Lesson 15: Explain Risk Management Processes

Risk Identification

The process of finding and listing things that could cause problems

Risk Assesment

The process of finding possible problems and figuring out how to reduce or prevent them.

Risk Analysis

The process of figuring out how likely a risk is to happen and how serious the damage would be.

Quantitative Risk Analysis

A way to use numbers to measure how likely a risk is and how much damage it could cause.

Qualitative Risk Analysis

The process of using logic and judgment to decide how likely a risk is and how bad it could be when you don’t have exact numbers.

Inherent Risk

The risk a threat would cause if nothing was done to stop it

Risk Management Strategy

A proactive and organized process that involves finding risks, evaluating how serious they are, deciding which ones to focus on, and taking action to reduce their impact

Risk Responses

• Avoid

• Accept

• Transfer

• Mitigate

Residual Risk

The risk that’s left over after you’ve taken steps to reduce or control it.

Risk Appetitie

The amount of risk an organization is willing to accept in order to achieve its goals.

Risk

A measure of threats, vulnerabilities, impact, and probability

Risk Register

A list or document that keeps track of all the risks an organization has identified, along with details about each one.

Risk Threshold

The limit of how much risk an organization is willing to live with before it must take action.

Key Risk Indicators (KRIs)

Predictive indicators for monitoring and predicting potential risks

Business Impact Analysis

The process of figuring out how much damage a business would suffer if important systems or operations stopped working.

Maximum Tolerable Downtime (MTD)

The longest amount of time a business can afford to have a system or process down before it causes serious damage.

Recovery Time Objective (RTO)

The amount of time you aim to recover a system or service after a disruption

Work Recovery Time (WRK)

The amount of time needed after systems are restored to get everything fully working again

Recovery Point Objective (RPO)

The maximum amount of data a business is willing to lose in a disruption, measured in time.

Third Party Vendor Assessment

When a company checks how safe and trustworthy another company is before working with them

Conflict of Interest

When a person or group has a reason to put their own benefit first, which could make it hard to stay fair or honest in their decisions.

Vendor Assessment Method

The different ways a company can check and evaluate how secure, reliable, and compliant a vendor is before or during a business relationship.

Vendor Assessment Methods

• Evidence of Internal Audits

• Independent Assessments

• Penetration Testing

• Supply Chain Analysis

• Right to Audit Clause

Evidence of Internal Audits

The documents, records, or findings that show an internal audit was done and what it found.

Independent Assessments

Outside reviews done by someone not directly involved in the work or system being evaluated

Penetration Testing

When security experts simulate a real cyberattack to find and fix weak spots in a system before hackers can exploit them.

Supply Chain Analysis

The process of examining every step involved in getting a product or service from the supplier to the customer to understand how it works and where risks or improvements can be made.

Right-to-Audit Clause

A part of a contract that gives one party the legal right to review or inspect the other party’s records, systems, or processes to make sure they’re following the rules.

Vendor Monitoring

Regularly checking vendors to make sure they’re still following security rules, legal requirements, and contract terms.

Memorandum of Understanding (MOU)

A nonbinding agreement that explains what two or more parties plan to do together, including their shared goals and the basic terms of cooperation.

Nondisclosure Agreement (NDA)

An agreement that says you won’t share confidential information with anyone who isn’t allowed to know it.

Memorandum of Agreement (MOA)

A formal, legally binding agreement that clearly defines each party’s goals, roles, responsibilities, and resources.

Business Partnership Agreement (BPA)

Agreement by two companies to work together closely

Master Service Agreement (MSA)

The overall terms and conditions that will apply to all future contracts or projects between two parties.

Service-level Agreement (SLA)

A detailed agreement that says how well a service must be delivered

Statement of Work (SOW)

A detailed document that explains exactly what work will be done, who will do it, when, how, and for how much.

Work Order (WO)

A shorter document that gives the green light to start a specific task or job

Rules of Engagement (RoE)

Guidelines outlining how parties will interact

Attestation

Proof that your security measures are in place and effective.

Internal Assesment

A self-review done by an organization to check how well its processes, systems, or controls are working

External Assessment

A review or evaluation done by an outside party to check if an organization’s systems, processes, or controls meet required standards, laws, or best practices.

Ethical Hacking

A security expert (ethical hacker) uses hacking skills legally to test an organization’s defenses and help improve security.

Active Reconnaissance

Actively probing and interacting with target systems and networks to gather information

Passive Reconnaissance

The process of gathering information about target systems and networks without touching them, by using publicly available data or watching traffic quietly.

Known Environment Penetration Testing

The tester has detailed knowledge of the target system or network

Partially Known Environment Penetration Testing

The tester has limited knowledge about the target system or network

Unknown Environment Penetration Testing

The tester has little to no prior knowledge about the target system or network

Offensive Penetration aka “Red Teaming”

A safe way to attack your own system to find and fix weaknesses before real hackers do.

Defensive Penetration Testing aka “Blue Teaming”

Tests how good your organization is at spotting and stopping attacks.

Physical Penetration Testing

Checking how easy it is for someone to physically break in or bypass security at a site.

Integrated Penetration Testing

Combines different types of penetration testing techniques to evaluate an organization’s security operations