•Phases of risk management
•Phases of risk management
- Identify mission essential functions
- Identify vulnerabilities
- Identify threats
- Analyze business impacts
- Identify risk response
- Identify mission essential functions—mitigating risk can involve a large amount
of expenditure so it is important to focus efforts. Effective risk management must
focus on mission essential functions that could cause the whole business to fail if
they are not performed. Part of this process involves identifying critical systems
and assets that support these functions. - Identify vulnerabilities—for each function or workflow (starting with the most
critical), analyze systems and assets to discover and list any vulnerabilities or
weaknesses to which they may be susceptible. - Identify threats—for each function or workflow, identify the threat sources and
actors that may take advantage of or exploit or accidentally trigger vulnerabilities. - Analyze business impacts—the likelihood of a vulnerability being activated as a
security incident by a threat and the impact of that incident on critical systems are
the factors used to assess risk. There are quantitative and qualitative methods of
analyzing impacts and likelihood. - Identify risk response—for each risk, identify possible countermeasures and
assess the cost of deploying additional security controls. Most risks require some
sort of mitigation, but other types of response might be more appropriate for
certain types and level of risks.
Risk assessment
Risk assessment
•Likelihood and impact
Enterprise risk management (ERM) frameworks
Mostcompanies will institute enterprise risk management (ERM) policies and procedures,
based on frameworks such as NIST’s Risk Management Framework (RMF) or ISO 31K.
- Risk and control self-assessment (RCSA)
* Risk and control assessment (RCA)
Most companies will institute enterprise risk management (ERM) policies and procedures,
based on frameworks such as NIST’s Risk Management Framework (RMF) or ISO 31K.
These legislative and framework compliance requirements are often formalized as
a Risk and Control Self-Assessment (RCSA). An organization may also contract an
external party to lead the process, in which case it is referred to as a Risk and Control
Assessment (RCA).
A RCSA is an internal process undertaken by stakeholders to identify risks and the
effectiveness with which controls mitigate those risks. RCSAs are often performed
through questionnaires and workshops with department managers. The outcome of an
RCSA is a report. Up-to-date RCSA reports are critical to the external audit process.
Risk Types
External
•Cyber threat actors and natural or person-made disaster
Internal
•Risks that arise from assets that are owned/managed
Multiparty
•Ripple impacts in the supply chain
Intellectual property (IP) theft
Software compliance/licensing
•Shadow IT
Legacy systems
Concrete values to risk factors (quantitative assessment)
- Single Loss Expectancy (SLE)
- Exposure Factor (EF)
- Annualized Loss Expectancy (ALE)
- Annualized Rate of Occurrence (ARO)
- Single Loss Expectancy (SLE)
* Exposure Factor (EF)
Single Loss Expectancy (SLE)—the amount that would be lost in a single
occurrence of the risk factor. This is determined by multiplying the value of the
asset by an Exposure Factor (EF). EF is the percentage of the asset value that would
be lost.
- Annualized Loss Expectancy (ALE)
* Annualized Rate of Occurrence (ARO)
Annualized Loss Expectancy (ALE)—the amount that would be lost over the
course of a year. This is determined by multiplying the SLE by the Annualized Rate
of Occurrence (ARO).
Difficulty of forecasting likelihood
Difficulty of assessing impact/cost
The problem with quantitative risk assessment is that the process of determining and
assigning these values is complex and time consuming. The accuracy of the values
assigned is also difficult to determine without historical data (often, it has to be based
on subjective guesswork). However, over time and with experience, this approach can
yield a detailed and sophisticated description of assets and risks and provide a sound
basis for justifying and prioritizing security expenditure
Qualitative Risk Assessment
- Seeks opinions and uses broad categorizations
- Heat map or traffic light impact matrix
- Security Categorizations (FIPS 199)
- Low
- Medium
- High
Inherent risk
Level of risk before any type of mitigation has been attempted
Risk Posture
The overall status of
risk management is referred to as risk posture. Risk posture shows which risk response
options can be identified and prioritized.
Risk posture and prioritization
Risk posture and prioritization [potential prioritization]
•Regulatory requirements
•High value asset, regardless of threat likelihood
•Threats with high likelihood
•Procedures, equipment, or software that increase the likelihood of threats
•Return on Security Investment (ROSI)
Risk mitigation/remediation
Risk mitigation (or remediation) is the overall process of reducing exposure to orthe effects of risk factors.
Risk mitigation/remediation
•Deploy countermeasure
•Reduce likelihood or impact or both
risk deterrence (or reduction)
If you deploy a countermeasure that reduces exposure to
a threat or vulnerability that is risk deterrence (or reduction). Risk reduction refers
to controls that can either make a risk incident less likely or less costly (or perhaps
both).
Risk Avoidance and Risk Transference
Avoidance
•Stop doing the risky activity
Transference
•Assignrisk to a third-party
•Cybersecurity insurance
•Limits to transference
cybersecurity insurance
Specific cybersecurity
insurance or cyberliability coverage protects against fines and liabilities arising from
data breaches and DoS attacks.
Risk acceptance/tolerance
- Risk is assessed and monitored, but no countermeasure is put in place
- Do not ignore risk
Residual risk
Likelihood and impact after mitigation
Risk appetite
- Willingness to tolerate a certain level of risk
* Established at an organization or project level
Control risk
Loss of countermeasure effectiveness over time
Control risk is a measure of how much less effective a security control has become
over time. For example, antivirus became quite capable of detecting malware on the
basis of signatures, but then less effective as threat actors started to obfuscate code.
Control risk can also refer a security control that was never effective in mitigating
inherent risk. This illustrates the point that risk management is an ongoing process,
requiring continual reassessment and re-prioritization.
Risk Awareness
- Communicate risk factors to stakeholders
- Risk registers
- Risk matrix/heat map
- Graphs
- Relevance to workflows
Business impact analysis (BIA)
Business impact analysis (BIA) reports for threat scenarios
•Calculate impact as costs
•Justifies and prioritizes investment in security controls
Business impact analysis (BIA) is the process of assessing what losses might occur
for a range of threat scenarios. For instance, if a DDoS attack suspends an e-commerce
portal for five hours, the business impact analysis will be able to quantify the losses
from orders not made and customers moving permanently to other suppliers based
on historic data. The likelihood of a DoS attack can be assessed on an annualized basis
to determine annualized impact, in terms of costs. You then have the information
required to assess whether a security control, such as load balancing or managed
DDoS mitigation, is worth the investment.
Business continuity planning/continuity of operations planning (COOP)
Business continuity planning/continuity of operations planning (COOP)
•Identifies controls and processes that maintain critical workflows
Where BIA identifies risks, business continuity planning (BCP) identifies controls and
processes that enable an organization to maintain critical workflows in the face of
some adverse event.
-
Lesson 128
-
Lesson 221
-
Lesson 359
-
Lesson 4 & 580
-
Lesson 639
-
Lesson 720
-
Lesson 835
-
Lesson 979
-
Tools8
-
Lesson 1042
-
Lesson 1164
-
Test Questions19
-
Lesson 1296
-
Lesson 1370
-
Lesson 14129
-
Lesson 15100
-
Lesson 1650
-
Lesson 1799
-
Lesson 1840
-
Lesson 1942
-
Lesson 2076
-
Lesson 2155
-
Test Questions 21
