Risk Prioritization.
There's always going to be risk.
You prioritize what is going to cause you the most pain first,
and you spend more money towards the most risk, the highest resultant impact.
In order to identify the various risks
with the same severity, risk should be prioritized and rated.
Number two, while performing the risk
response step, consider risk prioritization.
Prioritization depends on the goals and the resources of the organization.
Again, you'll typically look at what's going to cost you the most.
There's also some opinion in there as well some qualitative.
Our training budget is X number of dollars.
How do we choose to spend that money wisely?
Risk levels.
Risks are categorized into different levels, typically three basic categories,
extreme high, medium or low, according to their estimated impact on the system.
The impact level depends on the value of
assets and the resources it affects and the severity of the damage.
Extreme high, for example, you have a categorization or
classification going on here like anything else.
There's a classification for everything, everything gets a classification and that
should tell you directly how you need to respond to it.
An extreme high immediate response or
measures should be performed to combat risk.
Identify and impose controls to reduce
risk to a reasonably low level, reasonably, again, defined by management.
In medium, immediate action is not
required, but it should be implemented quickly.
Implement controls as soon as possible to reduce risk to a reasonably low level,
and low, take preventative steps to mitigate the effects of risk.
A risk matrix is going to lay all this out
based on probability, likelihood, consequence, or impact of the risk.
You have a probability and a percentage, that's your likelihood.
You're going to rank that in very high,
high, equal, low, or very low based on its percentage values.
Then you've got the consequences, the
result of the impact, insignificant, minor, moderate, major, severe.
As you cross reference both of those
values, the probability and the consequence, you get the different
ratings, extreme, high, medium, low, and low.
Risk matrix is again, X, Y coordinates based on probability and
impact, and you have a labeling that is derived from both of those factors.
Again, every organization is a little bit different on how to actually rank this.
A lot of times it's based on dollar loss, life safety goal issues, and so forth.
In military and government, it's based on danger to national security.
Risk treatment.
Now that we understand the risk, the
likelihood of impact, the resultant impact, risk treatment is the process of
selecting and implementing appropriate controls on the identified risks.
Risks are addressed and treated based on its severity level, and decisions made in
this phase are based on the results of a risk assessment.
Your options.
Risk treatment can change the likelihood
of risk occurrence owing to the risk treatment options available.
Risk modification or risk mitigation.
Risk mitigation modification modifies risk exposure by applying
controls to the process, system, or environment.
That's applying counter measures.
You're doing something about it to lower the level of risk.
Risk retention or risk acceptance occurs
when the organization acknowledges the existence of a risk and chooses
deliberately to operate without applying alternative risk treatment strategies.
Why would you ever do that?
When there is no cost-effective way to address the risk?
Let's say that that firewall we did in our
earlier whiteboard diagram was one million dollars, not $100,000.
Well, now it's going to cost you 550 grand
a year versus Savayah, that doesn't make any sense.
So, if it costs more to address the risk than the risk that's imposed to begin
with, then you wouldn't spend any money to it.
If you've got the data to back that up,
you've done your due care and your due diligence.
So, let's talk about those terms for just a second.
Due care and due diligence are
exercising reasonable and responsible actions to address specific risk.
Due diligence, for example, is doing your
homework, determining what cyber threats we might incur in an
organization and then due care is doing something about it.
So, exercising, doing something reasonably and responsibly, that's used to determine
if your actions have been negligent or not.
So, in a negligence case where you're being sued for not applying the
appropriate counter measures, they're going to measure your actions, Mr.
Ceo or organizational officer, whoever that may be, against the prudent person.
The prudent person always does the right thing, acts prudently.
Did they exercise due care and due diligence?
Did they act reasonably and responsibly?
If they've done the math behind it and shown that it costs more to implement the
countermeasure, that's doing your due diligence.
If they decide to reject the risk, flat
out, la la la la doesn't exist, that is not an appropriate response.
That's basically head in the sand
mentality and you might be found negligent in a legal case.
Risk retention, risk acceptance.
If it costs you more to address the risk
than the risk to begin with, you might accept it.
Risk avoidance or elimination relates to adjustments in the
organizational strategy or processes to eliminate or reduce the risk.
Without discontinuing the activity, you
really can't eliminate all risk, but you can greatly reduce it.
You might outsource, you might avoid or find an alternative too.
Risk sharing or risk transfer is where
you're buying insurance or potentially outsourcing it to a third party.
Risk sharing relates to reassigning
accountability for risk to another entity or organization.
It often refers to insurance.
You're buying cyber insurance.
Risk transfer is an acceptable strategy.
Manage risk easy to define or clearly understood.
Make it somebody else's problem, pay money for it.
But again, risk rejection, which we're not
really listing in the slide here, is not an appropriate response.
You'd be definitely found liable or negligent.
Risk categories.
A couple of different flavors of risk.
You've got inherent, which exists before controls are implemented, and then
residual risk, which is what's left over after you implement your controls.
That residual risk, that $50,000 a year
that was left over in our initial diagram, that was the residual risk.
That was what was left over after applying the firewall.
You also call that the controls gap, the gap that the controls can't address.
What remains, the most important
consideration for residual risk is the understanding that some quantity of risk
is always going to remain after applying mitigation.
You will never get rid of it 100 %, but
you do your best to bring it to a, everybody all together now, reasonable
level, which is determined by senior management.
The risk treatment plan.
The plan describing how you plan to respond to potential risks.
Document should be produced as part of a
certified ISO 27001 information security management program, which again, that's
one of the ISO standards for secure infrastructure.
You can be certified in ISO 27001.
The risk treatment plan should include your proposed security controls with
priorities and deadlines, required resources, roles and responsibilities of
stakeholders, performance and reporting and monitoring requirements.
Risk tracking is identifying the chance of a new risk occurring.
Again, once we've got our risk analysis
complete, at least initially, we're by no means finished.
It needs to be maintained in an ongoing fashion.
Tied to change management in the
organization is a good way to trigger a risk review.
The tracking phase ensures appropriate controls are implemented to handle risks.
Also, you can be monitoring the
effectiveness of the controls in the interim.
Risk tracking also includes monitoring probability, impact status, and exposure.
Risk review evaluates the performance of
the implemented risk management strategies.
Reporting ensures management is aware of
the top risks, enabling them to plan to reduce the risk appropriately.
Some formal frameworks.
The NIST Risk Management Framework is pretty standard these days.
If you're in DOE or military, you're
familiar with RMF, either First Chance Implementation or Aware of its existence.
Since this is the standard utilized by government and military to manage risk.
Nist's risk management or RMF uses a system development lifecycle,
categorizing, selecting, implementing, assessing, authorizing, and monitoring.
It's an ongoing process.
It goes round and round and round.
Categorized, define the criticality, sensitivity of the system, according to
potential worst case and adverse impact admission or business, so classifications.
Select your appropriate baseline security controls.
Implement, implement controls, apply configuration changes.
Assess, determine the control effectiveness, authorize, determine the
risk to organizational operations and assets, individuals, other organizations,
and if acceptable, authorize operation and then monitor.
Continuously track changes to the information system that may affect
controls and reassess control effectiveness.
Now, this replaces old school DITSCAP, DIACAP, and ICAP.
There are other risk management frameworks, but NIST is a hot topic these
days, or RMF is a hot topic these days used all over the place.
There's also COSO.
COSO ERM framework provides components,
creates a common language, provides clear direction and guidance for ERM.
It involves mission, vision and core
values, strategy development, business objective formulation,
implementation and performance, enhanced value, governance and culture, strategy
and objective, performance review mission, and communication reporting.
Now, we don't really need to get too much into the specifics.
Really at this stage of the game, we just want to understand the existence of COSO.
RMF, you want to be familiar with the cycle.
You don't necessarily have to describe exactly what happens at each step.
Then we also have COBIT.
Which COBIT is COSO is more strategic, organizational.
COBIT is more IT focused.
The COBIT framework emphasizes regulatory compliance, helps
organizations increase the value obtained from IT, enables alignment, simplifies the
implementation of the enterprise is the governance control framework.
Again, here's the wheel, what are the
drivers, where are we now, where we want to be, what needs to be done?
How do we get there?
Did we get there?
How to keep the momentum going, initiating
the program, defining problems, roadmap, plan, execute, realize, and review.
Now, again, these are frameworks.
There's a lot of detail at each step.
At this stage of the game, you're not too terribly concerned with that.
After you complete the course and you pass
your exam, you might want to dig into this stuff a little bit deeper.
But for now, you just want to understand
the existence and the purpose of these frameworks.
Other risk management frameworks.
There's a bunch of ISO standards.
Probably the most noted were the 27,000 series, 27005.
This is an extension to, maps directly to recommendations in 27001.
This was the first reference standard for identifying secure networks.
It evolved out of a British standard 7799.
It became ISO 17799, and then it evolved into the 27001, 27002 series and on.
Again, there's lots of ISO standards.
Iso 31000, generic guidelines for enterprise risk management with
universally recognized risk paradigm for practitioners and companies.
Then TARA.
TARA has actually been around for a long time.
Threat agent risk assessment.
There's OCTAVE, CRAMM, FRAP, and a few others.
Speaking of which, there's Octave.
Octave Allegro, FAIR representation and information security risk.
Then ITIL, definitely notable.
ITIL deals with service management, formerly known as the Information
Technology Infrastructure Library, set of practices for service management focused
on aligning services with the needs of a business.
That's development of services.
Finally, our enterprise network risk
management policy, assist in developing and establishing essential processes and
procedures to address and minimize information security risks.
We've talked about enterprise risk and frameworks.
Again, the policy lays this all out in formal documentation.
There is a lot of work related to risk assessment, risk analysis.
There's lots of standards or frameworks out there for doing it.
It can be a very involved process, incredibly important, and it definitely
needs to be an ongoing process, not just completed once.
It gets outdated pretty quickly. All right, well, that's going to wrap us up
for our final module in the course, Module 22 Risk Management.
Up next, course wrap up, recommendations and next steps.