Lesson 24 - Explain Elements of the Risk Management Process

Risk

uncertainty of an outcome

Risk Volatility

extent to which the level of risk is likely to change over time

Risk Velocity

- measures how fast an exposure can impact and organization

- time between the event and when the organization first feels its effects

Cascading Risk

- principle that risks are often linked, and failing to address one risk could cause a chain reaction

- can be parallel, serial, or mixed

Risk Appetite

the level of risk that a company is comfortable engaging in

Expansive Risk Appetite

willingness to take on a high degree of risk

Conservative Risk Appetite

preference for low risk activities and a focus on minimizing losses

Neutral Risk Appetite

balancing risk and reward in pursuit of both long-term stabilitiy and growth

Risk Tolerance

acceptable variance in outcomes related to specific performance measures

Risk Assessment

- structured method of understanding risk

Identification -> Analysis -> Evaluation -> Response

Risk Analysis

process of determining likelihood, impact, and risk level

Risk Evaluation

process of comparing result of risk analysis with the organization's risk appetite and risk tolerance

Inherent Risk

level of risk before controls are implemented

Residual Risk

level of risk after controls are implemented

4 Options for Risk Assesment Frequency

ad hoc, recurring, one time, continuous

Qualitative Risk Analysis

- uses well-define descriptiver terminology to indicate likelihood, impact, and residual risk

- good for when there are non-tangible elements of risk (e.g. reputation)

Quantitative Risk Analysis

assisgns numerical values to all elements of the analysis

AV (Asset Value)

monetary value of the resource

EF (Exposure Factor)

percent of the asset value that would be impacted

SLE (Single Loss Expectancy)

- SLE = AV X EF

- financial impact of a single event

ARO (Annualized Rate of Occurence)

how many times and event is expected to occur within a single year

ALE (Annual Loss Expectancy)

ALE = SLE X ARO

- financial impact on an annualized basis

Risk Response

the responsibility to determine how to respond to the outcome of a risk analysis

Risk Treatment

to select one or more options for addressing an identified risk

4 Risk Treatment Options

Avoid, Transfer, Mitigate, Accept

Avoid Risk

eliminate the cause or terminate the associated activity

Transfer Risk

- assign the risk to another party, generally via insurance

- typically done when the likelihood is low but the impact is high

Mitigate Risk

reduct the impact or likelihood by implemented controls or safeguards

Accept Risk

acknowledge and accept the level of risk and monitor it

Risk Exception

formal acknowledgment that a risk has been identified but its not feasible/practical to implement controls

Exception Handling

process of approving an exception on a temporary or permanent basis

Risk Exemption

- formal decision not to address a risk at all

- when potential impact is low and mitigation cost is disproportionate to impact

Risk Monitoring

continuous activity used to identify trends, failures, or opportunitites and respond in an efficient and appropriate manner

Risk Reporting

process of communicating real-time risk and performance data to stakeholders

Risk Register

dynamic, central repository for all risk-related documentation, tracking, and accountability including acceptance, exceptions, and exemptions

Heat Map

visualization tool to convey likelihood of impact

Dashboard

visualization tool to convery security posture

Metrics

predefined measures usually int he form of KRIs (Key Risk Indicators

KRI (Key Risk Indicator)

predictor of unfavorable events

Leading Indicator

- predicitive in nature

- looks forward at future outcomes

Lagging Indicator

- historical in nature

- looks back on what has happened

- based on historical measure to identify trends

BIA (Business Impact Analysis)

used to determine criticality and impact, recovery requirements, and recovery priority of system components and interdepencies

MTD (Maximum Tolerable Downtime)

maximum time a service can be down without causing significants damage to the business

- a.k.a Max Tolerable Outage

SDO (Service Delivery Objective)

- acceptable level of operations in alternate processing mode

- operations are less than normal but enough to sustain business functions until full recovery

RTO (Recovery Time Objective)

- amount of time allocated for system recovery before negatively impacting other systems

- combined RTO of all impacted systems should be less than MTD

RPO (Recovery Point Objective)

- the acceptable data loss

- the point in time, prior to the disruption that data can be recovered

MTTR (Mean Time to Repair)

- average time it takes to repair a failed component or device

- this metric typically comes from the manufacturer

MTBF (Mean Time Between Failures)

- measure of reliability (stated in hours)

- this metric typically comes from the manufacturer