Risk Assessment

1. Risk assessment should be among the first steps in your design process, and will help you frame your fur­ther efforts to design a secure system. Making risk assessment a priority will also help you to make sure your executive officers to be both informed about and integral to the beginnings of your securely designed project. During the risk assessment phase of design, you may find important supporters and champions among the executive officers: you should actively recruit their, participation if they're not already involved.

2. Business majors and MBAs already know about the managerial aspects of risk assessment. This methodology is heavily used in most business plans,⁴especially with respect to business planning. Risk assessment is no less important in secure, well-designed software or applica­tions development projects. Take advantage of the fact that your managers and executives are probably already familiar with risk assessment methodology. Armed with a common language and methodology, you can inform your managers of the relative risks to which the application exposes you or your customers, and you can additionally leverage their involvement and buy-in. This will help you in the end: if there should ever be an attack on your application, you will already have a champion to go to bat for the integrity of your application and the care with which it was designed.

3. The basic steps of risk assessment are as fol­lows :

1. Identify protected resources

2. Assign relative value

3. Identify possible attackers

4. Estimate relative frequency of each kind of attacker

5. Carry out attack tree analysis (Identify possible attack routes)

6. Protect all possible attack routes (Protect most likely attack routes)

4. Protected resources include things like your cus­tomer database, customer credit card information, or personal information. If you thought about the policies regarding the privacy, disposition and handling of cus­tomer information and other social and legal issues you would understand that your risk assessment process de­pends a great deal on such things. Your executive manag­ers must be involved in deciding these policies.

5. For each resource, assign it a relative value (i.e. your customer credit card database will probably be more valuable than your vendor contact list). Next, identify possible attackers. Frequent examples are the bored teen­ager, the disgruntled ex-employee, the corporate spy, or the government intelligence agent.

6. Estimation of the skill, frequency and methods of the attacker all belong to a related process to risk assessment which Bruce Schneier calls 'attack tree anal­ysis' . This process helps to formalize what's otherwise a significantly subjective process of analysis and assess­ment, and can help to prioritize your project's security goals. If you saw chapter 21 of Bruce Schneier's book: Secrets and Lies: Digital Security in a Networked World you could know more about attack trees. (A highly-recom­mended resource on all aspects of digital security.)

7. Once you knew what routes or attack you should be protecting (from your attack tree analysis), you would already organize information about the kind of security you need to implement in your design. You may also find that this information will be helpful in writing securi­ty and privacy policies to accompany your application design efforts.

8. Please be very careful when carrying out your own research about risk assessment. It is very easy to confuse this process with another process, usually called 'security assessment'. A risk assessment is a process that people undertake (sometimes aided by organization­enhancing software) to determine risks surrounding their specific efforts. On the other hand, there are many software tools available for security assessments that will analyze your network and servers for known vulner­abilities .

9. Three tips for using these kinds of software tools: 1) if you research the producing company carefully you will be sure you can trust them with the necessary access privileges before setting the software up on your network, 2) test the tool in an isolated testing envi­ronment before applying it, and 3) strongly consider petitioning your internal Information Technology de­partment or Help Desk for permission to run this kind of tool on your company's internal networks. Security as­sessment tools can be useful, but cannot be 100% effec­tive, and though they may help you do risk assessment for extant problems with existing software, they will not be able to do the job for you in regard to designing and developing new software and applications.

Грамматика

Инфинитив

I Инфинитив — это начальная форма глагола и, естественно, отвечает она на I вопрос «Что делать?», «Что сделать?».

Инфинитив есть и в русском языке. Для нас сложнее понять, что инфинитивов может быть так много. Но если мы вспомним, сколько глагольных конструкций требуется английскому языку для адекватного выражения действия, все становит­ся на свои места. Инфинитивы, как начальная форма, являются формулами гла­гольных конструкций. К тому же, инфинитив может использоваться самостоятельно в различных функциях в предложении. Для исполнения всех этих ролей инфини­тивы и должны быть многообразны. Посмотрите внимательно на примеры инфи­нитивов в таблице и значения Тех действий, которые они передают.