Dyman Associates Risk Management : So You Think You Have a Point of Sale Terminal Problem?

If your company has a Point of Sale (POS) terminal anywhere in its infrastructure, you are no doubt aware from the active media coverage that malware attacks have been plaguing POS systems across the country.

Just within the past week, the New York Times has reported that:

§  Companies are often slow to disclose breaches, often because of the time involved in immediately-required investigations;

§  Congress is beginning to make inquiries of data breach victim companies; and

§  Even those companies who have conducted cybersecurity risk assessments still get attacked, often during the course of implementing new solutions to mitigate potential problems and protect their customers’ payment cards or other personal information.

§  Former employees can be a source of information to the media about your efforts to investigate and secure your POS systems.

No Quick Fix

Even the best intentions, most competent efforts and unlimited budgets cannot fix a problem such as this overnight.  These fixes take time, and have become an unavoidable symptom of having POS terminals.

What should your company do?

(1) Launch a cybersecurity risk assessment, if you have not yet done so.

(2) Protect your risk calculations by engaging outside counsel and qualified cybersecurity experts to provide legal risk advice protected by the attorney-client privilege.  Keep C-suite executives and Boards of Directors informed.  The outside counsel, together with experts, should:

§  educate and advise directors and executives on legal and business risks associated with your company’s particular threats and vulnerabilities;

§  engage a qualified, experienced external cybersecurity team to review technical infrastructure and identify vulnerabilities stratified and prioritized by risk, likelihood of being exploited, and costs and time involved in remedying each one;

§  review  operational procedures across a multi-disciplinary team in your company, which are often overlooked and can have the greatest impact on the overall health of your risk profile;

§  help identify the most sensitive categories of information in your organization and develop data governance procedures tailored to your organization to add yet another layer of protection for your most sensitive assets;

§  regularly remind your team members, including from your third-party vendors engaged by counsel, about privilege and confidentiality obligations.

(3) Treat cybersecurity risk assessments and remediation efforts as an iterative process.  Constantly review your multi-disciplinary team’s recommendations as they change week by week or day by day.  Re-evaluate the spend allocated based on updated information about your risk landscape as the investigation and assessment progresses.

(4) Stay informed about updated regulatory requirements and case law on cybersecurity and privacy.  Ensure stakeholders understand these updates and charge them with implementing appropriate changes in their domains.

(5) Recognize that there is no such thing as perfect security, but that there is a tipping point over which your company will move outside the category of high-risk operations and into a safe zone.

(6) Allocate the necessary resources to get the job done – and done well.  If your company goes an extra mile in building security policies, procedures and technology that are better than industry standard, you can use your low risk profile as a market differentiator.  In addition to reducing litigation and reputational risks, validated strong security will increase customer confidence and loyalty.

(7) Review your insurance policies for adequate coverage to address interim risks.  While reputational risk cannot be insured against, insurance can be very valuable in the event of a breach.

In the retail industry in particular, the widespread compromises in Point of Sale Terminals resulting in staggering amounts of payment card theft is a hallmark of 2014.   A decrease in brand reputation alone is too high a cost to ignore.   If your company is – very understandably – not equipped to tackle the daunting task of finding and prioritizing vulnerabilities and choosing the best cybersecurity governance and technical plans, find someone who is.

Dyman Associates Risk Management: eBay In Security Storm With Dangerous Flaw Wide Open

Auction site eBay has found itself in the midst of another security storm after apparently choosing to leave a security hole wide open – in the interests of user functionality – as customer details were being stolen.

It is the latest in a trio of serious cybersecurity problems at the company this year, following a database breach in May, and the theft of details from its StubHub ticket site customers two months later.

eBay allows highly visual JavaScript and Flash content to be included in its listings, which is a somewhat unsurprising step – however, the company reportedly knew for months that a number of hackers were manipulating this code for malicious content, and left the ability to add the code largely as it is, in the interests of offering sellers attractive auction listings.

Cyber criminals have been using the technology to introduce cross-site scripting (XSS) – in which customers are led to a fake, eBay-mimicking site to enter their payment details. At least 100 exploited listings have been identified by the BBC, which reports that the problems continue even though eBay may have been aware of them since February.

‘Not An Okay Situation’

Security experts have lambasted eBay’s handling of the problems. Chris Oakley, principal security consultant at testing firm Nettitude, says he would expect “all organizations, particularly those with vast quantities of customer data to protect” to have the required, standard cross site scripting defenses in place.

“This hat-trick of security incidents will surely do the company no favors in terms of restoring and maintaining consumer confidence,” adds Paul Ayers, European VP at data security vendor Vormetric, and Mikko Hypponen, chief research officer at security firm F-Secure, describes the situation as “not okay”. Independent expert Graham Cluley told The Drum website that eBay was not in “proper control” of the situation, which he described as “embarrassing”.

Solving The XSS Problem

Experts have proposed a number of solutions for eBay, including simply removing the harmful code or listings, or providing its own Javascript editor in which sellers’ code can be more easily managed and controlled.

Dr Adrian Davis, EMEA managing director at security organization (ISC)2, tellsForbes that XSS is a well known threat, adding that “we can’t afford to tolerate relatively simple security issues like this, especially for a company as massive as eBay”.

Sites with the issue “need to update their current code to remove the vulnerability”, he says. “Functionality for the user would not be impaired, providing the code running in the browser and application is written properly.”

He warns that developers need to be much better trained to write secure code and not focus solely on usability, with “fully qualified and certified individuals, such as those holding (ISC)2’s CISSP or CSSLP” qualifications being involved “throughout the entire process”.

“This is an issue that must rise above the purely technical considerations and go onto the agendas of management and business leaders that are driving the development projects. Only then would we see investment in curbing incidents like these.”

Act Much More Quickly

Randy Gross, chief information officer at industry association CompTIA, says that it is “always difficult” for organizations to strike the right balance between security and convenience. But he adds: “With financial transactions, especially given recent high profile attacks, the pendulum needs to swing hard back toward security and give consumers the confidence their information is secure.”

Fayaz Khaki, an associate director of information security at IDC, adds in aForbes email interview that it is always difficult for large and complex sites, such as eBay, to be completely XSS free. “However, once an XSS vulnerability has been identified the organization must act quickly to remove the vulnerability”, even if it means removing a listing.

Active content such as Javascript, he says, should only be used where completely necessary, and regular monitoring and vulnerability assessments ought to be carried out to minimize risk.

“XSS vulnerabilities have existed for a number of years and really companies such as eBay, that came into existence solely as an internet organization, should be on top of these types of vulnerabilities and should have the capability to identify and mitigate these vulnerabilities very quickly.”

eBay said in a statement that cross site scripting risks exist across the internet, and that it has “hundreds” of engineers and security experts who collaborate with researchers to make its own site both usable and safe.

It added: “We have no current plans to remove active content from eBay. However, we will continue to review all site features and content in the context of the benefit they bring our customers, as well as overall site security.”

Criminals behind cross site scripting and phishing activity adapt their code and tactics “to try to stay ahead of the most sophisticated security systems”, it said. “Cross site scripting is not allowed on eBay and we have a range of security features designed to detect and then remove listings containing malicious code.”

Dyman Associates Risk Management Study: Mobile Health Apps Need Risk Assessment, Framework

Mobile health applications need a risk assessment model and a framework for supporting clinical use to ensure patient safety and professional reputation, according to a study published in the Journal of Medical Internet Research,  FierceHealthIT reports.

Study Details

For the study, researchers at Warwick Medical School in the United Kingdom analyzed the current regulatory oversight of mobile apps and identified several different kinds of risks associated with medical apps and ways to address those risks (Mottl, FierceHealthIT, 9/20).

The researchers defined a mobile medical app as "any software application created for or used on a mobile device for medical or other health-related purposes."

Study Findings

The researchers noted that there is not currently a clinically relevant risk assessment framework for mobile health apps, meaning health care professionals, patients and mobile app developers face difficulty in assessing the risks posed by specific apps.

They identified several risks associated with using mobile health apps, including:

• ·         Hindering professional reputation;
• ·         Causing possible patient privacy breaches;
• ·         Resulting in low-quality; and
• ·         Providing Poor medical advice.

The authors also outlined some of the most common variables that can affect those risk factors, including:

• ·         Apps that contain inaccurate or out-of-date information;
• ·         Inappropriate use by patients; and
• ·         Inadequate user education (Lewis et al., Journal of Medical Internet Research, 9/15/14).

Of those, the researchers warned that a lack of education poses the biggest threat to patient safety and recommended that health care professionals begin learning about the apps' risks before prescribing their use to patients.

Overall, the study's authors called for a formal risk assessment framework for mobile health apps to help reduce the "residual risk" by identifying and implementing various safety measures in the future development, procurement and regulation of mobile apps. They argued that medical apps will flourish in the health care industry after a process has been created to ensure their quality and safety can be "reliably assessed and managed" (FierceHealthIT, 9/20).

Dyman Associates Risk Management: A Mobility Checkup

I recently attended the Healthcare Innovation Challenge where I met some customers and took a look at various healthcare IT challenges and innovations. I came away with a couple of strong impressions about the role of mobility in healthcare, in addition to some best practices for healthcare companies to follow.

First, it was exciting to see how integrated mobility is with the core mission of many of the companies, and how important it has become for healthcare workers to be untethered from a PC or workstation. For example, a medical scanning and data collection company can now run its scanners from a remote location using tablets, which has increased safety by enabling technicians to review data in real-time without being in the same room as the diagnostic equipment. Tablets have also increased efficiency and productivity by enabling fewer technicians to monitor multiple scanners, and the touch user interface—swiping and pinching to analyze the scans, for example—is far preferable to traditional mouse clicks.

Another company provides brain exercises—in the form of role-playing games—for patients who have experienced brain trauma. The games are played exclusively on tablets, offering more flexibility for patients and providing a familiar, effective and fun user interface that encourages usage.

Many companies at the event made it clear that they still face major challenges to mobility. HIPAA and other privacy regulations require every mobile strategy involving patient data to meet stringent requirements. Is patient data stored on a device? How is it secured? Can non-authorized users access private information? Can the compliance of the device be validated?

In developing a security strategy for their mobile devices, healthcare companies struggle with choosing among various options, including a secure workspace and virtualization. Virtualization stores no information on the device, while a secure workspace stores data on the device in a protected container, which IT can wipe (though not a user’s personal information) if necessary. Fortunately, organizations aren’t limited to one path—many use both solutions for users with different risk profiles.

Another difficulty for many healthcare providers is that tech-savvy workers, especially doctors and nurses, are driving the demand for mobility, putting significant pressure on IT to move more rapidly than they otherwise would

So how can healthcare companies overcome these challenges? Consider these simple best practices:

·         Map out all your different use cases—including what users want—and study the available technologies. Then choose the mix of solutions that satisfies your needs.

·         Don’t consider just today’s use cases. Anticipate future innovations. For example, some devices already have built­-in heart-rate monitors. Other biometric capabilities coming to devices include identifying fingerprints, faces, voices and irises. To keep progressing on your mobility journey, track the technologies in development and plan for how to integrate them into your workflows.

·         Don’t fall into the trap of feeling that you can’t deal with the explosion of new capabilities. By focusing on users and workflows, you can look at every new capability as an opportunity to improve productivity, drive down costs and improve the ways healthcare is delivered.

Read more related Dyman Associates Risk Management

Dyman Associates Risk Management: what is Risk Management

The Importance of Risk Management to Business Success

Risk management is an important part of planning for businesses. The process of risk management is designed to reduce or eliminate the risk of certain kinds of events happening or having an impact on the business.

Definition of Risk Management

Risk management is a process for identifying, assessing, and prioritizing risks of different kinds. Once the risks are identified, the risk manager will create a plan to minimize or eliminate the impact of negative events. A variety of strategies is available, depending on the type of risk and the type of business. There are a number of risk management standards, including those developed by the Project Management Institute, the International Organization for Standardization (ISO), the National Institute of Science and Technology, and actuarial societies.

Types of Risk

There are many different types of risk that risk management plans can mitigate. Common risks include things like accidents in the workplace or fires, tornadoes, earthquakes, and other natural disasters. It can also include legal risks like fraud, theft, and sexual harassment lawsuits. Risks can also relate to business practices, uncertainty in financial markets, failures in projects, credit risks, or the security and storage of data and records.

Goals of Risk Management

The idea behind using risk management practices is to protect businesses from being vulnerable. Many business risk management plans may focus on keeping the company viable and reducing financial risks. However, risk management is also designed to protect the employees, customers, and general public from negative events like fires or acts of terrorism that may affect them. Risk management practices are also about preserving the physical facilities, data, records, and physical assets a company owns or uses.

Process for Identifying and Managing Risk

While a variety of different strategies can mitigate or eliminate risk, the process for identifying and managing the risk is fairly standard and consists of five basic steps. First, threats or risks are identified. Second, the vulnerability of key assets like information to the identified threats is assessed. Next, the risk manager must determine the expected consequences of specific threats to assets. The last two steps in the process are to figure out ways to reduce risks and then prioritize the risk management procedures based on their importance.

Strategies for Managing Risk

There are as many different types of strategies for managing risk as there are types of risks. These break down into four main categories. Risk can be managed by accepting the consequences of a risk and budgeting for it. Another strategy is to transfer the risk to another party by insuring against a particular, like fire or a slip-and-fall accident. Closing down a particular high-risk area of a business can avoid risk. Finally, the manager can reduce the risk's negative effects, for instance, by installing sprinklers for fires or instituting a back-up plan for data.

Having a risk management plan is an important part of maintaining a successful and responsible company. Every company should have one. It will help to protect people as well as physical and financial assets.

Dyman Associates Risk Management Approach and Plan

Dyman Associates Risk Management – As a management process, risk management is used to identify and avoid the potential cost, schedule, and performance/technical risks to a system, take a proactive and structured approach to manage negative outcomes, respond to them if they occur, and identify potential opportunities that may be hidden in the situation [4]. The risk management approach and plan operationalize these management goals.

Because no two projects are exactly alike, the risk management approach and plan should be tailored to the scope and complexity of individual projects. Other considerations include the roles, responsibilities, and size of the project team, the risk management processes required or recommended by the government organization, and the risk management tools available to the project.

Risk occurs across the spectrum of government and its various enterprises, systems-of-systems, and individual systems. At the system level, the risk focus typically centers on development. Risk exists in operations, requirements, design, development, integration, testing, training, fielding, etc. (see the SE Life-Cycle Building Blocks section of this Guide). For systems-of-systems, the dependency risks rise to the top. Working consistency across the system-of-systems, synchronizing capability development and fielding, considering whether to interface, interoperate, or integrate, and the risks associated with these paths all come to the forefront in the system-of-systems environment. At the enterprise level, governance and complexity risks become more prominent. Governance risk of different guidance across the enterprise for the benefit of the enterprise will trickle down into the system-of-systems and individual systems, resulting in potentially unanticipated demands and perhaps suboptimal solutions at the low level that may be beneficial at the enterprise level. Dealing with the unknowns increases and the risks associated with these——techniques in the Guide's section on Enterprise Engineering, such as loose couplings, federated architectures, and portfolio management——can help the MITRE SE alleviate these risks.

Risk Management in System-Level Programs

System-level risk management is predominantly the responsibility of the team working to provide capabilities for a particular development effort. Within a system-level risk area, the primary responsibility falls to the system program manager and SE for working risk management, and the developers and integrators for helping identify and create approaches to reduce risk. In addition, a key responsibility is with the user community's decision maker onwhen to accept residual risk after it and its consequences have been identified. The articles in the Risk Management topic area provide guidance for identifying risk (Risk Identification), mitigating risks at the system level with options like control, transfer, and watch (Risk Mitigation Planning, Implementation, and Progress Monitoring), and a program risk assessment scale and matrix (Risk Impact Assessment and Prioritization). These guidelines, together with MITRE SEs using tools such as those identified in the Risk Management Tools article, will help the program team deal with risk management and provide realism to the development and implementation of capabilities for the users.

Risk Management in System-of-Systems Programs

Today, the body of literature on engineering risk management is largely aimed at addressing traditional engineering system projects—those systems designed and engineered against a set of well-defined user requirements, specifications, and technical standards. In contrast, little exists on how risk management principles apply to a system whose functionality and performance is governed by the interaction of a set of highly interconnected, yet independent, cooperating systems. Such systems may be referred to as systems-of-systems.

A system-of-systems can be thought of as a set or arrangement of systems that are related or interconnected to provide a given capability that, otherwise, would not be possible. The loss of any part of the supporting systems degrades or, in some cases, eliminates the performance or capabilities of the whole.

What makes risk management in the engineering of systems-of-systems more challenging than managing risk in a traditional system engineering project? The basic risk management process steps are the same. The challenge comes from implementing and managing the process steps across a large-scale, complex, system-of-systems—one whose subordinate systems, managers, and stakeholders may be geographically dispersed, organizationally distributed, and may not have fully intersecting user needs.

How does the delivery of capability over time affect how risks are managed in a system-of-systems? The difficulty is in aligning or mapping identified risks to capabilities planned to be delivered within a specified build by a specified time. Here, it is critically important that risk impact assessments are made as a function of which capabilities are affected, when these effects occur, and their impacts on users and stakeholders.

Lack of clearly defined system boundaries, management lines of responsibility, and accountability further challenge the management of risk in the engineering of systems-of-systems. User and stakeholder acceptance of risk management, and their participation in the process, is essential for success.

Given the above, a program needs to establish an environment where the reporting of risks and their potential consequences is encouraged and rewarded. Without this, there will be an incomplete picture of risk. Risks that threaten the successful engineering of a system-of-systems may become evident only when it is too late to effectively manage or mitigate them.

Frequently a system-of-systems is planned and engineered to deliver capabilities through a series of evolutionary builds. Risks can originate from different sources and threaten the system-of-systems at different times during their evolution. These risks and their sources should be mapped to the capabilities they potentially affect, according to their planned delivery date. Assessments should be made of each risk's potential impacts to planned capabilities, and whether they have collateral effects on dependent capabilities or technologies.

In most cases, the overall system-of-systems risk is not just a linear "roll-up" of its subordinate system-level risks. Rather, it is a combination of specific lower level individual system risks that, when put together, have the potential to adversely impact the system-of-systems in ways that do not equate to a simple roll-up of the system-level risks. The result is that some risks will be important to the individual systems and be managed at that level, while others will warrant the attention of system-of-systems engineering and management.

Read full Article

Dyman Associates Risk Management on How to Develop a Risk Management Plan

Developing an effective Risk Management Plan can help keep small issues from developing into emergencies. Different types of Risk Management Plans can deal with calculating the probability of an event, and how that event might impact you, what the risks are with certain ventures and how to mitigate the problems associated with those risks. Having a plan may help you deal with adverse situations when they arise and, hopefully, head them off before they arise.

Steps

1. Understand how Risk Management works. Risk is the effect (positive or negative) of an event or series of events that take place in one or several locations. It is computed from the probability of the event becoming an issue and the impact it would have (See Risk = Probability X Impact). Various factors should be identified in order to analyze risk, including:

Event: What could happen?

Probability: How likely is it to happen?

Impact: How bad will it be if it happens?

Mitigation: How can you reduce the Probability (and by how much)?

Contingency: How can you reduce the Impact (and by how much)?

Reduction = Mitigation X Contingency

Exposure = Risk – Reduction

2. Define your project. In this article, let's pretend you are responsible for a computer system that provides important (but not life-critical) information to some large population. The main computer on which this system resides is old and needs to be replaced. Your task is to develop a Risk Management Plan for the migration

3. Get input from others. Brainstorm on risks. Get several people together that are familiar with the project and ask for input on what could happen, how to help prevent it, and what to do if it does happen. Take a lot of notes! You will use the output of this very important session several times during the following steps. Try to keep an open mind about ideas.

4. Identify the consequences of each risk. From your brainstorming session, you gathered information about what would happen if risks materialized. Associate each risk with the consequences arrived at during that session. Be as specific as possible with each one. "Project Delay" is not as desirable as "Project will be delayed by 13 days."

5. Eliminate irrelevant issues. If you’re moving, for example, a car dealership’s computer system, then threats such as nuclear war, plague pandemic or killer asteroids are pretty much things that will disrupt the project. There’s nothing you can do to plan for them or to lessen the impact.

6. List all identified risk elements. You don’t need to put them in any order just yet. Just list them one-by-one.

7. Assign probability. For each risk element on your list, determine if the likelihood of it actually materializing is High, Medium or Low. If you absolutely have to use numbers, then figure Probability on a scale from 0.00 to 1.00. 0.01 to 0.33 = Low, 0.34 to 0.66 = Medium, 0.67 to 1.00 = High.

8. Assign impact. In general, assign Impact as High, Medium or Low based on some pre-established guidelines. If you absolutely have to use numbers, then figure Impact on a scale from 0.00 to 1.00 as follows: 0.01 to 0.33 = Low, 0.34 – 066 = Medium, 0.67 – 1.00 = High.

9. Determine risk for the element. Often, a table is used for this. If you have used the Low, Medium and High values for Probability and Impact, the top table is most useful. If you have used numeric values, you will need to consider a bit more complex rating system similar to the second table here. It is important to note that there is no universal formula for combining Probability and Impact; that will vary between people and projects.

10. Rank the risks. List all the elements you have identified from the highest risk to the lowest risk.

11. Compute the total risk: Here is where numbers will help you. In Table 6, you have 7 risks assigned as H, H, M, M, M, L, and L. This can translate to 0.8, 0.8, 0.5, 0.5, 0.5, 0.2 and 0.2, from Table 5. The average of the total risk is then 0.5 and this translates to Medium.

12. Develop mitigation strategies. Mitigation is designed to reduce the probability that a risk will materialize. Normally you will only do this for High and Medium elements. You might want to mitigate low risk items, but certainly address the other ones first. For example, if one of your risk elements is that there could be a delay in delivery of critical parts, you might mitigate the risk by ordering early in the project

13. Develop contingency plans. Contingency is designed to reduce the impact if a risk does materialize. Again, you will usually only develop contingencies for High and Medium elements.

14. Analyze the effectiveness of strategies. How much have you reduced the Probability and Impact?

15. Compute your effective risk. Now your 7 risks are M, M, M, L, L, L and L, which translate to 0.5, 0.5, 0.5, 0.2, 0.2, 0.2 and 0.2. This gives an average risk of 0.329.

16. Monitor your risks. Now that you know what your risks are, you need to determine how you’ll know if they materialize so you’ll know when and if you should put your contingencies in place. This is done by identifying Risk Cues. Do this for each one of your High and Medium risk elements.