Fundamental process that involves identifying, analyzing, treating, monitoring, and reporting risks.
Risk Management Phases
Risk Identification: Proactive process with goal of creating a list of risks that may prevent organization from getting its objectives.
Risk Analysis: Evaluating likelihood and potential impact of risks. Can be qualitative or quantitative. Goal is to sort list of risks by priority.
Risk Treatment: Reduce risk to acceptable risk. Includes avoidance, reduction, sharing, acceptance.
Risk Monitoring: Ongoing process that requires tracking identified risks, assessing new risks, and evaluating the effectiveness of risk mitigation strategies.
Risk Reporting: Communicating risk and effectiveness of risk management process to stakeholders (e.g., dashboards, heat maps, detailed reports).
Risk Assessment Frequency
Regularity with which an organization does risk assessment process. Varies greatly depending on organizational needs.
Types:
Ad-hoc: Conducted as and when needed, often in response to an specific event or situation that has potential to introduce or change risk.
Recurring: Conducted at regular intervals (e.g., annually/quarterly/monthly). Determined by organization policy.
One-Time: Conducted for a specific purpose and are not reported (e.g., for a new IT system, construction project, or organizational change).
Continuous: Ongoing monitoring evaluation of risks. Involves real-time data collection and analysis.
Aside: Ad-hoc v. One-Time
Ad-hoc: Specific events or situations and may be repeated.
One-Time: Specific project or initiative and not repeated.
Risk Identification
Recognizing potential risks that could negatively impact an organizations ability to operate or achieve its objects.
Critical first step of Risk Analysis.
Organization should consider a wide range of risks including operational, financial, strategic, and reputational.
Risks should be analyzed based on probability and possible impact.
BIA: Process that involves evaluating potential effects of disruption to an organizations business functions and processes.
BIA terms:
Recovery Time Objective (RTO): Maximum acceptable length of time that can elapse before the lack of a business function severely impacts the organization.
Recovery Point Objective (RPO): Maximum acceptable amount of data loss measured in time (e.g., if your RPO is 15 minutes you need to back up every 15 minutes).
Mean Time to Repair (MTTR): Represents average time required to repair a failed component or system (how easy to repair a system is).
Mean Time Between Failures (MTBF): Average time between failures (how reliable a system is). e.g., if a system broke 5 times in a year, it would have an MTBF of ~72 days.
Risk Register
Risk Register (Risk Log): Document detailing identified risks including their description, impact, likelihood, and mitigation strategies.
Key tool in risk management, featuring key risk indicators, risk owners, and risk thresholds.
Can resemble the heat map risk matrix.
Should be shared among stakeholders.
Parts of Register:
Risk Description: Identifies and provide detailed description of risk.
Risk Impact: Potential consequence if risk materializes (cost/time/quality/etc.); usually rated low/medium/high.
Risk Probability: Chance of risk occurring.
Risk Outcome: Result of a risk, linked directly the impact and likelihood.
Risk Level: Determined by combining the impact and likelihood.
Cost: Pertains to financial impact on the project.
Risk Tolerance: Organizations willingness to deal with uncertainty in pursuit of their goals.
Risk Appetite: The amount of residual risk an organization is willing to accept.
Expansionary: More risk for greater returns.
Conservative: Less risk even if lower returns.
Neutral: Balance between risk and return.
Additionally we must know:
Key Risk Indicators (KRIs): Essential predictive metrics used by organization to signal rising risk levels in different parts of the enterprise.
Risk Owner: Person/group responsible for managing the risk.
Qualitative Risk Analysis
Method of assessing risks based on potential impact and likelihood of their occurrence.
Subjective and relies on expertise and experience of project team and stakeholders.
Likelihood: chance of risk occurring; typically qualitatively measured as low/medium/high.
Quantitative Risk Analysis
Method of evaluating risk with numerical methods.
Exposure Factor (EF): Proportion of an asset that is lost in an event (0% no loss, 100% total loss).
Single Loss Expectancy (SLE): Monetary value expected to be lost in a single event (Value of Asset times EF).
Annualized Rate of Occurrence (ARO): Estimated frequency a threat is expected to occur within a year.
Annualized Loss Expectancy (ALE): Expected annual loss from a risk (SLE times ARO).
Example:
Suppose a server is worth $10,000, the EF is 50%, and the server is expected to crash every two years.
If a vendor sells you a new server with a higher redundancy rating, you can use the formula to calculate savings to see if it is actually worth it.
Risk Management Strategies
Risk Transference (Risk Sharing)
Involves shifting risk from organization to another party (e.g., insurance policy, contract indemnity clause).
Contract Indemnity Clause: One party agrees to cover other’s harm, liability, or loss stemming form the contract.
Remember that moving financial burden of a potential loss does not eliminate the risk.
Risk Acceptance
Recognizing a risk and choosing to address it when it arises.
Used when the risk is unlikely to have a significant impact.
Exception: Temporarily relaxes security controls for operational business needs.11. [Verified] Clarified the difference between Exception (temporary deviation) and Exemption (permanent deviation).
Exemption: Permanent provision that grants an exception from a specific rule or requirement.
Risk Avoidance
Strategy of altering plans or approaches to completely eliminate a specific risk.
Used when the risk is too great.
Risk Mitigation
Implementing measures to decrease the likelihood or impact of a risk.
Risk Monitoring and Reporting
Risk Monitoring: Continually tracking identified risks, assessing new risks, and evaluating the effectiveness of risk mitigation strategies.
Residual Risk: Likelihood and impact after implementing mitigation/transference/acceptance measures on initial risk.
Control Risk: Assessment of how a security measure has lost effectiveness over time.
Risk Reporting: Process of communicating information about risk management activities.
Informed decisions-making.
Risk mitigation.
Stakeholder communication.
Regulatory compliance.
[Verified] Clarified the difference between Exception (temporary deviation) and Exemption (permanent deviation).↩︎