Model-Driven Risk Analysis: The CORAS Approach

458 Pages·2011·15.827 MB·English

by  Mass Soldal Lund, Bjørnar Solhaug, Ketil Stølen (auth.)

Model-Driven Risk Analysis
Mass Soldal Lund (cid:2) Bjørnar Solhaug (cid:2) Ketil Stølen
Model-Driven
Risk Analysis
The CORAS Approach
MassSoldalLund
BjørnarSolhaug
KetilStølen
SINTEFICT
P.O.box124Blindern
0314Oslo
Norway
[email protected]
[email protected]
[email protected]
ISBN978-3-642-12322-1 e-ISBN978-3-642-12323-8
DOI10.1007/978-3-642-12323-8
SpringerHeidelbergDordrechtLondonNewYork
LibraryofCongressControlNumber:2010936190
ACMComputingClassification(1998):K.6,D.2.9
©Springer-VerlagBerlinHeidelberg2011
Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis
concerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation,broadcasting,
reproductiononmicrofilmorinanyotherway,andstorageindatabanks.Duplicationofthispublication
orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,
1965,initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer.Violations
areliabletoprosecutionundertheGermanCopyrightLaw.
Theuseofgeneraldescriptivenames,registerednames,trademarks,etc.inthispublicationdoesnot
imply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevantprotective
lawsandregulationsandthereforefreeforgeneraluse.
Coverdesign:KünkelLopkaGmbH,Heidelberg
Printedonacid-freepaper
SpringerispartofSpringerScience+BusinessMedia(www.springer.com)
Preface
Exposure to risk is inescapablein most domains.Peopleand families, enterprises,
governments, private and public organisations, infrastructure providers, service
providers, and so forth all encounter risks on an ongoing and frequent basis. The
kindsofriskshowevervaryfromdomaintodomain,beitsafety,economy,informa-
tionandICT security,politics,civilprotection,emergencyplanning,defence,law,
health, and so on. The need for understanding and managing risk is self-evident.
Risk management is moreover in many cases imposed as a prerequisite, be it by
law and legal regulations or from the public opinion, in particular within critical
areas that may affect privacy and welfare, or even health and human life. In other
cases,thelackofgoodroutines,culturesandprocessesformanagingriskmaybea
decisivefactorforriskstoemergethatshouldorcouldhavebeenavoided.
Inthisbook,wepresentCORAS,whichisamodel-drivenapproachtoriskanal-
ysis.Riskanalysisisacorepartoftheoverallprocessofriskmanagement.Inorder
toconductriskanalysisinpractice,thereisclearlyaneedforwell-definedmethods,
techniques and guidelines for how to do this, and this is precisely what CORAS
offers.Riskanalysts,orforthatmatteranyonewithaneedforidentifyingandun-
derstanding risks, will in this book find guidance on how to conduct a stepwise,
structuredandsystematicanalysisanddocumentationofrisks.
Thebookalsoservesasanintroductiontoriskanalysisingeneral,andasanin-
troductiontothecentralandwell-establishedunderlyingconceptsandterminology.
Practitioners,aswellasgraduateorundergraduatestudents,particularlywithinthe
ITdomain,arethereforemaintargetgroupsofthisbook.CORASisstronglyrelated
tointernationalstandardsonriskmanagement,andthisbookthereforeservesasan
introductiontomanyoftheissuesthatareaddressedinthesestandards.
Animportantobjectiveofthisbookistoaccompanystandardisedriskmanage-
ment guidelines and terminology with comprehensive pragmatic support. Interna-
tionalstandardsgenerallyfocusonthewhat,butsaylittleornothingaboutthehow.
This book is a self-contained contribution not only to understand what risk man-
agement,riskanalysisandriskrelatedconceptsare,butalsotolearnhowtodorisk
analysisinpractice.Extensiveuseofpracticalandillustrativeexamplesfurthermore
facilitatesadeepunderstandingofboththepragmaticsandtheconceptualaspects.
v
vi Preface
The comprehensiveness of CORAS is manifested by the three complementary
parts of the approach. CORAS consists of a customised language for risk mod-
elling, a tool supporting the language, and a risk analysis method into which the
tool-supported risk modelling language is tightly interwoven. It is particularly the
specialised support for risk modelling that distinguishes CORAS from other ap-
proaches to risk analysis. The CORAS language provides explicit support for the
risk analysis steps and tasks, and is furthermore closely related to the underlying
riskanalysisconcepts.
TheCORASapproachaspresentedinthisbookistheresultofworkthatwasini-
tiatedin2001,andthatdrawsuponacademicresearch,empiricalstudies,thorough
experience, as well as close interaction and cooperation with actors from several
industrial domains. Along the way, we have benefited greatly from fruitful coop-
erationwithmanycolleagues,andmuchworkondifferentaspectsofCORAShas
alreadybeenpublishedinarticles,papers,reportsanddoctoraltheses.Severalcol-
leagueshavealsocontributedtothisbookbycoauthoringsomeofthechapters,or
by giving valuable criticism, suggestions and feedback, and for this we owe them
greatthanks.
We are deeply grateful to Ida Hogganvik Grøndahl for her influential doctoral
work.ManyaspectsoftheCORASapproachaspresentedinthisbookarestrongly
inspiredbyherwork,inparticularthebasicCORASlanguage.
WeoweourgreatthankstoGyrdBrændeland,AtleRefsdalandFredrikSeehusen
foreachcoauthoringachapterinthisbook,andfortheirvaluablesuggestionsand
comments.FredrikSeehusenhasmoreovercontributedbybeingthemaindeveloper
ofthecurrentversionoftheCORAStool.ManythanksalsotoFolkerdenBraber,
HeidiDahlandFredrikVraalsenfortheircontributionsoverthepastyears,andto
OlavLigaardenforhelpinguswiththeindexandformakingvaluablesuggestions.
ManythankstoTobiasMahlerforhismanycommentsandfruitfulcriticism,in
particularonthechapteronlegalaspects.Hisdoctoralworkonlegalriskmanage-
mentservedasavaluablesourceofinspiration,andweacknowledgethesynergies
betweenhisworkandtheworkthathasledtothisbook.
We are thankful to Jan Øyvind Aagedal, Iselin Engan, Bjørn Axel Gran, Jan
Heim,SivHildeHoumb,TormodHåvaldsrud,TomLysemose,AidaOmerovic,Eva
SkipnesandJanHåvardSkjetne,eachofwhichhascontributedbyvaluablesugges-
tionsorviafruitfulcooperationinCORASrelatedwork.
We are thankful to our colleagues at SINTEF ICT, including our Head of De-
partmentBjørnSkjellaug.Manythanksalsotothecolleaguesthatwehaveworked
withinseveralnationalandinternationalprojectsthathavebeenrelatedtoCORAS.
ThesepeopleincludeDemissieAredo,GustavDahll,TheoDimitrakos,IvanDjord-
jevic,RuneFredriksen,ChingwoeiGan,EvaHenriksen,ErikMorkKnutsen,Mon-
ica Kristiansen, Simon Lambert, Katerina Papadaki, Xavier Parent, Athanasios
Poulakidas, Dimitris Raptis, Brian Ritchie, Yannis Stamatiou, Nikos Stathiakis,
AtoosaThunem,ErikWisløffandBjarteØstvold.
Wealsorecognisethevaluablefeedbackandknowledgeacquiredfrommanyin-
dustrial field trials and commercial risk analyses based on CORAS. In relation to
this,wewouldliketothankTorAalborg,SemmingAustin,NilsIngeBrubrerg,Pet-
terChristensen,StenVidarEikrem,HåvardFridheim,AreTorsteinGimnes,David
Preface vii
Goldby, Janne Hagen, Rune Hagen, Tor-Gaute Indstøy, Hege Jacobsen, Ole Jarl
Kvammen, Arne Bjørn Mildal, Per Myrseth, Mikkel Skou, Petter Taugbøl, Anne
KarinWahlfjord,HermannSteenWienckeandJonØlnes.
WearealsoindebttothemanystudentswhohavefollowedourcourseINF5150
attheUniversityofOslosinceitwasstartedupin2001,aswellasthetotheMSc
students who have addressed various aspects of CORAS in their thesis work. In
particular, we would like to thank Emese L. Bogya, Jenny Beate Haugen, Vikash
Katta,IgorKodrik,MihailKorabelnikov,StigTorsbakken,andShahbazChaudhary
Yaqub.
Our work on developing the CORAS approach has benefited from research in
joint projects with a number of good partners. The initial CORAS approach was
developedwithintheCORASprojectfundedbytheEuropeanCommissionthatran
from2001until2003.WearethankfultotheprojectcoordinatorYvesPaindaveine,
aswellastheprojectleadersTomArthurOpperudandTonyPrice,forprovidinga
goodenvironmentforfruitfulresearch.WearealsogratefultoHabtamuAbiewho
togetherwithEvaSkipnesin1999invitedustojointheconsortiumthatlaterstarted
theCORASproject.
Someoftheresearchresultsthatisreportedinthisbookhaspartlybeenfunded
bytheResearchCouncilofNorwaythroughtheprojectsCOBRA,COMA,DIGIT,
EMERGENCY, ENFORCE and SECURIS. The research has also partly been
fundedbytheEuropeanCommissionthroughtheprojectsiTrust,MASTER,MOD-
ELWARE,SecureChange,S3MSandTrustCoM.
Oslo,Norway MassSoldalLund
BjørnarSolhaug
KetilStølen
Contents
PartI IntroductoryOverview
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1 TheImportanceofRiskAnalysis . . . . . . . . . . . . . . . . . . 3
1.2 AssetIdentification . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.3 RiskModelling . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.4 TheCORASApproach . . . . . . . . . . . . . . . . . . . . . . . 5
1.4.1 TheCORASLanguage . . . . . . . . . . . . . . . . . . . 6
1.4.2 TheCORASTool . . . . . . . . . . . . . . . . . . . . . . 6
1.4.3 TheCORASMethod . . . . . . . . . . . . . . . . . . . . 6
1.5 TheGeneralityofCORAS . . . . . . . . . . . . . . . . . . . . . . 7
1.6 OverallAimandEmphasis . . . . . . . . . . . . . . . . . . . . . 8
1.7 Organisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.7.1 PartI:IntroductoryOverview . . . . . . . . . . . . . . . . 9
1.7.2 PartII:CoreApproach. . . . . . . . . . . . . . . . . . . . 9
1.7.3 PartIII:SelectedIssues . . . . . . . . . . . . . . . . . . . 11
1.7.4 Appendices . . . . . . . . . . . . . . . . . . . . . . . . . 12
1.8 ColoursinCORASandinthisBook . . . . . . . . . . . . . . . . 13
2 BackgroundandRelatedApproaches. . . . . . . . . . . . . . . . . . 15
2.1 BasicTerminology . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2 RelatedApproaches . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2.1 RiskAnalysisMethods . . . . . . . . . . . . . . . . . . . 17
2.2.2 Table-basedRiskAnalysisTechniques . . . . . . . . . . . 18
2.2.3 Tree-basedRiskAnalysisTechniques . . . . . . . . . . . . 18
2.2.4 Graph-basedRiskAnalysisTechniques . . . . . . . . . . . 19
2.2.5 SituatingCORASWithinthisPicture . . . . . . . . . . . . 20
3 AGuidedTouroftheCORASMethod . . . . . . . . . . . . . . . . . 23
3.1 PreparationsfortheAnalysis . . . . . . . . . . . . . . . . . . . . 23
3.2 CustomerPresentationoftheTarget . . . . . . . . . . . . . . . . . 25
3.3 RefiningtheTargetDescriptionUsingAssetDiagrams . . . . . . . 26
ix
x Contents
3.4 ApprovaloftheTargetDescription . . . . . . . . . . . . . . . . . 31
3.5 RiskIdentificationUsingThreatDiagrams . . . . . . . . . . . . . 33
3.6 RiskEstimationUsingThreatDiagrams . . . . . . . . . . . . . . 37
3.7 RiskEvaluationUsingRiskDiagrams . . . . . . . . . . . . . . . 39
3.8 RiskTreatmentUsingTreatmentDiagrams . . . . . . . . . . . . . 41
PartII CoreApproach
4 TheCORASRiskModellingLanguage . . . . . . . . . . . . . . . . . 47
4.1 CentralConcepts . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.1.1 WhatisaThreat? . . . . . . . . . . . . . . . . . . . . . . 48
4.1.2 WhatisaThreatScenario? . . . . . . . . . . . . . . . . . 49
4.1.3 WhatisaVulnerability? . . . . . . . . . . . . . . . . . . . 51
4.1.4 WhatisanUnwantedIncident? . . . . . . . . . . . . . . . 53
4.1.5 WhatisanAsset? . . . . . . . . . . . . . . . . . . . . . . 55
4.2 TheDiagramsoftheCORASlanguage . . . . . . . . . . . . . . . 56
4.2.1 AssetDiagrams . . . . . . . . . . . . . . . . . . . . . . . 56
4.2.2 ThreatDiagrams . . . . . . . . . . . . . . . . . . . . . . . 58
4.2.3 RiskDiagrams . . . . . . . . . . . . . . . . . . . . . . . . 60
4.2.4 TreatmentDiagrams . . . . . . . . . . . . . . . . . . . . . 62
4.2.5 TreatmentOverviewDiagrams . . . . . . . . . . . . . . . 64
4.3 HowtoSchematicallyTranslateCORASDiagramsintoEnglish
Prose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
4.3.1 HowtoTranslateAssetDiagrams . . . . . . . . . . . . . . 65
4.3.2 HowtoTranslateThreatDiagrams . . . . . . . . . . . . . 67
4.3.3 HowtoTranslateRiskDiagrams . . . . . . . . . . . . . . 69
4.3.4 HowtoTranslateTreatmentDiagrams . . . . . . . . . . . 69
4.3.5 HowtoTranslateTreatmentOverviewDiagrams . . . . . . 70
4.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
5 PreparationsfortheAnalysis . . . . . . . . . . . . . . . . . . . . . . 73
5.1 OverviewofStep1 . . . . . . . . . . . . . . . . . . . . . . . . . 73
5.2 ConductingtheTasksofStep1 . . . . . . . . . . . . . . . . . . . 76
5.3 SummaryofStep1 . . . . . . . . . . . . . . . . . . . . . . . . . 78
6 CustomerPresentationoftheTarget . . . . . . . . . . . . . . . . . . 81
6.1 OverviewofStep2 . . . . . . . . . . . . . . . . . . . . . . . . . 81
6.2 ConductingtheTasksofStep2 . . . . . . . . . . . . . . . . . . . 83
6.2.1 PresentationoftheCORASTerminologyandMethod . . . 83
6.2.2 PresentationoftheGoalsandTargetoftheAnalysis . . . . 86
6.2.3 SettingtheFocusandScopeoftheAnalysis . . . . . . . . 89
6.2.4 DeterminingtheMeetingPlan . . . . . . . . . . . . . . . . 91
6.3 SummaryofStep2 . . . . . . . . . . . . . . . . . . . . . . . . . 94
7 RefiningtheTargetDescriptionUsingAssetDiagrams . . . . . . . . 95
7.1 OverviewofStep3 . . . . . . . . . . . . . . . . . . . . . . . . . 95
Contents xi
7.2 ConductingtheTasksofStep3 . . . . . . . . . . . . . . . . . . . 97
7.2.1 PresentationoftheTargetbytheAnalysisTeam . . . . . . 97
7.2.2 AssetIdentification . . . . . . . . . . . . . . . . . . . . . 101
7.2.3 High-levelAnalysis . . . . . . . . . . . . . . . . . . . . . 106
7.3 SummaryofStep3 . . . . . . . . . . . . . . . . . . . . . . . . . 109
8 ApprovaloftheTargetDescription . . . . . . . . . . . . . . . . . . . 111
8.1 OverviewofStep4 . . . . . . . . . . . . . . . . . . . . . . . . . 111
8.2 ConductingtheTasksofStep4 . . . . . . . . . . . . . . . . . . . 113
8.2.1 ApprovaloftheTargetDescription . . . . . . . . . . . . . 114
8.2.2 RankingofAssets . . . . . . . . . . . . . . . . . . . . . . 115
8.2.3 SettingtheConsequenceScales . . . . . . . . . . . . . . . 116
8.2.4 SettingtheLikelihoodScale . . . . . . . . . . . . . . . . . 118
8.2.5 DefiningtheRiskFunction . . . . . . . . . . . . . . . . . 120
8.2.6 DecidingtheRiskEvaluationCriteria . . . . . . . . . . . . 122
8.3 SummaryofStep4 . . . . . . . . . . . . . . . . . . . . . . . . . 124
9 RiskIdentificationUsingThreatDiagrams. . . . . . . . . . . . . . . 125
9.1 OverviewofStep5 . . . . . . . . . . . . . . . . . . . . . . . . . 125
9.2 ConductingtheTasksofStep5 . . . . . . . . . . . . . . . . . . . 128
9.2.1 CategorisingThreatDiagrams . . . . . . . . . . . . . . . . 128
9.2.2 IdentificationofThreatsandUnwantedIncidents . . . . . . 129
9.2.3 IdentificationofThreatScenarios . . . . . . . . . . . . . . 133
9.2.4 IdentificationofVulnerabilities . . . . . . . . . . . . . . . 137
9.3 SummaryofStep5 . . . . . . . . . . . . . . . . . . . . . . . . . 144
10 RiskEstimationUsingThreatDiagrams . . . . . . . . . . . . . . . . 147
10.1 OverviewofStep6 . . . . . . . . . . . . . . . . . . . . . . . . . 147
10.2 ConductingtheTasksofStep6 . . . . . . . . . . . . . . . . . . . 149
10.2.1 LikelihoodEstimation . . . . . . . . . . . . . . . . . . . . 150
10.2.2 ConsequenceEstimation. . . . . . . . . . . . . . . . . . . 154
10.2.3 RiskEstimation . . . . . . . . . . . . . . . . . . . . . . . 157
10.3 SummaryofStep6 . . . . . . . . . . . . . . . . . . . . . . . . . 163
11 RiskEvaluationUsingRiskDiagrams . . . . . . . . . . . . . . . . . 165
11.1 OverviewofStep7 . . . . . . . . . . . . . . . . . . . . . . . . . 165
11.2 ConductingtheTasksofStep7 . . . . . . . . . . . . . . . . . . . 167
11.2.1 ConfirmingtheRiskEstimates . . . . . . . . . . . . . . . 167
11.2.2 ConfirmingtheRiskEvaluationCriteria . . . . . . . . . . 168
11.2.3 ProvidingaRiskOverview . . . . . . . . . . . . . . . . . 169
11.2.4 AccumulatingRisks . . . . . . . . . . . . . . . . . . . . . 170
11.2.5 EstimatingRiskswithRespecttoIndirectAssets . . . . . . 173
11.2.6 EvaluatingtheRisks . . . . . . . . . . . . . . . . . . . . . 182
11.3 SummaryofStep7 . . . . . . . . . . . . . . . . . . . . . . . . . 185
xii Contents
12 RiskTreatmentUsingTreatmentDiagrams . . . . . . . . . . . . . . 187
12.1 OverviewofStep8 . . . . . . . . . . . . . . . . . . . . . . . . . 187
12.2 ConductingtheTasksofStep8 . . . . . . . . . . . . . . . . . . . 188
12.2.1 GroupingofRisks . . . . . . . . . . . . . . . . . . . . . . 189
12.2.2 TreatmentIdentification . . . . . . . . . . . . . . . . . . . 191
12.2.3 TreatmentEvaluation . . . . . . . . . . . . . . . . . . . . 196
12.3 SummaryofStep8 . . . . . . . . . . . . . . . . . . . . . . . . . 203
PartIII SelectedIssues
13 AnalysingLikelihoodUsingCORASDiagrams . . . . . . . . . . . . 207
13.1 UsingCORASDiagramstoCalculateLikelihood . . . . . . . . . 208
13.1.1 SpecifyingLikelihoodUsingCORASDiagrams . . . . . . 208
13.1.2 RulesforCalculatingProbabilityinCORASDiagrams . . 210
13.1.3 RulesforCalculatingFrequencyinCORASDiagrams . . . 222
13.1.4 LikelihoodasProbabilityorFrequency . . . . . . . . . . . 226
13.1.5 GeneralisationtoIntervalsandDistributions . . . . . . . . 227
13.2 UsingCORASDiagramstoCheckConsistency . . . . . . . . . . 229
13.3 UsingCORAStoAnalyseScenarioswithLogicalConnectives . . 233
13.3.1 Using CORAS to Analyse Scenarios with Logical
Conjunction . . . . . . . . . . . . . . . . . . . . . . . . . 233
13.3.2 Using CORAS to Analyse Scenarios with Logical
Disjunction. . . . . . . . . . . . . . . . . . . . . . . . . . 236
13.4 HowtoStructureaThreatDiagramtoExploitthePotentialfor
LikelihoodAnalysis . . . . . . . . . . . . . . . . . . . . . . . . . 237
13.4.1 EnablingApplicationofRulesbyComposition . . . . . . . 237
13.4.2 EnablingApplicationofRulesbyDecomposition . . . . . 239
13.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
14 TheHigh-levelCORASLanguage . . . . . . . . . . . . . . . . . . . 245
14.1 ReferringElementsandReferencedDiagrams . . . . . . . . . . . 246
14.1.1 ThreatScenarios . . . . . . . . . . . . . . . . . . . . . . . 247
14.1.2 UnwantedIncidents . . . . . . . . . . . . . . . . . . . . . 250
14.1.3 Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
14.1.4 TreatmentScenarios . . . . . . . . . . . . . . . . . . . . . 253
14.2 LikelihoodsinHigh-levelCORAS . . . . . . . . . . . . . . . . . 257
14.2.1 ReasoningAbouttheLikelihoodsinaHigh-levelDiagram. 260
14.2.2 ReasoningAbouttheLikelihoodsinaReferencedDiagram 261
14.2.3 AnalysingtheRelationBetweentheLikelihoodsofa
ReferringElementandtheLikelihoodsintheReferenced
Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
14.3 ConsequencesinHigh-levelCORAS . . . . . . . . . . . . . . . . 264
14.4 RiskLevelsinHigh-levelCORAS . . . . . . . . . . . . . . . . . 266
14.5 HowtoSchematicallyTranslateHigh-levelCORASDiagrams
intoEnglishProse . . . . . . . . . . . . . . . . . . . . . . . . . . 267