Lecture 8: Risk Management

Risk

The potential for loss or damage to an organization resulting from a threat exploiting a vulnerability

Which two factors is risk measured by?

How likely it is to occur (likelihood) and the damage it could cause (impact)

Risk Management

The process of identifying, assessing, and reducing risks that could affect an organization

What are the key steps in risk management?

Risk identification, risk assessment, risk response, risk monitoring

Risk Appetite

The maximum level of risk an organization is willing to tolerate

What are the types of risk appetite?

Expansionary, conservative, neutral

Expansionary Risk Appetite

Accepts higher risk for growth

Conservative Risk Appetite

Avoids risks and prioritizes stability

Neutral Risk Appetite

Balanced approach between expansionary and conservative

Risk Posture

The overall level of risk an organization is exposed to; helps prioritize risk response strategies

Risk Identification

The process of finding potential cybersecurity threats and vulnerabilities (risks)

What are the methods used in risk identification?

Vulnerability assessments, penetration testing, security audits, and threat intelligence

Risk Assessment

Analyzes the likelihood and impact of already identified risks and determines its severity in relation to the organization; helps prioritize risks and decide how to manage them

Inherent Risk

The level of risk before any security controls or mitigation are applied

What are the types of risk assessment?

Ad hoc, one-time, recurring, continuous

Ad Hoc Risk Assessment

Done when needed

One-Time Risk Assessment

Conducted once, often during a new system implementation

Recurring Risk Assessment

Done regularly (monthly, quarterly, annually)

Continuous Risk Assessment

Ongoing monitoring using automated tools

Which approaches can risk assessment be classified into?

Qualitative risk analysis and quantitative risk analysis

Quantitative Risk Analysis

Based on numerical values, calculations, and financial data to estimate potential monetary loss caused by risk

What are key concepts in quantitative risk assessment?

Single loss expectancy (SLE), annualized loss expectancy (ALE), annual rate of occurrence (ARO)

Single Loss Expectancy

Loss caused by one risk/incident

Annualized Loss Expectancy

Expected yearly loss; helps decide if security controls are worth it

Annual Rate of Occurrence

How often the risk happens in a year

Qualitative Risk Analysis

Simple and quick way to assess risks using subjective judgement; based on expert judgement and experience

What is part of the risk response?

Mitigation, avoidance, transference, acceptance

Mitigation

Reduces likelihood or impact of risks; e.g., fire alarms, sprinklers, etc.

Avoidance

Eliminates risky activities altogether; e.g., stop selling insecure software to avoid liability

Transference

Shifts risk to third parties (e.g., insurance, outsourcing)

Acceptance

Accepts minor risk when mitigation isn't justified; used when costs are greater than potential loss

Accept with Exemption

A required security policy or regulation cannot be followed due to constraints like system limitations or organizational factors

Accept with Exception

An internal security policy is temporary not applied due to operational issues or system conflicts

Residual Risk

Risk monitoring after mitigation measures are applied; the final level of risk that cannot be fully eliminated

Risk Monitoring

Continuous process of tracking and reviewing identified risks and controls

What are the key activities in risk monitoring?

Monitoring existing risks, reviewing effectiveness of controls, detecting new or changing risks

Risk Register

A central document that tracks all identified risks and mitigation strategies

What does the risk register help stakeholders with?

Monitoring, prioritizing, and managing risks effectively

What does a risk register typically include?

Risk description, likelihood & impact, risk owner, mitigation controls, status & escalation path

Penetration Testing

Authorized simulated cyberattack used to identify exploitable security weaknesses; AKA ethical hacking

What is the purpose of penetration testing?

To test the effectiveness of security controls and identify vulnerabilities before attackers exploit them

How does penetration testing support risk management?

By finding vulnerabilities and helping assess how serious the risks are

What are the penetration testing types based on knowledge level?

White box, grey box, black box

White Box

Known penetration testing; full knowledge of the system

Grey Box

Partially known penetration testing; limited knowledge of the system

Black Box

Unknown penetration testing; no prior knowledge, simulates real attacker

What are the penetration testing types based on testing approach?

Offensive, defensive, physical testing, integrated penetration testing

Offensive Testing

Red team; simulates attacks, finds vulnerabilities, attacker-focused

Defensive Testing

Blue team; tests controls, detection, and incident response

Physical Testing

Assesses physical security; uses social engineering, tailgating, lock picking

Integrated Penetration Testing

Combines different types of penetration testing techniques

Business Impact Analysis

A process used to identify and evaluate the potential effects of disruptions on an organization's critical operations

What are the critical systems and assets in BIA?

People, tangible assets, intangible assets, procedures

What are the business functions in BIA?

Mission Essential Functions (MEF) and Primary Business Function (PBF)

Mission Essential Functions

Cannot be deferred; must be restored first after disruption

Primary Business Function

Supportive but not critical

What are key metrics of BIA?

Maximum Tolerable Downtime (MTD), Recovery Time Objective (RTO), Recovery Point Objective (RPO), WRT (Work Recovery Time)

Maximum Tolerable Downtime

Longest time a process or system can be down before causing serious harm

Recovery Time Objective

Time required to restore systems after a disruption; set within MTD to ensure timely recovery

Recovery Point Objective

Maximum acceptable data loss after a disruption

Work Recovery Time

Time to reintegrate processes and resume all operations; focuses on people and processes after system recovery

What must not exceed MTD?

RTO and WRT