Summarize risk management processes and concepts Flashcards
Risk types
External Internal Legacy systems Multiparty IP theft Software compliance/licensing
External
External threat actors are one highly-visible source of risk. You must also consider wider threats than those of cyber attack. Natural disasters, such as the COVID-19 pandemic, illustrate the need to have IT systems and workflows that are resilient to widespread dislocation. The most critical type of impact is one that could lead to loss of life or critical injury. The most obvious risks to life and safety come from natural disasters, person-made disasters, and accidents, such as fire.
Internal
Internal risks come from assets and workflows that are owned and managed by your organization. When reviewing internal risks, it is important to remember that these can be classed as malicious and accidental or non-malicious. Internal threats can include contractors granted temporary access.
Legacy systems
Legacy systems are a source of risk because they no longer receive security updates and because the expertise to maintain and troubleshoot them is a scarce resource.
Multiparty
Multiparty risk is where an adverse event impacts multiple organizations. Multiparty risk usually arises from supplier relationships. If a critical event disrupts a supplier or customer, then your own organization will suffer. These are often described as ripple impacts. For example, if one of your top five customers goes out of business because of a data breach, your company will lose substantial revenue. Organizations in these supply chain relationships have an interest in promoting cybersecurity awareness and capability throughout the chain.
As an illustration of how risk assessments can change in view of multiparty relationship, consider a company that makes wireless adapters, originally for use with laptops. In the original usage, the security of the firmware upgrade process is important, but it has no impact on life or safety. The company, however, earns a new contract to supply the adapters to provide connectivity for in-vehicle electronics systems. Unknown to the company, a weakness in the design of the in-vehicle system allows an adversary to use compromised wireless adapter firmware to affect the car’s control systems. The integrity of the upgrade process now has an impact on safety, and is much higher risk.
IP theft
Intellectual property (IP) is data of commercial value that is owned by the organization. This can mean copyrighted material for retail (software, written work, video, and music) and product designs and patents. If IP data is exfiltrated it will lose much of its commercial value. Losses can be very difficult to recover in territories where there are not strong legal protections.
Software compliance/licensing
Breaking the terms of athe end user licensing agreement (EULA) that imposes conditions on installation of the software can expose the computer owner to substantial fines. License issues are most likely to arise from shadow IT, where users install software without change control approval. Network inventory management suites can report software installations on each host and correlate those with the number of license seats purchased. Licensing models can also be complex, especially where virtualization and the cloud are concerned. It is important to train the administrative staff on the specific license terms for each product.
Risk management strategies
Acceptance
Avoidance
Transference
Acceptance
Risk acceptance (or tolerance) means that no countermeasures are put in place either because the level of risk does not justify the cost or because there will be unavoidable delay before the countermeasures are deployed. In this case, you should continue to monitor the risk (as opposed to ignoring it).
Avoidance
Avoidance means that you stop doing the activity that is risk-bearing. For example, a company may develop an in-house application for managing inventory and then try to sell it. If while selling it, the application is discovered to have numerous security vulnerabilities that generate complaints and threats of legal action, the company may make the decision that the cost of maintaining the security of the software is not worth the revenue and withdraw it from sale. Obviously this would generate considerable bad feeling amongst existing customers. Avoidance is not often a credible option.
Transference
Cybersecurity insurance
Transference (or sharing) means assigning risk to a third-party, such as an insurance company or a contract with a supplier that defines liabilities. For example, a company could stop in-house maintenance of an e-commerce site and contract the services to a third-party, who would be liable for any fraud or data theft. Specific cybersecurity insurance or cyber liability coverage protects against fines and liabilities arising from data breaches and DoS attacks.
Cybersecurity insurance
Transference (or sharing) means assigning risk to a third-party, such as an insurance company or a contract with a supplier that defines liabilities. For example, a company could stop in-house maintenance of an e-commerce site and contract the services to a third-party, who would be liable for any fraud or data theft. Specific cybersecurity insurance or cyber liability coverage protects against fines and liabilities arising from data breaches and DoS attacks.
Mitigation
Risk analysis
Risk register Risk matrix/heat map Risk control assessment Risk control self-assessment Risk awareness Inherent risk Residual risk Control risk Risk appetite Regulations that affect risk posture Risk assessment types Likelihood of occurrence Impact Asset value Single loss expectancy (SLE) Annualized loss expectancy (ALE) Annualized rate of occurrence (ARO)
Risk register
A risk register is a document showing the results of risk assessments in a comprehensible format.
Risk matrix/heat map
A graphical table indicating the likelihood and impact of risk factors identified for a workflow, project, or department for reference by stakeholders.
Risk control assessment
A risk and control assessment is the process by which organisations assess and examine operational risks and the effectiveness of controls used to circumnavigate them.
Risk control self-assessment
Risk and control self assessment (RCSA) is a process through which operational risks and the effectiveness of controls are assessed and examined. The objective is to provide reasonable assurance that all business objectives will be met.
Risk awareness
To ensure that the business stakeholders understand each risk scenario, you should articulate it such that the cause and effect can clearly be understood by the owner of the asset. A DoS risk should be put into plain language that describes how the risk would occur and, as a result, what access is being denied to whom, and the effect to the business. For example: “As a result of malicious or hacking activity against the public website, the site may become overloaded, preventing clients from accessing their client order accounts. This will result in a loss of sales for so many hours and a potential loss of revenue of so many dollars.”
