So, what could cause a multimillion dollar information leak?  An intruder, a negligent operator, or a disgruntled employee?  How about a technological snafu?  Or even a tornado?  A tornado, you ask?  It's possible.  If those ominous winds were to blow in while your guidance staff was reviewing printed copies of confidential files, you could never be quite sure where those records might end up.

• Assets your organization possesses
• Potential threats to those assets
• Points in your organization where you may have vulnerabilities to those threats
• Probabilities of threats striking an organizational vulnerability
• Cost estimates of losses should a potential threat be realized

Such an endeavor may seem complicated on the surface, but it doesn't have to be.  Risk assessment is a straight-forward process and a most necessary step in decision-making.  By evaluating risk, you are determining your needs so that you don't spend valuable resources on unnecessary safeguards while, at the same time, you don't leave yourself exposed to unprotected loss.

What will your risk assessment tell you?  Well, since risk assessment is a process and not a product, it depends on your specific situation.  As stated above, it should identify your organization's assets, threats, vulnerabilities, probabilities of incursion, and associated costs.  How can that help you plan security?  It tells you what you have, what it's worth, what to worry about, where you're weak, and why you should be concerned in the first place.

Say, for example, that you realize that the old building in which you store your staff records (an asset) was not constructed with fire-resistant materials in the way you would require for a newly built structure (a vulnerability)-and you also realize that it's conceivable that a fire (a threat) could strike the site (a probability that, while low, is real, and could therefore be estimated).  The question becomes whether you should introduce countermeasures to protect your staff records from a fire.

Knowing what you do about the asset, vulnerability, threat, and probability, the answer then depends upon the cost of replacing that lost asset.  If you are in a very small school, it might be feasible to resurvey your staff to gather lost information at relatively little cost; therefore you could afford to risk the loss of staff records.

In contrast, however, while it might also be possible to resurvey staff in a large state system as well, the associated costs would be much greater-so much so that despite the low probability of a fire damaging your asset (the records), you wouldn't want to accept the risk because it would be far too costly to assume should the threat (the fire) actually strike.  Thus, a small school could theoretically accept the threat of a fire while a large state system should rebuild to meet fire-resistant standards.  Right?  Not so fast-that's not quite the answer.

While it may seem like a valid conclusion given the information presented, other issues must also be considered.  One influencing factor might be that the building in question stores not only staff records, but also  student and fiscal records as well, all of which are maintained on a state-of-the-art computer system.  Suddenly the low cost of resurveying a few teachers doesn't seem like an adequate solution because of the other costs you would likely incur should a fire occur at your site.

Q. Where do I begin to protect information and equipment?
A. The answer to that question can be very straightforward if you know the answers to two related questions: (1) What information and equipment do you want to protect? and (2) What do you want to protect it from?  Drawing conclusions about these important issues can be accomplished most effectively by a systematic approach to determining your assets, threats, and vulnerabilities-a process referred to here as risk assessment.  Risk assessment is a collaborative effort to identify potential threats to your organization's assets, estimate the likelihood of those  threats being realized, and quantify the costs attributable to potential losses.

Q. Why should I worry about all these details when I have far-reaching insurance policies to cover my losses?
A. First of all, many insurance policies cover only tangible assets (e.g., equipment).  As is emphasized throughout this document, however, information is often more valuable than the equipment that is used to access it.  After performing a risk assessment, you will be in a better position to inquire about additional insurance policies to cover your information as well.  You can then make sure that you have insured yourself against reasonably probable, high-cost losses because risk assessment will have helped you determine what they are more likely to be.  Remember, as an educational administrator, you are the expert on your organization, not an insurance agent.  It is your job to know where and why you need insurance coverage-so review all policies after performing your risk assessment.  Don't pay for insurance you don't need and make sure that you have those policies you do need.

Q. Even if my risk assessment identifies real threats and vulnerabilities, how can I possibly deal with them with such a small staff (not to mention budget)?
A. The fewer the resources you have to put into protecting your organization, the more vital the risk assessment process becomes.  Think about it.  If you have unlimited security funding, then you may have enough resources to protect yourself against the entire spectrum of threats.  Having said that, however, it should be noted that even the wealthiest organizations should perform a risk assessment to be sure that they have considered all of their potential threats.  On the other hand, if funds are scarce, you need to perform a risk assessment to accurately prioritize your needs before allotting your limited resources.  In this way, risk assessment provides you with the information needed to address your most pressing needs first and increase the effectiveness of those resources that are at your disposal, whatever they may be.

Components of Risk

What is a risk?  For the purpose of information security and this document, a risk is any hazard or danger to which your information or equipment is subject.  Storing an expensive computer within reach of an open window is risky.  Allowing students to have access to computerized grade books might also be considered risky.  But even if you now know what a risk is, the question of what is at risk still remains-and the answer is your assets.

Assets

Equipment is, of course, very valuable, but never forget that the real asset is the information.

It is estimated that as much as 67 percent of networked computers are infected with one form of a virus or another in a given year.³  Even accounting for the growing prevalence of virus threats, more than half of all reported system damage is caused by unintentional employee action-in most cases, simple negligence.  Any such action, actor, or event that contributes to risk is referred to as a threat.

As you consider types of potential threats, notice the secondary distinction that becomes relevant in the manmade category between intentional and unintentional threats.  Intentional manmade threats are a source of particular resentment for many people.  After all, why should an organization have to spend its valuable resources on keeping users from willfully causing damage?  The same question can be asked about the need for uninsured motorist insurance, but the results will be the same.  You have to be able to account for people who are unwilling to play by the rules!

Vulnerabilities refer to points within a system that are open to attack or damage.  What type of attack?  That depends on the threat.  Vulnerabilities are the mechanisms by which threats access your system.  Think of a thief (a threat), for example, who is ready to strike your building (which houses your assets).  An open back window through which that thief might enter the premises is a vulnerability.

Countermeasures

A countermeasure is a step planned and taken in opposition to another act or potential act.  While ultimately aimed at rebuffing threats, countermeasures are often deployed strategically at points of vulnerability, as is the case when a lock (a countermeasure) is installed on a back window through which a thief may try to enter your building (see vulnerabilities above).  Countermeasures are often designed to serve one of the following functions:⁵

Dealing with Risk

Under what conditions could accepting risk make sense?  Well, it is theoretically possible that an asteroid could smash into the earth and land, of all places, on your office.  The risk is real, albeit small, and can be estimated as such.  Should you, therefore, endeavor to build a concrete vault two miles beneath the surface of the earth to store backup files of your records, or should you accept the risk of an asteroid strike and figure that your system will be the last of your worries should the event actually occur?  Your risk assessment (see Steps 1-8 below) and common sense will probably tell you that you can safely afford to accept the residual risk of asteroid strikes.  That's right, you don't have to counter any and every risk conceivable, only those it makes sense to address based on the results of your risk assessment.

While potential risks should never be ignored, it only makes sense for an organization to focus its attention on those risks that are most likely to affect the system.

Guidelines for Risk Assessment

The process of risk assessment should be initiated and led by the top educational administrators in an organization.  But although the endeavor is captained by chief administrators, feedback from all levels and job categories is required.  At a minimum, information collectors, data providers, data entry staff, and data processors and managers should be involved in the early stages of risk assessment.  In short, more people involved in the brainstorming process results in more ideas being generated.

Take Stock of What You Have and What It's Worth
Only careful and collaborative efforts will yield worthwhile results.  Be inclusive, exhaustive, and realistic when documenting your assets.

Step 1 - Identify sensitive information and critical systems:  The goal here is to make a distinction between general information and systems (i.e., that information and those systems that are helpful to your organization as it carries out its mission) and sensitive information and critical systems (i.e., that information and those systems that are private and/or vital to your organization as it carries out its mission).

For example, the computer that houses the "HELP" file for your organization's word processing software is a "general" support component.  While it is most helpful to have access to user HELP when facing a word processing problem, the files themselves are not vital to running a school or school system.  Conversely, the new software that manages a school system's substitute teacher scheduling is vital to the teaching mission.  If it isn't available and working properly, principals could potentially find themselves with classrooms full of students who have no teacher.  And that makes the system "critical" if ever there was one.

• Direct replacement costs of hardware, software, and peripherals (Would there be installation costs? Consultant fees? Necessary upgrades?)

• Replacement costs of stored information (Would rekeying be necessary? Resurveying?)

• Costs associated with the disruption of service or other activities (Would you have to pay staff overtime during the recovery period?  What about extra school days at the end of the year to make up for missed time?)

• Indirect but real costs associated with a loss of public confidence (Would it impede current or future data collection efforts?  What would be the effect on legislative initiatives?)

Again, keep in mind that while the costs of hardware and software tend to be more readily measurable, information costs are very real as well.  You may not be able to call a vendor and say "What is my information worth?" the way you can call your equipment salesperson, but you still have to ask yourself "What is it worth to my organization?" Estimates of these costs, no matter how rough, give you a more accurate sense of the true value of important information assets.

If information isn't valuable enough to warrant consideration of its protection and recovery, can it be valuable enough to warrant precious disk space in the first place?

Step 3 - Identify threats:  What actors, actions, or events threaten your system?  Refer to the examples on page 15 before creating an exhaustive list through a collaborative brainstorming process.  Be sure to consider the following types of threats:

• Natural (e.g., fire, flood, lightning, and humidity)
• Manmade unintentional (e.g., negligence and accidents)
• Manmade intentional (e.g., hackers and viruses)

Step 4 - Identify vulnerabilities:  Where is your system susceptible?  Consider vulnerabilities to natural threats and both intentional and unintentional manmade threats as identified in Step 3.  Also look at other examples of threats, as listed on page 15, to see if any new ideas are triggered.  After this initial brainstorming, organize the list of vulnerabilities you've generated into categories such as the following and then once again see if additional thoughts come to mind:

• Physical concerns (e.g., room access, building construction, and climate)
  
• Hardware- and software-related issues (e.g., equipment, programs, and compatibility)
  
• Media liabilities (e.g., disks, tapes, hard drives, and print copies)
• Communications (e.g., access points and encryption)
• Human concerns (e.g., personnel and office behavior)

Step 5 - Estimate the likelihood of a potential penetration becoming an actual penetration:  What is the probability of a threat capitalizing on a vulnerability?  As difficult as answering such a question might appear to be, you don't have to be able to predict the future in order to generate reasonable probabilities of future events.  Use logic, as possible, to support your estimates.  For example, for an institution located along the Mississippi River, earthquakes and floods are threats that are within the realm of possibility, but logic will tell you that the site is probably much more susceptible to floods.  Using flood histories, the likelihood of the next 100-year flood can be estimated.  Similarly, by researching earthquake data, you can estimate the likelihood of earthquakes as well.

Think Through Your Defensive Options

Step 6 - Identify countermeasures against perceived threats and vulnerabilities:  This step parallels Steps 3 and 4 in that its purpose is to generate an exhaustive list of ideas-this time potential solutions to the concerns caused by your identified threats and vulnerabilities.  When considering options, be sure to keep in mind that many threats and vulnerabilities can be addressed by more than one countermeasure.  A potential thief, for example, could be thwarted by better locks, video cameras and other electronic surveillance, or even trained security patrol officers.  Step 6 focuses on generating a list of such options for each perceived threat and vulnerability, not in selecting what appears to be the preferred option.  That is attempted only after an exhaustive list is finalized and costs/benefits are considered.  Issues to consider when brainstorming potential countermeasures include:

• Physical security equipment and procedures-location and environmental strategies such as climate monitors, required building specifications, and regulations governing room access and food and beverage use

• Information security practices-storage and use regulations such as labeling and write-protecting files

• Software security techniques-purchasing and programming concerns such as copyright infringements and proper documentation
  

• User access controls-data and system access issues, including log-in and password protection
  

• Networking security initiatives-connectivity issues like firewalls and encryption strategies

• Both money and time for research, development, procurement, installation, and maintenance of security features
  

• Staff training time-the costs are real and absolutely necessary

• Altered productivity (e.g., having each employee spend one minute using a virus scanner three times each day may amount to only three minutes of work time per day, but when calculated for the entire organization and compounded by a host of other possible security activities, such seemingly insignificant costs can add up)
  

• Countermeasures already available to the organization that may require less investment to institute (e.g., if your accounting office currently uses certain security procedures, there may be fewer training costs because you already have a core of people who can share their expertise)

Step 8 - Select suitable countermeasures for implementation:  In Step 8, it's finally time to decide which countermeasures make the most sense to implement.  Remember that there will probably be more than one countermeasure that can protect your system from any given threat or vulnerability, so you have some choices.  Your job is to determine which strategy makes the most sense from a cost/benefit perspective.  This can be accomplished by comparing your estimated costs of potential losses for a given period of time (Steps 2-5) with actual security costs that would be incurred when preventing such a loss for the same period of time (Step 7).

A desired level of risk reduction is achieved when further reduction would cost more than the benefits gained.

Once you determine your needs and priorities through the above eight steps, you can then make security decisions based on concrete information.  Sales pitches from vendors and gut instinct on the part of well-intentioned, but perhaps uninformed, staff need no longer serve as reasons for making security policy when competent administrators are armed with the information required to make rational, valid decisions.

An exception to the rule: Failure to introduce risk reduction cannot be justified by cost/benefit analysis if there are compelling non-financial reasons for mandating it (e.g., privacy or appropriate use laws).

While it may be tempting to simply refer to the following checklist as your security plan, to do so would limit the effectiveness of the recom-mendations. They are most useful when initiated as part of a larger plan to develop and implement security policy throughout an organization. Other chapters in this document also address ways to customize policy to meet an organization's specific needs- a concept that should not be ignored if you want to maximize the effectiveness of any given guideline.

Security Checklist for Chapter 2
The brevity of a checklist can be helpful, but it in no way makes up for the detail of the text.

Check Points for Risk Assessment Is the process of risk assessment being championed by a top-level decision-maker?       Is feedback being elicited from representatives of all user types?       Have sensitive information and critical systems been identified (Step 1)?       Has the value of all system components (not just sensitive information and critical systems) been estimated (Step 2)?       Has an exhaustive list of potential threats been generated (Step 3)?       Has an exhaustive list of vulnerabilities been generated (Step 4)?       Has the likelihood of a potential penetration becoming an actual penetration been estimated (Step 5)?       Has an exhaustive list of countermeasures to identified threats and vulnerabilities been generated (Step 6)?       Have the costs of implementing identified countermeasures been estimated (Step 7)?       Have suitable countermeasures been selected for implementation (Step 8)?