controls as access control enforcement, encryption, and authentication. Detective controls warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums. The implementation of such controls during the risk mitigation process is the direct result of the identification of deficiencies in current or planned controls during the risk assessment process (e.g., controls are not in place or controls are not properly implemented). 4.3 Control Analysis Technique As discussed in Section 3.3, development of a security requirements checklist or use of an available checklist will be helpful in analyzing controls in an efficient and systematic manner. The security requirements checklist can be used to validate security noncompliance as well as compliance. Therefore, it is essential to update such checklists to reflect changes in ITSD’s control environment (e.g., changes in security policies, methods, and requirements) to ensure the checklist’s validity. Output from Step 4 - List of current or planned controls used for the information system to mitigate the likelihood of a vulnerability being exercised and reduce the impact of such an adverse event. STEP 5: LIKELIHOOD DETERMINATION To derive an overall likelihood rating that indicates the probability that a potential vulnerability may be exercised within the construct of the associated threat environment; the following governing factors must be considered: Threat-source motivation and capability Nature of the vulnerability Existence and effectiveness of current controls The likelihood that a potential vulnerability could be exercised by a given threat-source can be described as high, medium, or low. Table 4 below describes these three likelihood levels. Table 4 - Likelihood Definitions Likelihood Level Likelihood Definition High The threat-source is highly motivated and sufficiently capable, and controls to prevent the vulnerability from being exercised are ineffective. Medium The threat-source is motivated and capable, but controls are in that may impede successful exercise of the vulnerability.
Risk-Assessment-for-Information-Systems-Process-2010-Mar-10.docx