Gestión de Controles

How to assess risk by reviewing controls?

To ensure security in an organization, it is vital to perform an adequate risk assessment that includes the review of controls. There are multiple references, standards and frameworks that guide us in this task. The ISO 27001 standard and the special document 800-53 of the National Institute of Standards and Technology of the United States stand out here.

What is the reference of ISO 27001 and 27002?

ISO 27001 is a certifiable standard that establishes requirements for establishing, implementing, maintaining and improving an information security management system. Within its family is ISO 27002, which contains the controls necessary to meet the requirements of ISO 27001. If a control cannot be met because it is outside the scope of the business, it can be adequately justified in the Statement of Applicability (SoA).

What is NIST 800-53 B and C?

NIST 800-53 provides detailed guidance on security and privacy controls that help mitigate risks to information systems. 800-53B also provides a baseline that varies depending on the impact assets have on systems. A practical example would be to implement inactivity logoff on systems with moderate to high impact, as indicated in this document.

What is the role of 800-53 A?

800-53A is focused on control assessment. It provides methods for assessing the effectiveness of controls through specific questions and actions. It assists in preparing for audits by indicating which personnel to interview, what to validate and which documents to review.

How is the Statement of Applicability used?

The Statement of Applicability (SoA) is a document that lists the controls applied, justifying their implementation or exclusion. In an Excel sheet, it could contain:

• Control name: according to the standard used.
• Implementation: applicable or not applicable.
• Justification: reasons behind its implementation or exclusion.
• Responsible: person in charge of the decision.

This document is essential for auditors, facilitating the understanding of why a control is applied or not, and the implications of such decisions. It also serves to report to superiors and justify budgets, avoiding unnecessary investments in controls.

How are assets, threats and risks related?

1. Assets: They are valuable and have sensitivity.
2. Threats: They target assets by degrading them and can occur with a certain frequency.
3. Probability and Impact: By putting together the frequency of the threat with the impact on the asset, the risk is determined.
4. Control and Mitigation: Risks are mitigated by implementing controls that reduce the impact and frequency of occurrence of threats.

How is residual risk managed?

When applying controls, risks do not disappear completely. The resulting impact, known as residual risk, must be accepted or addressed. Risk management occurs throughout the organization, spanning from strategy to operations. It is a crucial element in any security program, enabling organizations to effectively minimize threats and consciously accept the risks that remain.