Risk Management Flashcards
First Part of a risk assessment
Establishing the context - determine basic parameters and identity assets. Explores political and social enviroment in how the organisation operates. Provides baseline for organisations risk exposure. Senior management defines risk apetite and the acceptable level of risk. The last component of the first step is asset identification.
Threat Identification
A threat is is anything that might hinder or prevent an asset from providing appropriate levels of the key security services
Threat Sources
Natural acts of god, man made, accidental or deliberate.
How do you evaluate human threat sources
Motivation, capability, resources, probability, deterence. Previous expierence of attacks needs to be considered.
Vulnerability identification
Identify exploitable flaws in organisation. Determines applicability and significance of threat.
Need a combination of threat and vulnerability to create a risk. Outcome should be a list of threats and vulnerabilities with a brief description of how and why they might occur.
Analyse risks
Specify liklihood of occurance of each identified threat . specify concequence should threat occur. Derive overall risk rating to each threat.
Risk Formula
Risk = Probability threat occurs x Cost to Organisation
Qualatative or Quantatative ratings?
Qualatative, as it is hard to determine accurate probabilities and realistic cost concequence
Security Controls
Management, Operational, Technical
Management
These are security methods and policies put in place to manage the user and the system’s behavior.
Operational
These controls are implemented by people (as opposed to systems) and are designed to improve the security and integrity of information.
Technical
Also known as logical controls, these are safeguards incorporated into computer hardware, software, and firmware that mitigate access to systems and information.
Risk Liklihood
Rare (1), Unlikely (2), Possible (3), Likely (4), Almost Certain (5)
Risk Concequences
Insignificant (1), Minor (2), Moderate (3), Major (4), Catastrophic (5), Doomsday (6)
Risk Level
Extreme, High, Medium, Low
Risk Register
Results of risk analysis should be documented. Risks are sorted in decreasing level of order.
Aim of documentation is to provide management with the info to make decisions. Provides evidence a formal risk assessment has been conducted.
Headings are the following: Asset, Threat/Vulnerability, Existing Controls, Liklihood, Concequence, Level of Risk, Risk Priority
Judgement about risk treatment
Usually risks with higher ratings need action more urgently. however some risks are cheaper, easier and faster to address. Some risks with lower levels should be treated ahead of higher risks based on cost/technicality.
Risk Treatment alternatives
Risk Acceptance
Risk Avoidance
Risk Transfer
Reduce Concequence
Reduce Liklihood
Risk Acceptance
Choosing to accept risk levels greater than normal for business reasons
Risk Avoidance
Not proceeding with an activity or system which creates risk at the cost of convinience or ability
Risk Transfer
Sharing responsiblity of risk with a third party
Reduce Concequence
Modifying structure or use of asset to reduce impact
Reduce Liklihood
implement controls to reduce chance of vulernability being exploited.
