01. Emerging Risk and Threat Landscape Flashcards
Emerging Risk and Threat Landscape
What is the fundamental undertaking for any organisation that desires to be reasonablly aware of risks
Risk Management
120
Emerging Risk and Threat Landscape
Risks that are not identified or monitored could result in these 3 things being Jeopardised
- U ____ B ____ L ____
- L ____ of L ____
- S ____ of the business
- Unexpected business losses
- Loss of life
- Survival of the business
120
The Importance of Risk Management
Risk management represents time proven methods and techniques used in;
- I ____ risks
- Understand P____ of occurance
- Understand potential I____
- Make D____ about risks based on established criteria
- M____ key attributes of security and risk
- Produce long term trend R____ to executive management
- Identify
- Proability
- Impact
- Decisions
- Measure
- Reporting
120
The Importance of Risk Management
The effectiveness of a risk management program is largely dependent on two factors
- S ____ from ____
- O ____ C ____
- Support from executive management
- Organisational culture
121
The Importance of Risk Management
Risk management is based on several factors
- Culture
- Mission, objectives, and goals
- Management Structure
- Management Support
- Industry sector
- Market conditions
- Applicable laws, regulations, and other legal obligations
- Stated or unstated risk tolerance
- Financial health
- Operating locations
121
Outcomes of Risk Management
An organisation that implements an effective risk management program will have heightened awareness of
Use of technology, and how it can impact the business
121
Outcomes of Risk Management
The greatest benefit an organisation can derived from an effective risk management program in relation to security incidents
Lower probability of security incidents
Those that do occur, a better prepared state, reducing impact
121
Risk Objectives
A vital part of risk management strategy development is the determination of desired…
Risk Level
121
Risk Objectives
One important input into risk management strategy development
Understanding current level of risk and desired future state
121
Risk Management Technologies
Organisations without effective risk management programs often acquire technologies without first..
Identifying specific, relevent risks and do so based on;
- Salespeople (false claims)
- Security managers of other organisations
- Articles in trade publications
122
Implementing a Risk Management Program
There are several risk management frameworks to choose from which share the common principles
- RIsk management being a life cycle process
- period assement requirements
- Aim for continuous improvement
123
Implementing a Risk Management Program
Applying a risk management framework in an organisation will require an understanding of the organisations…
- Mission
- Objectives
- Strategies
- Cultures
- Practices
- Structure
- Financial condition
- Risk Appetite
- Level of executive management support
123
Implementing a Risk Management Program
Enterprise Risk Management (ERM) and Information Risk Management programs share concepts and techniques
They often work together, but deal with different subject matter
123
Risk Management Strategy
The objective of a risk management strategy is to…
Identify all credible risks and reduce them to an acceptable level
123
Risk Management Strategy
The acceptable level of risk is generally related to…
- Executive management risk appetite
- Organisations ability to absorb losses (and ability to build defences)
- Regulatory and legal requirements
124
Risk Management Strategy
The primary means of mitigating risks by ensuring desired outcomes
Controls
124
Risk Management Strategy
A key objective of a risk management strategist in organisations with smaller pockets of risk management programs or an Enterprise Risk Management program
Alignment
124
Risk Management Strategy
Key internal and external factors will govern the implementation of risk management objectives
- Culture
- Organisational Maturity
- Management structure
- Management support
- Market conditions
- Regulatory and Legal requirements
124
Risk Management Strategy
The most important factor that will enable or contrain security managers as they develop a risk management strategy
Development of key relationships throughout the organisation
124
Risk Communication
Risk management must be introduced to the organisations key stake holders, and not work in secrecy, to help them understand…
The role of risk management in the organisation and the role they will play to help the program achieve its objectives
124
Risk Communication
Communication channels should be open at all times and operate in..
all directions
125
Risk Communication
Successful information risk programs operate through transparency. Information about risks should be…
readily available to all board members, executives, stakeholders, and risk owners
125
Risk Awareness
A goal of risk awareness is to ensure business leaders and decision makers understand business decisions have a risk component. Formal information risk management programs will include..
Processes and techniques for making risk-aware decisions
125
Risk Awareness
There is an overlap in content and audience of security awareness and risk awareness.
1. Security awareness applies to…
2. Risk awareness encompasses…
- Entire organisations
- Senior personnel involved in risk management
125
Risk Consulting
Security managers are often seen to play the role of security and risk consultant. They are regarded as technology risk experts who..
are available to consult with on a wide variety of issues
125
Risk Consulting
Key attributes to make a good information risk consultant
- Ability to listen to business leaders and understand what was requested
- Ability to assess information and understand its impact on process or business
- Have a holistic understanding of the business
125
Risk Management Frameworks
When building an information risk management program, the security manager needs to develop…
- Processes and procedures
- Roles and responsibilities
- Templates for business records
125
Risk Management Frameworks
High quality industry risk management frameworks
- ISO/IEC 27001
- ISO/IEC 27005
- ISO/IEC 31010
- NIST SP 800-37
- NIST SP 800-39
- COBIT 2019
- Risk IT Framework
- RIMS Risk Maturity Model
126
Risk Management Frameworks
Risk managers can take 2 main approaches when considering existing frameworks
- Use a single framework that best aligns to the business
- Use elements from one or more frameworks to build an organisation risk management program
126
Risk Framework Components
Risk management frameworks have a common core set of components
- Program scope
- Information risk objectives
- Information risk policy
- Risk appetite/tolerance
- Roles and responsibilities
- Risk management life-cycle process
- Risk management documentation
- Management review
126
Integration into the environment
To be effective, the risk management program needs to..
Fit into and align with the organisations existing policies, processes, and systems and to minimise the impact to the organisation
126
Risk Management Context
The security manager and executive management must define…
the boundaries within which the risk management program will operate
- Business units, lines of business, locations and regions
- Participants and stakeholders
- Roles and responsibilities
- Risk appetite and tolerance
127
Three levels of risk management
Risk management is best divided into three tiers
- Enterprise-level risks
- Process-level risks
- Asse-level risks
- Generall risks associated with organisation culture and management. Risks typically conceptual in nature. ERM - Enterprise Risk Management
- Usually associated with effectiveness of business processes, typically those that affect cybersecurity posture.
- Risks associated with individual systems or small groups of systems.
128
Three levels of risk management
Risks at one tier sometimes inform adjacent risks. A surge in asset level risks may indicate defects in process level risks.
Gap Analysis
When a security manager is developing actual plans for implementing components of the information risk management program, they must understand the current state of the program. They should conduct a gap analysis to..
determine which elements of the current state remain, can be disgarded, or should be replaced
129
External Support
External sources of information and expertise that a security manager can lean on when developing the risk management program
- Consultants
- Security round tables
- Organisation chapters
- Published information risk management practices
- Security industry news sources
- Research organisation reports
- Advisory services
- Training
- Books
- Conferences
- Intelligence services
130/131
Risk Management Lifecycle
Risk management is a cyclical process and formally defined in policy and process documents that define…
- Scope
- Roles and responsibilities
- Workflow
- Business rules
- Business records
132
Risk Management Lifecycle
Information risk management reslies upon risk assessments that consider..
Valid threats against the organisations assets, considering any present vulnerabilities
132
Risk Management Lifecycle
Risk treatment decisions about risks are made after weighing various risk treatment options. These decisions are typically made by..
a business owner associated with the affected business activity
132
The Risk Management Process
The risk management process consists of a set of structued activities that enable an organisation to manage risks systematically
- Scope definition
- Asset identification and valuation
- Risk appetite
- Risk identification
- Risk analysis
- Risk treatment
- Risk communication
132/133
The Risk Management Process
Risk Identification:
The organisation identifies a risk that comes from one of several sources including…
- Risk assessment
- Vulnerability assessment
- Threat advisory
- Risk analysis
- An overall or focused risk assessment
- Security scans, pentest, source code scan
- Advisory from product vendor, threat intelligence feed, or news story
- Analysis of a risk may uncover other associated risks
132
The Risk Management Process
Risk analysis:
Risk analysis determines several characteristics..
- Proability of event occurrance
- Impact of event occurance
- Mitigation
- Recommendation
- Calculating the likelihood that an event associated with a risk will occur
- Determine the impact of each given risk. Can be evaluated qualitatively (high, medium, low) or quantitiatively (dolar value)
- Determines different methods and techniques (and possibly each associated cost) of risk mitigation
- Developed recommended course of action
133
The Risk Management Process
Risk treatment:
An individual decision maker or committee will make a decision about specific risk
- Accept
- Mitigate
- Transfer
- Avoid
- No action is taken
- Implement or take some form of action that serves to reduce the probability or impact of the risk occurrance
- Typically involves taking out an insurance policy
- Discontinuing the activity or technology associated with the risk
133
The Risk Management Process
A risk register is the primary business record used by most risk management programs. It will typically contain
- Description of the risk
- Level and type of risk
- Information relating to risk treatment options
133
