Risk Management Fundamentals

Risk Management Fundamentals

• Risk is the likelihood of a loss occurring, triggered when a threat exposes a vulnerability.
• Organizations of all sizes face risks, some severe enough to cause business failure, others minor enough to accept without further thought.
• Key elements of risk are threat, vulnerability, and loss.
• A threat is any activity representing a possible danger.
• A vulnerability is a weakness.
• A loss compromises business operations.
• Risks can lead to a loss negatively impacting a business.
• Types of business losses include: compromises in business functions, compromises in business assets, and drivers of business costs.
• Business function compromises affect product/service sales, leading to revenue loss.
  • Examples include reduced sales representative capabilities (phone/email) or website outages.
• Compromise of business assets occurs when an asset has the potential of losing value. Assets are tangible (cost) and intangible (e.g., client confidence).
• Risk also drives business costs, which entails measures like antivirus software implementation to reduce risk.
• A method to examine risk is through seven typical IT infrastructure domains.
• These domains can be examined separately and represent potential targets for attackers.
• IT infrastructure domains are, user, workstation, LAN, LAN-to-WAN, WAN, remote access, and system/application.
• Vulnerabilities in one domain can put the entire system at risk.
• The user domain encompasses users, employees, contractors, and consultants—frequently the weakest link in IT security.
• Workstation computers are susceptible to malicious software (malware) if not kept updated with patches.
• The LAN domain is inside the firewall, and devices must have protection to prevent risk.
• The LAN-to-WAN domain connects to the wide area network (WAN), which is treated as an untrusted zone.
• Remote access domains allow access when workers are away from the company and often involve dial-up or VPN connections.
• The WAN domain is the Internet and hosts are at high risk of attack.
• The system/application domain refers to mail, database, application, and domain name servers.
• A threat exploiting a vulnerability results in a loss. Impact identifies loss severity.
• These threats are always present, and although not eliminable, they can be controlled.
• Protection of confidentiality, integrity, and availability (CIA triad) are common security objectives
• Risk management practices involve identifying, assessing, controlling, and mitigating risks.
• Identifying relevant risk threats and vulnerabilities for an organization is an important initial step.
• Risk management includes elements: Risk assessment, identifying risks to manage, selection of controls, implementation and testing of controls, and evaluating controls.
• Identifying risks requires determining threats, identifying vulnerabilities, and estimating exploit likelihoods.
• Risk management techniques involve taking steps to avoid, transfer, mitigate, or accept risk and employing a cost-benefit analysis.
• Residual risk is the risk that remains after applying controls.
• The primary risk management technique is risk mitigation (risk reduction/treatment).

Threats, Vulnerabilities, and Impact

• Threats are attempts to exploit vulnerabilities that result in loss of confidentiality, integrity, or availability.
• Threats are always present and cannot be eliminated—mitigation can manage potential.

Understanding and Managing Threats

• Threats are part of the risk equation (Risk x Vulnerability = Threat).
• Threats can be uncontrollable (natural events, human error, and simple accidents), intentional (hostile acts), or unintentional.
• Organizational risk management plans can reduce operational impacts.

Understanding and Managing Vulnerabilities

• Vulnerabilities are weakness in assets, systems, or processes.
• Vulnerabilities can be mitigated by reducing occurrence rates/loss impact.
• Mitigation techniques should consider technique value, initial cost, and ongoing costs.

Understanding and Managing Exploits

• Exploits are the act of taking advantage of a vulnerability to gain an advantage.
• Understanding exploits is important for risk reduction.

Best Practices for Managing Threats in Your IT Infrastructure

• Best practices include establishing security policies, obtaining insurance, implementing appropriate access controls, using automation tools, providing training, and implementing antivirus software.
• Protect the boundary of your IT infrastructure, using firewalls.