In this lesson,
we'll discuss the threat model, OCTAVE,
which stands for
Operationally Critical Threat, Asset,
and Vulnerability Evaluation.
This approach was developed
by Carnegie Mellon University's
Software Engineering Institute.
OCTAVE isn't just another threat modeling technique;
it's a framework designed to spotlight
and manage organizational risk, not just the technical ones.
This method is perfect for our small
to medium-sized organizations
and focuses heavily on operational impacts,
like those from data breaches
rather than just faulty technology.
OCTAVE empowers organizations with a self-directed approach,
enabling them to actively shape their security assessments
without the need for extensive external consulting.
This method, again, is particularly beneficial
for small to medium-sized organizations
which might not have large, dedicated security teams.
By allowing internal management and operations teams
to lead the assessment,
OCTAVE encourages organizations to take ownership
of their security strategies,
which would allow them to integrate it
within their business operations.
OCTAVE uniquely combines organizational insights
with technological assessments
to form a full picture of security risks.
It's structured around three main phases
which are one, Build Enterprise-Wide Security Requirements;
two, Identify Infrastructure Vulnerabilities;
and three, Determine Security Risk Management Strategies.
These are also further divided into eight processes.
In the first phase of OCTAVE,
Build Enterprise-Wide Security Requirements,
organizations develop asset-based threat profiles,
identifying and cataloging a range of assets
from physical devices to intangible elements
like the company's reputation.
The phase begins with process one,
Identify Enterprise Knowledge,
where senior managers contribute their insights
on key assets, discussing their value,
the thrust they face, associated risk indicators
and the current protection strategies.
This forms the foundational understanding
of what the organization prioritizes
in its current state of security.
Next in process two,
which is Identify Operational Area Knowledge,
the focus shifts to operational area managers
to capture their perspectives
on what constitutes key assets and threat.
This provides a middle-management point of view
on security and risk, detailing how these assets
are currently protected as well.
Then in process three, Identify Staff Knowledge.
The perspective broadens to include staff-level input,
gathering insights from the frontline
and operational staff, on similar key areas,
which enhances the understanding of security
across all organizational levels.
In the fourth phase, Establish Security Requirements,
the information from these processes
are combined to develop a comprehensive,
enterprise-wide view of assets, threats,
protection strategies, and security requirements.
This process aligns different organizational perspectives
into one combined strategy.
Moving on to the second phase,
which is Identify Infrastructure Vulnerabilities.
Here, we'll conduct a detailed evaluation
of the infrastructure supporting these assets
to uncover any existing vulnerabilities
that could be exploited.
And process number five,
Map High-Priority Information Assets
to Information Infrastructure,
the organization begins using the compiled asset
and threat information
to map high-priority infrastructure components.
This process identifies how these assets interact
with the organization's physical and digital infrastructure.
It then moves on to process six,
Perform Infrastructure Vulnerability Evaluation,
which integrates insights from the initial phase
with additional evaluations of the infrastructure,
identifying missing policies, practices, and vulnerabilities
that could pose risks to the organization.
This proactive assessment helps businesses match
their most significant vulnerabilities
with corresponding threats,
setting a stage for targeted risk management.
By integrating these findings
with the initial phases insights,
the company can prioritize its vulnerabilities
based on the potential impact
and likelihood of associated risk.
For instance, the outdated SCADA software
is a critical vulnerability
because it controls essential production processes,
and an attack on this system could disrupt operations
and cause significant financial loss.
Weak password policies and unpatched systems
could be exploited by attackers
to gain access to sensitive data or systems.
The lack of network segmentation and insufficient monitoring
are systematic issues that could allow an attacker
to move laterally within the network and remain undetected.
The third phase,
Determine Security Risk Management Strategy,
focuses on creating a customized security plan
to address identified risk.
This includes detailing specific mitigation practices,
setting timelines for implementation,
and assigning the responsibilities.
For example, if outdated software is identified
as a vulnerability, the strategy might include updating it
to the latest version to fix a known security flaw,
setting a deadline of two weeks for completion,
and assigning the IT department
to carry out this particular task.
Now, this begins process seven,
which is Conduct Multi-Dimensional Risk Analysis.
Here, data from the first two phases
is used to analyze potential risk
by examining break-in scenarios, asset vulnerabilities,
and threat likelihood.
For instance, if an intrusion scenario
involves a phishing attack,
the analysis will look at how vulnerable
the organization's email systems are,
and the likelihood of such attack occurring.
Risks are then prioritized
based on their impact and probability,
such as prioritizing a phishing attack
that could compromise sensitive customer data
over a less likely physical security breach.
And finally, in process eight,
Develop Protection Strategy.
Organization creates a strategic plan
to mitigate and prioritize risk.
This includes selecting
the appropriate mitigation strategies
and crafting a risk management plan.
For instance, if phishing is at the top of the list,
the protection strategy might involve implementing
multi-factor authentication (MFA)
to reduce the likelihood of account compromised.
Also, we can conduct employee training
on recognizing phishing attempts,
and we can also set up email filters
to block suspicious emails.
This strategic plan ensures continuous risk assessment
and mitigation,
keeping the organization prepared for evolving threats.
So remember, OCTAVE stands out
for its comprehensive and integrated approach.
It includes three phases and eight processes,
that further emphasizes understanding a full spectrum
of organizational risks
and not just technical vulnerability.
It combines insights from all levels of the organization-
from senior management to operational staff-
to develop security strategies that are aligned
within the organizational goals and operations.
This method fosters a culture of proactive risk management
and enhances security awareness across all the departments,
ensuring that security considerations
become an integral part of decision-making process
By involving various organizational sectors
in the assessment and strategy development,
OCTAVE creates a balance and effective security posture
that is not only adaptable, but very sustainable.