Security Risk Assessment & Audit - OGCIO
Office of the Government Chief Information OfficerINFORMATIONSECURITYPractice GuideforSecurity Risk Assessment & Audit[ISPG-SM01]Version 1.1November 2017 Office of the Government Chief Information OfficerThe Government of the Hong Kong Special Administrative RegionThe contents of this document remain the property of and maynot be reproduced in whole or in part without the expresspermission of the Office of the Government Chief Information Officer
COPYRIGHT NOTICE 2017 by the Government of the Hong Kong Special Administrative RegionUnless otherwise indicated, the copyright in the works contained in this publication is ownedby the Government of the Hong Kong Special Administrative Region. You may generallycopy and distribute these materials in any format or medium provided the followingconditions are met –(a)(b)(c)(d)the particular item has not been specifically indicated to be excluded and is thereforenot to be copied or distributed;the copying is not done for the purpose of creating copies for sale;the materials must be reproduced accurately and must not be used in a misleadingcontext; andthe copies shall be accompanied by the words "copied/distributed with the permissionof the Government of the Hong Kong Special Administrative Region. All rightsreserved."If you wish to make copies for purposes other than that permitted above, you should seekpermission by contacting the Office of the Government Chief Information Officer.
Amendment HistoryAmendment HistoryChangeNumberRevision DescriptionPagesAffectedRevisionNumberDate1G51 Security Risk Assessment & AuditGuidelines version 5.0 was converted toPractice Guide for Security RiskAssessment & Audit. The RevisionReport is available at the governmentintranet portal ITG 0December20162Added a new chapter on informationsecurity management, revised descriptionon security risk assessment and securityaudit, and aligned references with otherpractice guides.Wholedocument1.1November2017Practice Guide for Security Risk Assessment and Auditiii
Table of ContentsTable of Contents1.Introduction . 11.1Purpose. 11.2Normative References . 11.3Definitions and Conventions. 21.4Contact . 22.Information Security Management . 33.Introduction to Security Risk Assessment and Audit . 54.5.6.7.3.1Security Risk Assessment and Audit . 53.2Security Risk Assessment vs Security Audit . 6Security Risk Assessment . 84.1Benefits of Security Risk Assessment . 84.2Frequency and Type of Security Risk Assessment . 94.3Steps on Security Risk Assessment . 104.4Common Security Risk Assessment Tasks . 324.5Deliverables . 33Security Audit . 345.1Frequency and Timing of Audit . 355.2Auditing Tools . 355.3Auditing Steps . 36Service Pre-requisites & Common Activities . 426.1Assumptions and Limitations . 426.2Client Responsibilities . 426.3Service Pre-requisites. 436.4Responsibilities of Security Consultant / Auditors . 436.5Examples of Common Activities . 44Follow-Up of Security Risk Assessment & Audit . 467.1Importance of Follow-Up . 467.2Effective & Qualified Recommendations . 477.3Commitment . 477.4Monitoring and Follow-Up . 48Practice Guide for Security Risk Assessment and Auditiv
Table of ContentsAnnex A: Sample List of Questions for Security Risk Assessment . 51Annex B: Sample Contents of Deliverables . 54Annex C: Different Audit Areas . 56Annex D: Sample Audit Checklist . 63Annex E: Sample List of Documented Information as Evidence of Compliance . 69Practice Guide for Security Risk Assessment and Auditv
Introduction1.IntroductionInformation Technology (IT) security risk assessment and security audit are themajor components of information security management. This document provides areference model to facilitate the alignment on the coverage, methodology, anddeliverables of the services to be provided by independent security consultants orauditors. With this model, managerial users, IT managers, system administrators andother technical and operational staff can have more understanding about security riskassessment and audit. They should be able to understand what preparations arerequired, which areas should be noted, and what results would be obtained. It is notthe intention of this document to focus on how to conduct a security risk assessmentor audit.1.1PurposeThis document shows a general framework for IT security risk assessment andsecurity audit. It should be used in conjunction with other security documents suchas the Baseline IT Security Policy [S17], IT Security Guidelines [G3] and relevantprocedures, where applicable.This practice guide is intended for all staff who are involved in a security riskassessment or security audit as well as for the security consultants or auditors whoperform the security risk assessment or security audit for the Government.1.2Normative ReferencesThe following referenced documents are indispensable for the application of thisdocument. Baseline IT Security Policy [S17] , the Government of the Hong Kong SpecialAdministrative RegionIT Security Guidelines [G3] , the Government of the Hong Kong SpecialAdministrative RegionInformation technology - Security techniques - Information securitymanagement systems - Overview and vocabulary (fourth edition),ISO/IEC 27000:2016Information technology - Security techniques - Information securitymanagement systems - Requirements (second edition), ISO/IEC 27001:2013Information technology - Security techniques - Code of practice for informationsecurity controls (second edition), ISO/IEC 27002:2013Information technology - Security techniques - Information security riskmanagement (second edition), ISO/IEC 27005:2011Practice Guide for Security Risk Assessment and Audit1
Introduction1.3Definitions and ConventionsFor the purposes of this document, the definitions and conventions given in S17, G3,and the following shall apply.Abbreviation and TermsSecurity RiskAssessmentSecurity Audit1.4It is a process to identify, analyse and evaluate the securityrisks, and determine the mitigation measures to reduce therisks to an acceptable level.It is an audit on the level of compliance with the securitypolicy or standards as a basis to determine the overall state ofthe existing protection and to verify whether the existingprotection has been performed properly.ContactThis document is produced and maintained by the Office of the Government ChiefInformation Officer (OGCIO). For comments or suggestions, please send to:Email:it security@ogcio.gov.hkLotus Notes mail:IT Security Team/OGCIO/HKSARG@OGCIOPractice Guide for Security Risk Assessment and Audit2
Information Security Management2.Information Security ManagementInformation security is about the planning, implementation and continuousenhancement of security controls and measures to protect the confidentiality,integrity and availability of information assets, whether in storage, processing, ortransmission and its associated information systems. Information securitymanagement is a set of principles relating to the functions of planning, organising,directing, controlling, and the application of these principles in harnessing physical,financial, human and informational resources efficiently and effectively to assure thesafety of information assets and information systems.Information security management involves a series of activities that requirecontinuous monitoring and control. These activities include but not limited to thefollowing functional areas: Security Management Framework and the Organisation;Governance, Risk Management, and Compliance;Security Operations;Security Event and Incident Management;Awareness Training and Capability Building; andSituational Awareness and Information Sharing.Security Management Framework and OrganisationB/Ds shall establish and enforce departmental information security policies,standards, guidelines and procedures in accordance with the business needs and thegovernment security requirements.B/Ds shall also define the organisation structure on information security and provideclear definitions and proper assignment of security accountability and responsibilityto involved parties.Governance, Risk Management and ComplianceB/Ds shall adopt a risk based approach to identify, prioritise and address the securityrisks of information systems in a consistent and effective manner.B/Ds shall perform security risk assessments for information systems and productionapplications periodically and when necessary so as to identify risks andconsequences associated with vulnerabilities, and to provide a basis to establish acost-effective security program and implement appropriate security protection andsafeguards.Practice Guide for Security Risk Assessment and Audit3
Information Security ManagementB/Ds shall also perform security audit on information systems regularly to ensurethat current security measures comply with departmental information securitypolicies, standards, and other contractual or legal requirements.Security OperationsTo protect information assets and information systems, B/Ds should implementcomprehensive security measures based on their business needs, covering differenttechnological areas in their business, and adopt the principle of "Prevent, Detect,Respond and Recover" in their daily operations. Preventive measures avoid or deter the occurrence of an undesirable event;Detective measures identify the occurrence of an undesirable event;Response measures refer to coordinated actions to contain damage when anundesirable event or incident occurs; andRecovery measures are for restoring the confidentiality, integrity andavailability of information systems to their expected state.Security Event and Incident ManagementIn reality, security incidents might still occur due to unforeseeable, disruptive events.In cases where security events compromise business continuity or give rise to risk ofdata security, B/Ds shall activate their standing incident management plan toidentifying, managing, recording, and analysing security threats, attacks, or incidentsin real-time. B/Ds should also prepare to communicate appropriately with relevantparties by sharing information on response for security risks to subdue distrust orunnecessary speculation. When developing an incident management plan, B/Dsshould plan and prepare the right resources as well as develop the procedures toaddress necessary follow-up investigations.Awareness Training and Capability BuildingAs information security is everyone’s business, B/Ds should continuously promoteinformation security awareness throughout the organisations and arrange trainingand education to ensure that all related parties understand the risks, observe thesecurity regulations and requirements, and conform to security best practices.Situational Awareness and Information SharingAs cyber threat landscape is constantly changing, B/Ds should also constantly attendto current vulnerabilities information, threat alerts, and important noticesdisseminated by the security industry and the GovCERT.HK. The security alerts onimpending and actual threats should be disseminated to and shared with thoseresponsible colleagues within B/Ds so that timely mitigation measures could betaken.B/Ds could make use of the cyber risk information sharing platform to receive andshare information regarding security issues, vulnerabilities, and cyber threatintelligence.Practice Guide for Security Risk Assessment and Audit4
Introduction to Security Risk Assessment and Audit3.Introduction to Security Risk Assessment and Audit3.1Security Risk Assessment and AuditSecurity risk assessment and audit is an ongoing process of information securitypractices to discovering and correcting security issues. They involve a series ofactivities as shown in Figure 3.1. They can be described as a cycle of iterativeprocesses that require ongoing monitoring and control. Each process consists ofdifferent activities and some of which are highlighted below as examples.AssessingSecurity RisksPeriodic Review& Security AuditImplementing &Maintaining aSecure FrameworkIdentify Threats,Vulnerabilities &ImpactsDefine Policies, AssignSecurity Responsibilities& Apply SafeguardsReviewing&Maintaininga tyRisksRecordingIncident Monitoring &Audit TrailsFigure 3.1 An Iterative Process of Security Risk Assessment and AuditAssessing security risk is the initial step to evaluate and identify risks andconsequences associated with vulnerabilities, and to provide a basis for managementto establish a cost-effective security program.Based on the assessment results, appropriate security protection and safeguardsshould be implemented to maintain a secure protection framework. This includesdeveloping new security requirements, revising existing security policies andguidelines, assigning security responsibilities and implementing technical securityprotections.With implementation of secure framework, there is also the need for constantmonitoring and recording so that proper arrangements can be made for tackling asecurity incident. In addition, day-to-day operations such as users' access attemptsand activities while using a resource, or information, need to be properly monitored,audited, and logged.Practice Guide for Security Risk Assessment and Audit5
Introduction to Security Risk Assessment and AuditThis step is then followed by cyclic compliance reviews and re-assessments toprovide assurance that security controls are properly put into place to meet users'security requirements, and to cope with the rapid technological and environmentalchanges. This model relies on continuous feedback and monitoring. The review canbe done by conducting periodic security audits to identify what enhancements arenecessary.3.2Security Risk Assessment vs Security AuditBoth the security risk assessment and the security audit are on-going processes butare different in terms of both nature and functions.Security risk assessment is the process to identify, analyse and evaluate the securityrisks, and determine the mitigation measures to reduce the risks to an acceptablelevel. The risk assessment is an integral part of a risk management process designedto provide appropriate levels of security for information systems. It helps identifyrisks and consequences associated with vulnerabilities, and to provide a basis toestablish a cost-effective security program and implement appropriate securityprotection and safeguards.For a new information system, the security risk assessment is typically conducted atthe beginning of the system development life cycle. For an existing system, theassessments shall be conducted on a regular basis throughout the systemdevelopment life cycle or when major changes are made to the IT environment.An information security audit is an audit on the level of compliance with the securitypolicy and standards as a basis to determine the overall state of the existingprotection and to verify whether the existing protection has been performedproperly. The security audit is an on-going process to ensure that current securitymeasures comply with departmental IT security policies, standards, and othercontractual or legal requirements.Practice Guide for Security Risk Assessment and Audit6
Introduction to Security Risk Assessment and AuditWhile there are similarities in certain functions, below is a highlight of the keydifference between security risk assessment and security audit.Security Risk AssessmentSecurity AuditThe identification of threat andvulnerabilities, evaluation of the levelsof risk involved, and determination ofan acceptable level of risk andcorresponding risk mitigation strategiesThe processes to ascertain the effectiveimplementation of security measuresagainst the departmental IT securitypolicies, standards, and othercontractual or legal requirementsFocus on the risk perspective,assessment areas not necessarily relatedto security policies and standardsFocus on the compliance perspective,assess against security policies,standards or other pre-defined criteriaFor new information systems, conductearly in the system development lifecycle and before the system is put inproductionPeriodic review, on-going processFor existing information systems,conduct at least once every two years orwhen major changes are madeCan be a self-assessment or completedby an independent third partyMust be completed by an independentthird partyKey deliverable: risk register and riskmitigation measuresKey deliverable: compliance checklistThe details of the processes for conducting security risk assessment and securityaudit are described in Sections 4 and 5 respectively.Practice Guide for Security Risk Assessment and Audit7
Security Risk Assessment4.Security Risk AssessmentSecurity risk assessment is the process to identify, analyse and evaluate the securityrisks, and determine the mitigation measures to reduce the risks to an acceptablelevel. The assessment process of a system includes the identification and analysisof : all assets of and processes related to the systemthreats that could affect the confidentiality, integrity or availability of thesystemsystem vul
security controls (second edition), ISO/IEC 27002:2013 . Information security risk management (second edition), ISO/IEC 27005:2011 . Introduction Practice Guide for Security Risk Assessment and Audit 2 1.3 Definitions and Conventions . Security Operations To protect information assets and information systems, B/Ds should implement .
The quality audit system is mainly classified in three different categories: i Internal Audit ii. External Audits iii. Regulatory Audit . Types Of Quality Audit. In food industries all three audit system may be used to carry out 1. Product manufacturing audit 2. Plant sanitation/GMP audit 3. Product Quality audit 4. HACCP audit
AUDIT OF DEKALB COUNTY DATA CENTER PHYSICAL SECURITY AUDIT REPORT NO. 2018-007-IT John Greene Chief Audit Executive FINAL REPORT What We Did In accordance with the Office of Independent Internal Audit's (OIIA) Annual Audit Plan, we conducted a performance audit of the DeKalb County Data Center Physical Security.
INTERNAL AUDIT Example –Internal audit report [Short Client Name] Internal Audit Report Rev. [Rev Number] STEP ONE: Audit Plan Process to Audit (Audit Scope): Audit Date(s): Lead Auditor: Audit #: Auditor(s): Site(s) to Audit: Applicable Clauses of [ISO 9001 or AS9100] S
4.1 Quality management system audit 9.2.2.2 Quality management system audit - except: organization shall audit to verify compliance with MAQMSR, 2nd Ed. 4.2 Manufacturing process audit 9.2.2.3 Manufacturing process audit 4.3 Product audit 9.2.2.4 Product audit 4.4 Internal audit plans 9.2.2.1 Internal audit programme
security controls (second edition), ISO/IEC 27002:2013 Information technology - Security techniques - Information security incident . In information security management, the "Security Operations" functional area includes the deployment of proper security protection and safeguards to reduce the
Audit and Consulting Services Annual Report Fiscal Year 2022 Page 7 of 9 . VI. Internal Audit Plan for Fiscal Year 2023 . The internal audit plan was prepared using a risk assessment methodology. ACS distributed a risk assessment survey to Cabinet members and their leadership teams to identify top risks from an audit universe of 69 areas.
Risk is the effect of uncertainty on objectives (e.g. the objectives of an event). Risk management Risk management is the process of identifying hazards and controlling risks. The risk management process involves four main steps: 1. risk assessment; 2. risk control and risk rating; 3. risk transfer; and 4. risk review. Risk assessment
Am I My Brother's Keeper? Grounding and Motivating an Ethos of Social Responsibility in a Free Society (Thisisadraftpriortopublication. Forpublishedversion,&see cal(Philosophy, Vol.&12,&No.&4,&December&2009,&559–580. Pleaseusepublished&versionforallcitations). David Thunder Matthew J. Ryan Center for the Study of Free Institutions and the .
