Difference between revisions of "OWASP Risk Rating Methodology"

Revision as of 15:39, 22 December 2006

[Up]

OWASP Testing Guide v2 Table of Contents

Overview

Discovering vulnerabilities is important, but just as important is being able to estimate the associated risk to the business. Early in the lifecycle, you may identify security concerns in the architecture or design by using threat modeling. Later, you may find security issues using code review or penetration testing. Or you may not discover a problem until the application is in production and is actually compromised.

By following the approach here, you'll be able to estimate the severity of all of these risks to your business, and make an informed decision about what to do about them. It's important to have a system in place for rating risks, as it is all too easy to get distracted by minor risks while ignoring more serious risks that are less well understood.

Ideally, there would be a universal risk rating system that would accurately estimate all risks for all organization. But a vulnerability that is critical to one organization may not be very important to another. So we're presenting a framework here that you should customize for your organization.

We have worked hard to make this model simple enough to use, while keeping enough detail for accurate risk estimates to be made. Please reference the section below on tailoring and weighting the model to customize it for use in your organization.

Approach

There are many different approaches to risk analysis. See the reference section below for some of the most common ones. The OWASP approach presented here is based on these standard methodologies and is customized for application security. Our approach builds on the standard risk model:

      Risk = Likelihood * Impact

In the sections below, we break down the factors that make up "likelihood" and "impact". Organizations should customize and weight these factors to create their own standard for rating risks.

Step 1: Identifying a Risk

The first step is to identify a security risk that needs to be rated. You'll need to understand the threat agent involved, the attack they're using, the vulnerability involved, and the impact on your business. There may be multiple possible groups of attackers, or even multiple possible business impacts. In general, it's best to err on the side of caution, and use the worst-case option, as that will result in the highest overall risk.

Step 2: Factors for Estimating Likelihood

Once you've identified a vulnerability, and want to figure out how serious it is, the first step is to estimate the "likelihood". At the highest level, this is a rough measure of how likely this particular vulnerability is to be uncovered and exploited by an attacker. We do not need to be over-precise in this estimate. Generally, identifying whether the likelihood is low, medium, or high is sufficient.

There are a number of factors that can help us figure this out. The first set of factors are related to the threat agent involved. The goal is to estimate the likelihood of a successful attack from a group of possible attackers. Note that there may be multiple threat agents that can exploit a particular vulnerability, so it's usually best to use the worst-case scenario. For example, an insider may be a much more likely attacker than an anonymous outsider - but it depends on a number of factors.

Threat Agent Factors

Skill level

How technically skilled is this group of attackers? No technical skills, some technical skills, advanced computer skills, network and programming skills, security penetration skills

Motivation

How motivated is this group of attackers to find and exploit this vulnerability? Low or no reward, possible reward, high reward

Opportunity

How much opportunity does this group of attackers have to find and exploit this vulnerability? No known access, limited access, some access, full access

Size

How large is this group of attackers? All internet users, authenticated users, partners, intranet users, application users, administrators, developers

Vulnerability Factors

The next set of factors are related to the vulnerability involved. The goal here is to estimate the likelihood of the particular vulnerability involved being identified and exploited. It's important to consider the totality of the circumstances here

Ease of discovery

How easy is it for this group of attackers to discover this vulnerability? Practically impossible, difficult, easy, automated tools available

Ease of exploit

How easy is it for this group of attackers to actually exploit this vulnerability? Theoretical, difficult, easy, automated tools available

Awareness

How well known is this vulnerability to this group of attackers? Public knowledge, all insiders, limited insiders

Intrusion detection

How likely is an exploit to be detected? Not logged, logged without review, logged and reviewed, active detection in application

Step 3: Factors for Estimating Impact

Impact is generally calculated based on annualized loss expectancy (ALE). Businesses should create a standard for what dollar amounts are significant to their business and establish some levels for Impact. Understanding the assets and functions involved, and the importance of confidentiality, integrity, and availability to the business is critical to getting good estimates of the real business impact. Reputation damage is frequently the driver here.

Impact Factors

The next set of factors are related to the impact to your business. The goal here is to estimate the likelihood of the particular vulnerability involved being identified and exploited. It's important to consider the totality of the circumstances here

Ease of discovery

How easy is it for this group of attackers to discover this vulnerability? Practically

Step 4: Tailoring and Weighting

The real tailoring comes from weighting these factors according to your business. Having a risk ranking framework that's customizable for a business is critical for adoption. Otherwise, you'll spend lots of time arguing about the risk ratings that are produced.

Step 5: Calculating the Overall Severity of a Risk

Based on the factors and weights, you calculate whether the likelihood is L, M, or H and whether the impact is L, M, or H. Then you can calculate the overall risk with a 9-box.

HIGH LIKELIHOOD

Medium
High
Critical

MEDIUM LIKELIHOOD

Low
Medium
High

LOW LIKELIHOOD

Note
Low
Medium


LOW IMPACT
MEDIUM IMPACT
HIGH IMPACT

If the list is okay with this approach, I will write it up in time for the release. I can imagine a simple tool that queries you for information like what are your different user groups, etc.. then the tool allows you to weight the factors, then it produces a custom risk rating tool for your organization's application security findings. Built into report generator this would be very cool.

Definitions

For the scope of the risk assessments of this guide the definitions for risk, threat and vulnerability are taken from the the Risk Management Guide for Information Technology Systems of NIST

• Risk is the probability that a particular threat will exercise a particular information system vulnerability and the resulting impact if this should occur.
• Threat is the potential to exercise (accidentally trigger or intentionally exploit) a specific vulnerability
• Vulnerability is a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy.

References

• NIST 800-30 Risk Management Guide for

Information Technology Systems [1]

• Industry standard vulnerability severity and risk rankings (CVSS[2])

• Security-enhancing process models vulnerability root cause categorization (CLASP [3])

• Microsoft Web Application Security Frame [4]

• Security In The Software Lifecycle from DHS [5]

• Threat Risk Modeling [6]

• TRIKE Threat Modeling Methodology [7]

• Pratical Threat Analysis [8]

• CORAS [9]
• SECURIS [10]
• T-MAP [11]

{{Category:OWASP Testing Project AoC}