Risk Management and Risk Assessment Services
CyberSecOp work with you team to developing an effective risk management program is important in building an information security program. Risk management activities will take into account people, business processes (information handling), and technology.
Risk management is an activity directed towards assessment, mitigation, and monitoring of risks to an organization. Information security risk management is a major subset of the enterprise risk management process, which includes both the assessment of information security risks to the institution as well as the determination of appropriate management actions and established priorities for managing and implementing controls to protect against those risks.
Risk Management Approach and Plan
Our risk management process involves setting institutional priorities and making key decisions in regards to what is sometimes called the institution's "appetite for risk". Primary direction in making decisions about risk acceptance needs to come from institutional leadership. Information security organizations may manage the risk management program but it's necessary to consult with institutional leadership about handling risks that cannot effectively be reduced or mitigated. The Risk Management Framework provides useful guidance to assist with developing these processes.
Evaluate and select risk management methods:
ISO/IEC 27005:2011 provides guidance in establishing a risk management program, and describes how to implement each phase of risk management (identification, assessment, treatment, monitoring and review)
NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission and Information System View, describes the fundamentals and the process of completing risk assessments
NIST Special Publication 800-30 Revision 1 is a Guide For Conducting Risk Assessments
ISO/IEC 27002:2013 is an international standard that assists organizations with evaluating information security controls and performing risk treatment activities
NIST Special Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework, offers guidance in evaluating controls and applying risk treatment methods
The HEISC Risk Management Framework is closely aligned with the guidance provided in the NIST publications cited above
ISO/IEC 27005:2011, used in combination with the above framework, provide a complementary and comprehensive approach to identifying, assessing, and treating risks
Risk Management process can be broadly divided into two components:
Risk assessment
Risk treatment
Risk assessment identifies, quantifies, and prioritizes risks against both criteria for risk acceptance and objectives relevant to the organization. The assessment results guide the determination of appropriate management action and priorities for managing information security risks and for implementing controls selected to protect against these risks. The assessment should include both a systematic approach to estimating the magnitude of risks and a process for comparing estimated risks against risk criteria to determine the significance of the risks.
scope of a risk assessment
The scope of a risk assessment can be either the whole organization, parts of the organization, an individual information system, or even specific system components or services. Performing a risk assessment in areas that include technology infrastructure also includes performing vulnerability assessments to help quantify risks. This process of assessing risks and vulnerabilities will need to be performed at recurring intervals, especially if an incremental approach is selected, to ensure that comprehensive and effective results are obtained. This will also ensure that constantly evolving changes in security requirements and/or significant changes are assessed. For example, IT will be implementing new products or services each year and new or additional risks may be introduced due to vulnerabilities that can be exploited.
Risk Treatment & Risk Management
Once a risk assessment is completed, risk treatment is the next step in the process. For each of the risks identified during a risk assessment, a risk treatment decision needs to be made. Possible options for risk treatment include:
Knowingly and objectively accepting risks, providing they clearly satisfy the organization's policy and criteria for risk acceptance;
Applying appropriate controls to reduce the risks;
Avoiding risks by not allowing actions that would cause the risks to occur;
Transferring the associated risks to other parties, e.g. insurers or suppliers.
Controls should be selected to ensure that risks are reduced to an acceptable level. Take into account applicable federal, state, and local statutes as well as other binding regulations. Additionally, consider institutional goals and objectives, operational requirements and constraints, the cost of implementing effective controls relative to potential harm of not implementing them, and the costs likely to result from one or more security failures.
It should be kept in mind that even after mitigating all current risks, achieving a 'state of complete security' is unlikely. Making continuous improvements through ongoing risk management activities will make a very positive impact.
A vulnerability assessment is basically an inventory of all vulnerabilities that is often thought of as a technical examination (e.g., network scanning). However, a complete vulnerability assessment would include the network, mission critical systems, physical environments, and processes.
The risk assessment considers those vulnerabilities in light of the other aspects of the risk formula - threats and impact (which includes the concepts of both asset and value) - in order to prioritize the potential mitigations that might be applied.
Risk management encompasses risk assessment and vulnerability assessment along with the mitigation. It also includes measuring the outcome of the process, and repeating the process again and again.
Expand the information security risk management program:
Adopt specific methodologies described in the standards and guidelines listed in #1 above
Complete a formal information security risk assessment across the organisation
Take a phased or incremental approach if the institution is large or has decentralized IT operations
Outsource risk assessments to third party service providers if you don’t have resources to perform them
Reevaluate risks and vulnerabilities on a recurring basis as each risk assessment is a ‘snapshot’ at a point in time
Explore the use of GRC solutions that can assist with developing a formal risk management system.
Security Solutions We can work with your team to deploy GRC solutions.
Review review of current state and a periodical base
Cyber Security Operations Consulting provides the technology and systematic method to identify all risks that impact your organization and automate risk scoring using dynamic models.
IT Risk Management Audit/Assurance Program
Risk Register: Define potential risks associated with activities across the enterprise. Capture everything from vendor interactions, finance, to sales and marketing activity.
Risk Assessments: Stakeholders from across your business rate risk dimensions such as impact and likelihood using a configurable risk computation scale.
Risk Modifiers: Activity-based risk drivers are added as modifiers to risk scores to capture additional business-driven risk factors.
Final Risk Scoring: Customizable algorithms compute weighted risk scores for use on dashboards & reports.
