Aviation Cyber Security Threat Assessment and Risk ManagementSasSofia

February 02, 2022

Blog

Sofema Aviation Services (SAS) www.sassofia.com considers the process to perform a Cyber Risk Assessment.

Introduction Role & Purpose of Cybersecurity Risk Assessments

Cyber Risk Assessments are integral to information risk management and form a subset of the organization’s high-level overall business risk management strategy.

Cybersecurity Risk Assessments are a critical component of risk management strategy intended to provide understanding, analysis control, and mitigation of all instances of cyber risk. Cyber risks are categorized from zero, low, medium, to high-risks.

Hacking, Malware, as well as multiple other risks (for example Natural Disasters), pose potential security risks and should be addressed:

Rational for Performing a Cyber Risk Assessment

Ability to identify potential threats and vulnerabilities
o Opportunity to mitigate potential rather than “real” scenarios
o Potential to prevent or reduce the incidence of security breaches
o Avoid reputational damage
o Data breaches can create a huge financial burden for the organization
The potential benefit of avoiding unnecessary expenditure (rectifying cyber exposures)

Types of Cyber Risk

Cyber risk could be described as the likelihood of experiencing negative events related to any of the following areas:

Disruptions to sensitive data,
Financial Abuse or Impropriety,
Interruptions to Business Process or Operations,
An event exposing a data breach. (illegal access to secure data)

Cyber Risks Examples include:

Cyberattacks
Ransomware
Malware
Data leaks
Phishing

Cyber Risks and Vulnerabilities:

A vulnerability is a weakness that results in unauthorized access.
Cyber risk is the probability of a vulnerability being exploited.

Basic Organizational Factors to use When Developing Policies:

Reputational damage
Feasibility of mitigating actions
Regulations driving legal and organizational obligations
Effectiveness of existing controls
Safety & Reliability Exposure
Organizational attitude towards risk (Tolerance & Weighting)

Performing an assessment of Risk (Vulnerability) – Ask & Answer the Following:

What is the threat?
How vulnerable is the system to the identified threat?
Is there any additional exposure for example financial impact or reputational damage?
What is the risk I am reducing?
Is this the highest priority security risk?
Am I reducing the risk in the most cost-effective way?

Calculate Cyber Risk using the following:

Cyber risk = Threat x Vulnerability x Information Value

Basic Cyber Questions (Configure for your Situation)

What cyber attacks, cyber threats, or security incidents could impact affect the ability of the business to function?
Can all threat sources be identified?
o What is the level of the potential impact of each identified threat?
o What is the likelihood of exploitation?
o What is the impact if those vulnerabilities are exploited?
Have we identified our organization’s primary technology assets?
What effect would a data breach have on our business related to each of the following:
o Malware,
o Human Error,
o Cyberattack.
What is the effective level of risk my organization is comfortable taking?
o How is this managed & communicated

How to Perform a Cyber Risk Assessment

Initial Assessment Considerations including special requirements or constraints: (Primary focus should be on Business-Critical Systems)

Purpose of the assessment
Scope of the assessment

The next step is to consider the data used by your organisation its value and the infrastructure it supports – use the following to support the evaluation process:

What data do we collect and or share with our third-party partners?
How are we protecting and documenting this data?
What Data Storage Procedures are followed?
How many access points are associated with the data? (Internal & External)

Develop your own organizational criteria for measuring the value of a particular asset – typically a combination of:

Asset value,
Legal Commitments & Obligations standing and business importance,
Classification of the Perceived Risk.

Additional Measures you can draw on include:

Potential Reputational Damage
Value of our Data to a Competitor
Financial or potential legal penalties related to the exposure of the information?
Cost to Replace lost Data
Business Continuity Impact

Information to factor into the assessment (validate & verify for each asset)

Software / Hardware
Data & Interface
Active End-users & Support personal
Role Purpose & Criticality
Functional requirements
IT-related aspects – Policies / Architecture / Storage & Comms
Network topology (Communication Methodology)
Security – Technical / Physical & Environment

Analyze Exposure and Implement Mitigations

Ensure controls are in place and are effective in minimizing any identified vulnerability.
Controls can be considered as:

Technical

o Hardware,
o Software,
o Encryption,
o Two-factor authentication,
o Continuous data vulnerability assessment.

Non-Technical

o Security policies,
o Physical mechanisms (locks & keycard access).

Controls Classification

Preventative

o Encryption,
o Antivirus,
o Continuous monitoring.

Reactive Controls

o Reactive – Identify when an attack has occurred from continuous data validity & analysis

Developing a Risk Cost / Annum Assessment

Calculate the Likelihood and Financial Impact of Various Scenarios on a Per-Year Basis (cost of data loss versus likely occurrence for example 100,000 Euro / could happen once in 10 Years = exposure of 10,000 Euro / Year

Risks Prioritization Measured Against Prevention / Information Value

Using Risk level as the basis for a determinant to drive mitigation proposals for the leadership team.

High – corrective measures to be developed as soon as possible.
Medium – correct measures developed within a reasonable period of time.
Low – decide whether to accept the risk or mitigate.

Producing a Cyber Risk Assessment Report

A Cyber Risk Assessment Report is an essential tool when developing policies and making decisions related to budget, policies and procedures.

The Cyber Risk Report will support the development of a risk assessment policy defining the steps to be taken to provide the necessary oversight and monitoring on a continuous basis.

Method

For each identified threat describe: