OWASP Risk Rating Methodology

[Up]

OWASP Testing Guide v2 Table of Contents

Overview

Discovering vulnerabilities is important, but just as important is being able to estimate the associated risk to the business. Of course, a vulnerability that is critical to one organization may not be very important to another. But having a standard way of rating vulnerabilities within an organization is extremely important. A risk rating standard allows security issues to be prioritized, so that an organization can make informed decisions about where to focus security investments.

Approach

There are many different approaches to risk analysis. Here are some of the common methodologies.

• NIST 800-30
• OCTAVE
• ...

The OWASP approach is based on these standard methodologies and is customized for application security. This approach builds on the standard risk model:

      Risk = Likelihood * Impact

In the sections below, we break down the factors that make up "likelihood" and "impact". Organizations can customize and weight these factors to create their own standard for rating risks.

Step 2: Estimating Likelihood

Likelihood factors generally break down into information about the threat agent, and information about the vulnerability:

- Threat agent

o Skill level required

o Threat agent motivation (attractiveness of target)

o Threat agent access level

o Threat agent size

o …

- Vulnerability

o Ease of discovery

o Awareness

o Tools available

o Mitigating controls in place

o Accountability (not logged, logged w/o review, logged and reviewed)

o …

Step 3: Estimating Impact

Impact is generally calculated based on annualized loss expectancy (ALE). Businesses should create a standard for what dollar amounts are significant to their business and establish some levels for Impact. Understanding the assets and functions involved, and the importance of confidentiality, integrity, and availability to the business is critical to getting good estimates of the real business impact. Reputation damage is frequently the driver here.

Since none of these factors are very easy to measure, it's best to have enumerated lists (like accountability above) for each factor that make sense for the particular business.

The real tailoring comes from weighting these factors according to your business. Having a risk ranking framework that's customizable for a business is critical for adoption. Otherwise, you'll spend lots of time arguing about the risk ratings that are produced.

Based on the factors and weights, you calculate whether the likelihood is L, M, or H and whether the impact is L, M, or H. Then you can calculate the overall risk with a 9-box.

                                                           OVERALL SEVERITY

HIGH LIKELIHOOD

Medium
High
Critical

MEDIUM LIKELIHOOD

Low
Medium
High

LOW LIKELIHOOD

Note
Low
Medium


LOW IMPACT
MEDIUM IMPACT
HIGH IMPACT

If the list is okay with this approach, I will write it up in time for the release. I can imagine a simple tool that queries you for information like what are your different user groups, etc.. then the tool allows you to weight the factors, then it produces a custom risk rating tool for your organization's application security findings. Built into report generator this would be very cool.

Definitions

For the scope of the risk assessments of this guide the definitions for risk, threat and vulnerability are taken from the the Risk Management Guide for Information Technology Systems of

• Risk is the probability that a particular threat will exercise a particular information system vulnerability and the resulting impact if this should occur.
• Threat is the potential to exercise (accidentally trigger or intentionally exploit) a specific vulnerability
• Vulnerability is a flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy.

• Regulatory and requirements compliance
• Tactical prioritization for mitigation of vulnerabilities (e.g. high risk first)
• Risk strategy selection

References

• NIST 800-30 Risk Management Guide for

Information Technology Systems [1]

• Industry standard vulnerability severity and risk rankings (CVSS[2])

• Security-enhancing process models vulnerability root cause categorization (CLASP [3])

• Microsoft Web Application Security Frame [4]

• Security In The Software Lifecycle from DHS [5]

Threat modeling tools

• DREAD [6]
• TRIKE [7]
• PTA [8]
• CORAS [9]
• SECURIS [10]
• T-MAP [11]

{{Category:OWASP Testing Project AoC}