Risk Management

What Risk Management Covers

When we talk about a security program or a risk management program, we're really mitigating against risk in both cases. Well, what type of risk do we have? The CIA Triad gives us some element of what we're talking about from a risk perspective. The C stands for confidentiality, the I stands for integrity, and the A stands for availability. This is what we're trying to incorporate into the infrastructures that we're managing, and so from this perspective, a lack of confidentiality, or a lack of integrity, or a lack of availability is really what we're guarding against.

Now, I love the CIA Triad, but risk management goes beyond just the CIA Triad. When it comes to the CIA Triad we're really talking about technology, we're really talking about the services that we're offering, we're talking about the data that we're storing and making sure that those remain confidential, and the integrity involved in it, and the availability. But there are other risks to the business that risk management addresses.

Terms Around Risk

To a large degree, risk management is protecting assets. We have some sort of asset — in this case maybe it's data — and so risk management is all about protecting that data, protecting us against the risk to that data.

Those assets have some sort of threat to them. A threat is something that could happen to that data. In this case, data could be stolen, it could be altered, or it could be deleted. From a CIA Triad standpoint, stolen has to deal with confidentiality: if it's stolen, somebody has access to view that information, and that could be bad and devastating. Or it could be altered, which attacks the integrity of it. Or it could be deleted, which attacks the availability. There are other things that can happen as well — maybe it's not deleted, but maybe it's just offline for a while, and that would be attacking availability as well. The point is that there is some sort of threat to this data.

Then we have a threat agent or actor. This is an entity, or an organization, or maybe it's a single person, whoever is carrying out the attack. They're the ones who are stealing or altering or deleting, and that's the threat agent or threat actor.

Risk is actually an equation. It's a function of the probability — what's the likelihood that something's going to happen — times the impact, what will be the impact if it does happen. For instance, let's say this threat agent were to steal this asset. What's the impact that's going to have, and what is the probability that it's going to happen? Maybe we're not so secure in holding this asset, so the probability is pretty high, but maybe the impact is low — maybe it's just some data that doesn't really matter all that much. That's going to play into what the risk of this happening is. Or if the probability is high and the impact is high, then our risk suddenly goes up with that.

Mitigation is putting steps into place that are going to help mitigate that threat. In this case right here we have put up a wall and a gate to access this data. What this essentially does is lessen the risk, and the way we lessen the risk is either lessen the probability that this is going to happen or lessen the impact if it does happen. So in the case of stealing, what we've done is we put a wall in place, reducing the probability that this will happen, therefore reducing the risk. To reduce the impact, maybe we delete some of the data that we no longer need, and so that deletes the impact this would have, and that reduces the risk as well.

A vulnerability is when there's some sort of weakness in the system. Maybe in this case right here we have a break in the gate, or maybe the lock of this gate is not very good, and so we have some sort of vulnerability. Exploitation is when the threat actor or agent uses that vulnerability and leverages it to try to get access, or to try to use it for whatever purpose they're trying to use it for. So in this case right here we've got a break in the gate, and this threat actor is going to exploit that, or use that to their advantage.

If the threat actor is successful, now we have a breach. Maybe they've stolen this data, so they have successfully broken into our network — that's the breach part of this — and carried out that threat.

Risk Management and Controls

Risk management is the processes and things that we use to manage the risk. We've already mentioned what we want to do: we want to mitigate the risk, we want to reduce the risk. So the risk management process helps identify what the risk is and reduce that risk, and really we're reducing the probability and impact, and we're doing that by implementing controls.

Now, there are different definitions of what a control is, but in this case we're going to use control as putting steps in place to mitigate risk. So in the example that I'm giving right here, the gate that I'm putting up and the wall that I'm putting up there is a control that we're putting into place to mitigate this risk, or reduce the risk, by reducing the amount of probability. If I put another control in place which says we're going to delete data we're no longer using, then we're reducing the impact. That's another control I put into place to reduce the risk.

Risk Management Within Security Operations

There is security operations, which is all about risk management. These are the different operations that we want to carry out as part of security operations: we want to go into compliance management, we want to do asset acquisition and management, we want to do vulnerability and patch management, we want to do vendor and supply chain management. All of these really are all about risk management.

So what's different about risk management? What are we talking about here? We have all of these other things that we're doing as part of our security operations that could be categorized as risk management. I like to think of it as two different subroutines. Number one: even when we're doing, let's say, vendor management, where we're managing different vendors, we have to have a common way that we're going to measure risk across all of these different functions. So the first subroutine is creating that measurement — part of risk management is creating a measurement by which we're going to gauge risk. The second thing is a risk assessment that we're going to be performing. We're going to be performing risk assessments on our network, maybe even a full-on risk assessment once a year, and then ongoing risk assessment throughout the year. So we're going to take a look at these two different subroutines — measuring risk and doing risk assessment — as part of this risk management.

Scope of Operations

Another thing that's a little bit different about risk management is the scope of operations. When we're talking about these other different functions as part of our security operations — for instance, let's say we're evaluating assets — usually we're digging down into our technical assets and some of our other assets that we have for the company, and a lot of times they have to deal with cyber security and information security and data security and network security. We're not going to get into the definitions of all of that, but essentially, when we're talking about risk management we take a broader scope. We're looking at all risk for all of the company and the organization, not just in these specific areas.

Let's look at an example of this. Let's say we are number one in our industry. Maybe we're cranking out widgets, and we're doing it in an excellent way, and sales are booming, and we're number one in the industry. One of the risks that we have is that somebody could come by and develop widgets in a much better way, or maybe the widget itself changes and it's much more marketable. Something has happened where we now get dislodged from number one and maybe we now drop to number three. That's a risk to the business, and a lot of our other security operations that we do might not even catch that as being a risk.

So what risk management does is it takes this big overall scoping thing — this is our organization, what is everything that can happen to our organization that puts it at risk? In this example, one thing that could happen is that we could have a competitor that comes out with a better product, or can develop it faster, or can develop it with better quality, or could somehow develop these widgets so that they outperform us, and then we become irrelevant in our industry.

Risk Management Versus Vulnerability Management

The scope can really be seen when we're talking about things like risk management versus vulnerability management. These two terms can seem like they overlap quite a bit, and in fact they do overlap quite a bit — they're definitely closely related. In fact, NIST 800-53, a set of controls, a framework for setting up your cyber security operations, really groups these both under risk management.

I like to think of them as two separate operations, because really, in my experience, they are set apart from each other. When it comes to risk management we're looking at the overall risk to the company, whereas with vulnerability management we're looking at weaknesses in technology. It has to do with risk to the business or organization versus the technology we use and what the different weaknesses of those different technologies are — which is certainly a risk to the business, and that's one reason why a lot of times it's seen as a subset of risk management.

Usability Versus Security Requirements

Let's also address the usability of these systems versus the security requirements of those systems, because there is a balance between those. The most secure I could make, let's say, a network is I could go and unplug it from the internet and just unplug everything, and so now you don't have any connectivity. That is being super secure. It is really taking very little chance and really removing all of the risk, or almost all of the risk, from something being compromised. But the usability is going to be really poor. We have those systems in place, we have that data in place, we have those things in place to help us operate as a business, and so we're constantly battling this usability for our end users and the system requirements from a security perspective.

Most importantly, this is going to turn into some sort of actionable item. Just measuring or assessing risk by itself is not something that's going to be very useful for us unless it turns into some sort of action.