Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Risk Management Concepts and Frameworks
What risk is
ISO 31000 defines risk as the effect of uncertainty on objectives. For information security, risk exists when something of value could be harmed because a threat could exploit a weakness:
Take away any ingredient and the risk shrinks. That’s what controls do: they remove vulnerabilities, deter threats or limit impact. Risk is usually expressed as a combination of likelihood and impact.
| Term | Meaning |
|---|---|
| Asset | Anything of value: data, systems, people, reputation |
| Threat | A potential cause of harm: an attacker, an error, a flood |
| Vulnerability | A weakness a threat can exploit |
| Likelihood | How probable the event is |
| Impact | The harm if it happens: financial, legal, customer, safety |
| Control | A measure that reduces likelihood or impact |
The risk management life cycle
- Establish context: scope, business objectives, risk criteria (scales) and appetite.
- Identify: assets, threats, vulnerabilities and risk scenarios.
- Analyse: likelihood and impact, considering existing controls.
- Evaluate: compare with appetite and prioritise.
- Treat: mitigate, transfer, avoid or accept.
- Monitor and review: track risks, controls and changes; reassess.
Communication and consultation with stakeholders run through every step. The aim isn’t to eliminate risk but to keep it within the organisation’s appetite while supporting business objectives.
Frameworks you’ll meet
| Framework | What it gives you |
|---|---|
| ISO 31000 | Principles and a process for managing any kind of risk |
| ISO/IEC 27005 | Information security risk management, supporting an ISO 27001 ISMS |
| NIST SP 800-30 | Guidance on conducting IT risk assessments |
| NIST SP 800-37 / 800-39 | The Risk Management Framework for systems; managing risk across the organisation |
| COSO ERM | Enterprise risk management linked to strategy and performance |
| FAIR | A quantitative model expressing risk as the probable frequency and magnitude of loss, in money |
| ISACA Risk IT | IT risk governance and management, aligned with COBIT |
Why one method matters
If IT rates risks on a 3-point scale and finance on a 5-point scale with different impact bands, the board can’t compare them. The security manager should use the organisation’s enterprise risk method, or align with it, so information risks sit alongside credit, operational and strategic risks.
Example. A company adopts ISO 27005 for information risk but calibrates its impact bands to the finance team’s ERM scale. For the first time, the board’s top-ten list mixes cyber, credit and supply-chain risks on equal terms.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Purpose of information risk management | Keep risk within appetite while supporting business objectives |
| First step in the risk management process | Establish context: scope, criteria and appetite |
| A quantitative risk framework | FAIR |
| Standard for information security risk management | ISO/IEC 27005 |
| Benefit of a common enterprise method | Risks can be compared and prioritised across the organisation |
In short
- Risk is the effect of uncertainty on objectives; information risk arises when a threat can exploit a vulnerability to harm an asset.
- Risk is usually expressed as a combination of likelihood and impact.
- The risk life cycle: establish context, identify, analyse, evaluate, treat, and monitor, with communication throughout.
- Common frameworks: ISO 31000 (general), ISO 27005 (information security), NIST SP 800-30 and 800-39, COSO ERM, FAIR (quantitative) and ISACA Risk IT.
- The purpose of information risk management is to keep risk within the organisation's appetite while supporting business objectives.
- A consistent, organisation-wide method lets information risks be compared with other business risks.
Exam traps
- Risk management aims to keep risk acceptable, not to eliminate it.
- Establishing context (scope, criteria, appetite) comes before identifying risks.
- A vulnerability with no credible threat, or a threat with nothing to exploit, carries little risk.
- Using different methods in different departments makes risks impossible to compare.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What risk is
ISO 31000 defines risk as the effect of uncertainty on objectives. For information security, risk exists when something of value could be harmed because a threat could exploit a weakness. Take away any of those ingredients and the risk shrinks.
The risk management life cycle
Frameworks you'll meet