Risk Management Fundamentals

Risk Management Fundamentals

• Risk is the likelihood of a loss occurring when a threat exposes a vulnerability
• Organizations of all sizes face risks, some severe enough to cause business failure, others minor and easily accepted
• Key components of risk are threat, vulnerability, and loss
  • Threat: Any activity representing a possible danger
  • Vulnerability: A weakness in a system
  • Loss: A compromise to business operations
• Risks to a business result in negative effects that can compromise business functions, assets, and overall costs
• Business function compromise examples: Sales capabilities reduced (e.g., phone or email), website attack resulting in lost sales
• Business asset compromise examples: Tangible assets (e.g., physical equipment) or intangible assets (e.g., client confidence), with potential value loss
• Driver of business costs examples: Implementing countermeasures or controls to manage risk (e.g., antivirus software)

IT Infrastructure Risk Components

• Examining typical IT infrastructure domains—seven domains

  • User domain: Users, employees, contractors, consultants
  • Workstation domain: End-user computers; susceptible to malware
  • LAN domain (within firewall): Local area network; individual devices must be protected or all are at risk
  • LAN-to-WAN domain: Connects LAN and WAN; LAN is trusted zone, WAN is untrusted
  • Remote access domain: Access for remote workers; protected area between trusted zone and untrusted zone
  • WAN domain (Internet): Untrusted zone with significant risk to public IP hosts
  • System/application domain: Servers hosting applications like email and databases

• Attackers only need to exploit vulnerabilities in one domain to cause significant impact

Threats, Vulnerabilities, and Impact

• Threats exploit vulnerabilities resulting in loss; impact assesses severity of loss
• A threat is any circumstance or event with potential to cause loss; always present but can be controlled
• Threats are attempts to exploit vulnerabilities, resulting in loss of confidentiality, integrity, or availability of an asset
• Confidentiality, integrity, and availability (CIA) are key security objectives for information systems

Risk Management and Importance

• Risk management involves identifying, assessing, controlling, and mitigating risks
• Identifying relevant threats and vulnerabilities to the organization is crucial for reducing losses
• Risk management aims to identify risks and implement controls to minimize them

Risk Management Elements

• Risk assessment
• Identifying risks to manage
• Selecting controls
• Implementing and testing controls
• Evaluating controls

Identifying Risks

• To identify risks, identify threats and vulnerabilities
• Estimate the likelihood of threats exploiting vulnerabilities

Risk Management Techniques

• Choosing how to handle a risk: avoid, transfer, mitigate, or accept
• Cost-benefit analysis (CBA): Helps determine the best controls for implementation

Residual Risk

• Residual risk is the risk that remains after applying controls

Summary

• Risks occur when threats exploit vulnerabilities, impacting business functions, assets, and costs; risk management helps identify and reduce these risks
• Initial steps for risk management: Identify threats and vulnerabilities and pair to identify risk severity

Managing Risks

• Risk can be managed by avoiding, transferring, mitigating, or accepting the risk
• Risk mitigation is also known as risk reduction or risk treatment; vulnerabilities are reduced by implementing controls

Managing Threats

• Threats are part of the risk equation (Risk x Vulnerability = Threat)
• This section includes types of threats (unintentional, intentional)
• Unintentional threats (environmental, human errors, accidents) can be managed through insurance, error reduction, prevention, and avoidance.
• Intentional threats (greed, anger, desire to damage) are often motivated by these factors

Managing Vulnerabilities

• A vulnerability is a weakness in an asset or environment; can be a flaw in any system/business process.
• Vulnerabilities can be mitigated by reducing their occurrences/injuries or the resulting impact from them
• Mitigation techniques must consider their initial and ongoing costs

Exploits

• Exploits occur when threats leverage vulnerabilities
• An exploit is the act of exploiting a vulnerability by leveraging a vulnerability against a system